In this Help Net Security video, Vince Stoffer, Field CTO at Corelight, talks about how AI is changing work in the SOC and how attackers are using the same tools. He explains how LLMs help with vulnerability analysis and detection engineering, including writing SIEM rules and small programs that analyze packets or Zeek metadata. Those using agentic triage report faster work and fewer false positives, and junior analysts can dig deeper into network data.
Bringing AI into the SOC means watching for shadow AI and loose permissions
About this summary. This is a short excerpt from the description that Help Net Security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.helpnetsecurity.com/2026/10/21/bringing-ai-into-the-soc-video/
Source attribution: headline and facts are from Help Net Security (helpnetsecurity.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
From Investigation Failures to Reliable SOC Agents: Understanding and Improving LLM-Based Alert Triage
arXiv:2610.10608v1 Announce Type: new Abstract: Security operations centers (SOCs) must triage large volumes of alerts, most of which are benign, while missed attacks…
Abstract links automated response actions directly to SIEM detection rules
Abstract has announced new AI SOC capabilities in its agentic SIEM: investigation, hunt, and triage powered by a combination of Abstract’s own trained and tuned models…
Your Next Insider Threat Won’t be Human: Securing AI Agents From the Outside in
Why the controls on an AI agent have to live outside of it, and what a security operations team can implement and maintain those controls. The new privileged user in…
Swimlane connects custom detections to AI-led investigation and response
Swimlane has announced new capabilities in the Swimlane Turbine platform that allow security teams to run their own detection logic against large volumes of data and…
Quoting Terk Terkowitz
If your work does not benefit from current AI tooling, that is a finding, not a failing. Document why, share it with your community of peers, bring it to your manager…
Measuring Users' Security and Privacy Concerns About Third-Party Community Bots on Discord
arXiv:2610.36626v1 Announce Type: new Abstract: Third-party community-based bots are central to how social platforms such as Discord work. They moderate content, manage…