Overview
- Reporting on Wednesday and Thursday shows security operations teams are widely using AI to speed investigations and are increasingly letting it take limited response actions under human-defined boundaries.
- Teams first use AI to summarize alerts, gather and link evidence across identity, cloud, endpoint and SaaS, and to recommend fixes, then expand autonomy as the system proves reliable and records its reasoning for audits.
- Vendors now offer both cloud-hosted services and self-hosted integrations, for example Wazuh’s cloud AI Analyst that uses Amazon Bedrock and Anthropic’s Claude and self-hosted Llama/Ollama options, with vendors saying data used for reports is isolated and not reused to train models.
- Security leaders say trustworthy automation depends on a strong data foundation such as semantic knowledge graphs, continuous telemetry, clear evidence trails, and use of governance frameworks like NIST’s model to define escalation rules and auditability.
- The shift is reshaping work: an emerging Threat Operator role will govern AI actions and set defensive priorities, teams report measurable time savings in pilots (one case study reported a 95% drop in mean time to investigate) and experts warn independent validation and cautious rollout remain necessary.