AI has quickly become a boardroom priority. Organisations are investing heavily in governance frameworks, usage policies and risk controls as employees adopt AI technologies across the business. Yet as boards look to understand AI risk, many are overlooking a more immediate frontline challenge: the impact AI is having on the threat landscape and the ability of security operations teams to keep pace.

The National Cyber Security Centre (NCSC) has warned that AI is accelerating offensive cyber activity, enabling threat actors to move faster, operate at greater scale and reduce the effort required to conduct attacks. For security leaders, this shifts the conversation beyond AI governance and into a more pressing question: can SOCs detect, investigate and respond at machine speed when adversaries increasingly can?

AI Is Exacerbating an Existing SOC Problem

Many organisations already struggle to manage the volume of alerts generated by their security tools. AI-powered attacks threaten to make this challenge significantly worse.

As attackers automate vulnerability identification, phishing campaigns and attack planning, security teams can expect growing volumes of suspicious activity and a greater number of security events requiring investigation. Yet most SOC analysts remain constrained by manual workflows that require them to pivot between multiple tools, gather evidence from disparate systems and spend valuable time performing repetitive investigative tasks.

The challenge facing many organisations is not a lack of visibility. It is a lack of capacity.

Adding more telemetry sources, deploying additional security tools or creating more alerts provides limited value if analysts do not have the time to investigate the alerts they already receive. Without addressing operational efficiency, organisations risk creating larger backlogs while reducing their ability to identify the threats that matter most.

More Alerts Are Not the Answer

When organisations consider strengthening their cyber defences, the instinct is often to invest in additional security tools. New platforms promise greater visibility, more telemetry and broader threat detection capabilities. In theory, this should improve security outcomes.

In practice, however, more data does not automatically translate into better security.

Most security teams already receive far more alerts than they can realistically investigate. Every new detection capability typically generates additional signals that require triage, analysis and validation. Without sufficient capacity and expertise, organisations simply create more work for already stretched teams.

This challenge has become particularly acute as environments grow more complex. Modern organisations operate across cloud platforms, hybrid infrastructure, remote work environments, third-party ecosystems and increasingly AI-enabled applications. Each layer generates new data sources and new alerts.

From a board perspective, this creates a dangerous illusion of control. Large volumes of security data may suggest comprehensive visibility, but if analysts cannot effectively assess and investigate the alerts they receive, significant risks can still be missed.

The question is no longer whether the organisation has enough data. The question is whether it has the operational capability to turn that data into meaningful security outcomes.

The Need for Evidence-Based Investigations

As the risks of AI attacks rise, scrutiny on security teams continues to increase in turn. Following a significant incident, organisations must be able to demonstrate not only what decisions were made, but why they were made. Regulators, auditors and boards are increasingly expecting clear evidence trails that show how threats were assessed, investigated and escalated.

This places additional pressure on SOC teams already struggling with expanding workloads. Analysts need to move quickly, but they also need to be thorough. Balancing speed with accuracy is becoming one of the defining challenges of modern security operations, particularly as AI enables attackers to launch and adapt campaigns at a pace that traditional investigation processes were never designed to match.

AI Central to Security Operations

The same technology accelerating attackers can also help defenders regain the advantage.

The most effective use of AI within an agentic SOC is not to replace analysts, but to amplify them. AI analysts within SOCs can investigate alerts, collect evidence, correlate activity across multiple systems and summarise findings in minutes rather than hours. This allows analysts to focus on higher-value activities, applying context, business knowledge and judgement to response decisions.

Rather than acting as standalone tools, coordinated AI agents can work across the investigation lifecycle, continuously gathering information, assessing activity and surfacing evidence-backed conclusions. By doing so, they reduce the operational burden on analysts while improving consistency, coverage and responsiveness.

In an environment where attackers increasingly operate at machine speed, human-only SOC models are becoming increasingly difficult to sustain.

AI Risk Demands an Operational Response

For boards, AI risk should no longer be viewed solely through the lens of governance and compliance. While policies, controls and oversight remain important, they do little to address the operational realities facing security teams tasked with defending the organisation.

The real question is whether the SOC is equipped to respond to AI-accelerated threats with the same speed and scale at which they emerge.

Boards need confidence that critical threats are identified quickly, investigations progress efficiently and decisions are supported by robust evidence. Delivering that confidence will require a new operating model in the agentic SOC, in which analysts handle the heavy lifting of investigation while experts retain responsibility for judgement, escalation and response.

As AI helps attackers to enact increasingly sophisticated, frequent, and scalable cyberattacks, it must also transform cyber defence – far quicker than we’re currently seeing. The organisations that successfully combine human-led expertise with AI-driven security operations will be best placed to keep pace with an increasingly automated threat landscape.