My Thoughts on the AI SOC: Hype, Reality, and the 'Vibe Coding' Revolution

Everyone is talking about the AI SOC. While I didn’t make it to RSA this year, the reverberations were impossible to miss—agentic AI and automated defense dominated every conversation. After countless discussions with colleagues and customers about building a SOC from scratch, buying out-of-the-box products, or navigating a hybrid of both, the same question keeps coming up: Is this AI SOC thing just hype, or are we on the brink of a revolution?

I thought it was a good time to write down my thoughts. Whether you are actively standing at this decision point or just watching the landscape evolve, I hope this perspective helps.

What is an AI SOC, anyway? #

Let’s strip away the buzzwords and describe it simply.

Imagine you have all the shiny security tools monitoring your cloud environments, your on-prem infrastructure, and your employees’ laptops for malware and phishing. These tools constantly find anomalies and generate alerts. Sometimes, your users spot a weird email and report it directly (which is a fantastic sign—it means your employees are in the trenches with you). Or, an external source gives you a heads-up: “Hey, I was on your website and saw someone else’s data.”

In every one of these scenarios, an investigation kicks off. You have to determine if it’s a true positive. If it is, you stop the bleeding, remediate the environment, and run a lessons-learned process to ensure it doesn’t happen again.

Now, if you’re reading this, you might be thinking: Why limit this to incident response? I want help with cloud security posture, reviewing governance policies, or identifying missing controls. The list of use cases is endless.

So, what changed? Why the buzz now? #

I narrow it down to three massive shifts:

1. Frontier models are out-of-the-box ready: AI models have become remarkably adept at security reasoning. We are now mature enough to build out complex SOC use cases without needing an in-house team of machine learning engineers to train models from scratch.
2. Attackers are moving at machine speed: In 2026, threat actors are leveraging AI to compress their attack windows. Recent industry data shows attackers achieving lateral movement in as little as 4 minutes—an 85% acceleration from previous years—with data exfiltration happening in just 6 minutes. To fight machine-speed attacks, we need AI-powered, autonomous defenses.
3. Context is finally accessible: AI tools are useless without context. Today, security tools have the data, and technologies like the Model Context Protocol (MCP) make it incredibly easy to pipe that context directly into your AI agents. (Though, as any security architect will tell you, securing those MCP integrations against tool poisoning and credential aggregation is a critical battleground of its own).

What are our options? #

Today, most vendors offer excellent security products with integrated AI features—think chat interfaces hooked into your logs or predefined agentic flows for investigations.

That’s a great starting point. But what I’m hearing in the field is a desire for something more radical: Teams want to bring the “vibe coding” revolution to the SOC.

Coined by Andrej Karpathy, “vibe coding” is the shift where you stop writing code line-by-line and instead use natural language to prompt AI to build what you need. In the SOC, this means moving away from rigid, vendor-defined playbooks.

Imagine describing the behavior you want to see: “If an alert looks like phishing, check the user’s recent logins, look for data exfiltration, and if verified, isolate the host.” The AI agent builds the logic, connects the tools, and deploys the automation in minutes. You are not constrained by pre-built playbooks; you are limited only by your imagination.

Example 1: The 24/7 Self-Service Agent #

Imagine providing a self-service AI agent that acts as an extension of your security team, available to employees 24/7. An employee reports a suspicious event. The agent converses with them, gathers screenshots, extracts timelines, and performs initial triage. If it determines the threat is real, it escalates to the human SOC. By the time an analyst sees the ticket, the agent has already gathered and parsed all the required context. This drastically improves the user experience, cuts triage time to a fraction, and helps the SOC process infinitely more information.

Example 2: The Auto-Remediation Agent #

We can take it a step further by deploying an auto-remediation agent. Based on playbooks you define, this agent assists developers and IT staff in fixing vulnerabilities, misconfigurations, or bad code verifiably and instantly. The value to the organization here is massive.

To Summarize (For Now) #

As we push deeper into 2026, we are going to face a barrage of AI-based threats, expanded attack surfaces, and entirely new attack vectors. But at the exact same time, we have an unprecedented opportunity to overhaul our defensive architecture using agentic workflows.

The question isn’t whether AI will change the SOC, but how fast you can adapt to this new reality.

There will definitely be a part two to this pretty soon, where I’ll dive into the architecture of building your own AI SOC. Stay tuned!