Key Insights
Every security team knows how this story starts. An alert fires, lands in a queue, and waits. By the time an analyst opens it, the question that matters isn’t only whether it’s real. It’s how much has already happened.
For years, the answer to that problem was better detection: more telemetry, more rules, more tools watching more surfaces. Detection did get better. Investigation didn’t keep pace. Spotting something suspicious is now the easy part. Working out what it means, what it touched, and what to do about it is where the hours go.
That makes this a speed problem, though not the kind most teams measure. The issue isn’t how fast the SOC sees a signal. It’s how fast it gets from that first signal to an answer it can trust. The gap between those two moments is where attackers operate, and it’s wider than most security leaders assume.
The numbers show how wide.
CrowdStrike puts average eCrime breakout time at 29 minutes. Prophet Security's State of AI in the SOC 2026 survey of 250 security leaders found alerts wait an average of 55 minutes before an analyst picks them up, and a thorough investigation takes about 75 minutes more. Twenty-eight percent of alerts are never investigated, and 60% of respondents said an alert they ignored later proved material.
Put those side by side. The attacker can break out before anyone opens the alert, and the investigation takes more than twice the breakout window once someone does.
If more detection isn’t the fix, what is? The answer starts with understanding why the alert pile keeps growing even as tooling improves, and why each new tool tends to make it worse.
Why More Detections Make the SOC Slower
A Cloud Security Alliance research note from September, drawing on an analysis of about 16.9 million alerts, found that AI-related alerts grew 685% between February and June 2026. Of those, 94.1% were noise and 0.02% were confirmed attacks. More than 80% were auto-suppressed without review.
The CrowdStrike 2026 Threat Hunting Report points at one reason: activity by AI agents now generates 2.5 times as many threat leads as manual activity, which makes malicious behavior harder to separate from expected AI activity. A new tool adds to the pile. It doesn't clear it.
The SOC Has a Conversation Problem
The constraint is investigation throughput. An investigation is a chain of questions:
Who is this account?
What else did it touch?
Is this normal for them?
Who owns that bucket?
Each question means a query in a different console, a pivot, a wait, and a message to someone in another time zone. A good analyst might ask a few dozen questions an hour. An AI-driven attacker asks thousands. The SOC can't ask its own data questions fast enough.
Why General-Purpose AI Hasn't Closed the Gap
Analysts noticed when chat-based AI made every other knowledge worker faster, and many tried pasting logs into a general-purpose model mid-incident. Two things got in the way. The model is a smart stranger: it doesn't know your people, your service accounts, or what normal looks like in your environment. And an investigation looks a lot like an attack, so questions like "which credentials could an attacker have used here?" can run into safety guardrails built for the opposite purpose.
What Happens to the SOC Analyst's Job
When investigation becomes a conversation, the job changes. Tier-one triage, the copy-paste work of enriching alerts and pulling context, shrinks. The analyst becomes an editor: directing the investigation, judging the evidence, deciding what to do.
The survey data fits that picture. In Prophet's study, 72% of teams using AI in the SOC cut investigation time by at least a quarter, and no respondent gave AI full autonomy.
The effects reach past the SOC. Hiring shifts from people who know which console to query toward people who know which question to ask. Burnout, long driven by repetitive triage, has a chance to fall. And SOCs that make the shift first can absorb rising attack volume without matching headcount growth, which is a scaling model a CFO can approve.
What a Machine-Speed Investigation Needs
Context. An investigation model has to know your identities, their relationships, and their normal behavior. Otherwise it's guessing.
Room to investigate. The model and its tooling have to be built for security work, so "how could an attacker abuse this role?" gets an answer instead of a refusal.
Evidence alongside answers. Every conclusion should come with the queries and records behind it, so an analyst can verify it in seconds and hand it to legal or leadership.
Readiness before the incident. Deciding how you'll investigate during a breach is too late.
Three Questions to Ask About Your SOC
Three questions are a good place to start. First, on your last three investigations, how much time went to thinking and how much to waiting for queries, context, and replies? Expect the waiting to be the larger number. Second, does any AI your analysts use know what normal looks like in your environment? Third, do you track the time from first signal to first answer, alongside your detection metrics?
That third number is the one that has to fit inside 29 minutes.
We track how AI is changing both attacks and security operations. Our AI security resource hub collects our latest research, guides, and analysis in one place.
Get AI Security Resources