At Infosecurity Europe, Enterprise Times talked with Carl Pharoah, Senior Sales Director at Securonix. The topic was how to better integrate AI and humans in the SOC. It’s a challenge. Everyone is being told that AI will solve all the problems the SOC faces. But there are significant challenges in how we integrate it to get the most from our people and the AI.
Adding AI to automate the grunt work makes sense if it frees SOC analysts up to learn. The challenge is that while AI promises to automate the SOC, over-reliance risks creating a skills vacuum. How will Level 1 analysts learn and evolve their skills? Pharaoh says the answer lies not in full automation, but in a semi-autonomous model. Let AI handle the grunt work, and focus humans on critical thinking.
Pharoah said, “It’s about learning what’s right, getting the learning in there, having managed service partners that can help you, and having some thought leadership around how that’s done.”
Using AI for more than just data analytics requires training. Customers want their data segregated, which limits training unless you can anonymise it. Additionally, AI has to avoid the trap of dismissing threats as false positives.
Pharaoh says that the Securonix approach involves extensive baseline analysis to distinguish good, bad, and indifferent activity before introducing human oversight.
This ensures that while AI processes logs from multiple sources and ingests threat intelligence from CVE databases, the final judgment call remains with experienced analysts. As organisations grapple with rising cyber insurance premiums and the reputational cost of breaches, the focus shifts to risk mitigation through partnership rather than just technology deployment.
Pharaoh does not see a future where the SOC is fully autonomous. Instead, it will be a collaborative environment where AI accelerates threat detection. That will allow humans to focus on complex investigations and strategic business alignment.
To hear what else Pharoah had to say, listen to the podcast.
Where can I get it?
You can listen to the podcast by clicking on the player below. Alternatively, click on any of the podcast services below and go to the Enterprise Times podcast page.
