There is a version of the AI in security conversation happening in boardrooms right now that goes roughly like this: we have too many alerts, our analysts are overwhelmed, response times are too slow. AI will fix that. 

But if the underlying processes are messy or non-existent, AI has nothing to accelerate. 

When RiverSafe works with a new SOC environment to help build maturity, the gaps we find are different every time. But some things come up repeatedly, in different combinations and at different severity. These include; 

• Alert triage processes that aren’t well documented, meaning consistency depends entirely on who is on shift.  

• Detection rules that were written when a particular threat was current and haven’t been touched since, generating noise that analysts have learned to ignore.  

• Escalation paths that look clear on paper but break down in practice because the criteria for escalation are ambiguous.  

• Playbooks that were written during an implementation project and haven’t been updated to reflect how the environment has actually changed.  

• Analyst documentation habits that mean context gets lost between shifts, so the next analyst starts from scratch rather than building on what the previous one found. 

Why this matters when you introduce AI 

AI doesn’t arrive in your SOC and assess what it’s working with, it operates on whatever inputs you give it, using whatever logic you’ve built or bought.

• If your triage process is inconsistent, AI will apply that inconsistency at greater speed and volume.  
• If your detection rules are generating noise, AI will enrich and prioritise that noise, presenting it to analysts with more confidence than it deserves.
• If your escalation criteria are ambiguous, AI-assisted recommendations will reflect that ambiguity back at you in ways that are harder to question because they come with a probability score attached. 

The organisations we see getting real, measurable value from AI in their SOC have typically done the less exciting work first. 

One question worth sitting with before any AI procurement conversation: if you replaced AI with a very fast, very diligent human analyst, would they make better decisions in your environment than your current team?

If the answer is no, because the inputs they’d be working with are unreliable, the playbooks are out of date, or the escalation logic is unclear, then AI won’t change that, it will just surface the same problems faster. 

We’d suggest four questions any SOC leader should be able to answer clearly before evaluating AI tooling: 

1. Can you define, in writing, what a correctly triaged alert looks like in your environment? 
2. When did you last review your detection rules, and who owns that process? 
3. Do your escalation criteria hold up when tested against real incidents, or only in theory? 
4. If a senior analyst left tomorrow, how much institutional knowledge would leave with them? 

 If any of these surfaces uncertainty, that’s where the investment should go first as AI built on solid foundations will be better able to deliver measurable results.