Only 10% of SOCs Say They’re Getting Excellent Value From AI. Here’s What the Second Wave Has to Deliver

The article examines why AI adoption in SOCs has not delivered expected value and identifies what architecture the second wave of SOC-AI must adopt.

• •Only 10% of SOCs report excellent value from AI despite rapid adoption across LLMs, agents, and co-pilots
• •The "taker model" where 65% deploy off-the-shelf AI without customization shows lowest value, suggesting structural adoption without operational maturity
• •First-wave AI operates as isolated point tools in each SOC stage without sharing context across threat intelligence, hunting, detection, investigation, and remediation
• •SOCs reporting excellent value run AI as a connected fabric where each stage feeds the next with context, enabling continuous calibration and improvement
• •