Survey Finds Most Security Teams Using AI Daily, but Few Have Checked Whether Their SOC Is Ready

Forty percent of security teams now use AI every day and another 56% are testing it, with only 4% reporting no plans to adopt it, according to Prophet Security's State of AI in Security Operations 2026 survey of more than 250 CISOs, SOC leaders and practitioners. For teams still in testing, the next question is whether their own SOC is ready.

Readiness has two parts: whether a SOC has the problems AI SOC agents are built for, and whether it has the data access, context, written standards and oversight rules agents need to investigate alerts accurately. A SOC does not need to be far along a maturity model to be ready. Agents do their first work on the bottom layer, alert handling, and the analyst hours they return give a team room to work on the layers above.

The SOCs that gain the most usually recognize several problems. If an MDR or MSSP works their alerts, threats may be flagged too slowly, alerts handed back for lack of context, closures made without showing the work, and coverage limited to the tools the provider supports. If their own analysts work the queue, answering "are we impacted?" can take days, lower-severity alerts wait or get closed in bulk, noisy detections get switched off, hunting waits for spare time, a few senior analysts carry the hard cases, and nights and weekends are thinly covered. In the survey, 60% said an alert they had ignored or missed later turned into a serious issue, and respondents said 28% of their alerts are never investigated.

Technical readiness covers four areas. An agent can only investigate what it can query, so it needs API access to the SIEM, EDR, identity provider, cloud platforms, email and key SaaS applications, plus readable context such as asset criticality and user roles, and monitored data pipelines. Data privacy was the most common roadblock named, cited by 44% of teams. Teams also need a written standard for a finished investigation and a recorded baseline; the survey found a thorough investigation takes an average of 75 minutes, and alerts often wait close to an hour before anyone opens them. On response, 57% require a human to review every AI decision before an alert is closed, 44% have AI recommend actions people carry out, 30% let it handle low-risk remediation alone, and no respondent gives full, unsupervised autonomy.

Some teams consider building their own agents instead. The survey suggests caution: 72% of AI users had tried building internal AI tools, and 46% of those projects were abandoned, never reached production, or were replaced by a commercial product.

Source: The Hackers News