2.6. AI in Security Operations

💡 First Principle: An AI model produces the most statistically plausible output for its input, not a verified one — so in a SOC, AI output is a hypothesis or a draft that speeds the analyst up, never evidence and never a decision the analyst stops owning.

Generative AI arrived in the SOC because it attacks the same problem SOAR does — the volume of data exceeds human reading speed. A large language model (LLM) can summarize 40,000 log lines, explain an obfuscated script, draft an incident report or suggest the SIEM query an analyst would otherwise spend twenty minutes writing. That speed is real. So are the failure modes: the model can state a false fact with complete confidence, it can leak whatever data you feed it, it can be trained on tampered data, and it can be steered by text an attacker plants in the very logs and emails it is asked to read.

The exam treats AI in three layers, and this section follows them: the risks (what goes wrong), the governance that decides whether and how AI may be used (law, regulation and internal policy), and the use cases where AI genuinely helps an analyst. The common thread is that AI changes who drafts the work, not who is accountable for it.

⚠️ Common Misconception: If the AI tool is approved by the organization, its output can be trusted. Approval addresses where the data goes and who may use the tool — it says nothing about whether a particular answer is correct. An approved, enterprise-hosted model can hallucinate just as a public one can. Approval and verification are two different controls, and the analyst needs both.