By Apoorba Patranabish, Partner, Grant Thornton Bharat LLP
We are entering an era where attackers are no longer operating only as individuals or coordinated human teams. They are increasingly using AI-driven systems to support reconnaissance, test credentials, discover vulnerabilities, escalate privileges and adapt tactics at a speed no human analyst can match.
The question is no longer whether AI will be used in cyberattacks.
The question is whether our Security Operations Centers are prepared for attacks that can move at machine speed.
The Threat Is Not Intelligence. The Threat Is Velocity.
Many discussions around AI in cybersecurity focus on intelligence. I believe the more immediate concern is velocity.
Consider a typical attack. Historically, an attacker would compromise an account, perform reconnaissance, escalate privileges, move laterally and eventually reach sensitive assets.
Those steps still exist today. Certain activities must still follow a logical sequence. Credentials normally need to be obtained before they can be abused, and access must generally be established before privileges can be escalated. AI does not remove these dependencies or rearrange the attack chain.
What AI changes is the time between those steps. It also allows activities that do not depend on one another to run in parallel. While one agent tests credentials, another can map exposed infrastructure; while one investigates privileges, another can identify valuable data or alternative routes.
The attack chain has not disappeared. Its execution has become faster, broader and more adaptive.
In many organisations, it can still take hours to investigate, validate, approve and respond to suspicious activity. An AI-enabled adversary may compress meaningful parts of the intrusion lifecycle into minutes.
That is the real challenge before us.
Why Traditional SOC Models Are Struggling
Most modern SOCs already possess sophisticated technologies: SIEM platforms, SOAR capabilities, UEBA analytics, DLP controls, threat-intelligence feeds and automated playbooks.
So the issue is not that SOCs lack correlation or orchestration. A capable SIEM can correlate defined patterns, and SOAR can automate established workflows. DLP and UEBA can also detect behavioural and data-risk signals.
The limitation is that these capabilities are often constrained by predefined rules, tool boundaries, incomplete context and approval chains. They may identify related events, but they do not always translate them into a current, business-aware risk decision across identity, endpoint, cloud, applications and data.
Major incidents still occur because technology is not the only bottleneck. The bottleneck is often the organisation’s decision architecture.
Most organisations can detect suspicious activity quickly. What takes time is determining whether it is truly malicious, which business asset is at risk, what the consequences of containment may be, who has authority to act and what operational impact might follow.
Detection may occur in seconds. A trusted decision can take much longer. Attackers exploit that gap.
The Real Problem: Understanding Risk Fast Enough
Imagine the following scenario.
A user logs in from an unusual location. A cloud workload begins enumerating permissions. A device generates an endpoint warning. A SaaS platform records an abnormal download.
Individually, none of these events may justify a disruptive response. Similar events can occur during legitimate activity.
The challenge is not simply seeing the signals. Modern platforms already correlate many forms of telemetry. The harder challenge is continuously interpreting what the combined evidence means for the business.
If the same identity has privileged access, the endpoint supports a critical process and the download involves sensitive information, the risk changes materially. What looked like several low-severity observations may represent one rapidly developing intrusion.
The future SOC must therefore move from event correlation towards dynamic risk correlation. It must answer a harder question: What business risk is emerging from these combined signals, and what is the safest action we can take now?
The organisation that answers that question first will have the advantage.
Why AI Changes the Defender’s Mission
The cybersecurity industry often talks about fighting AI with AI. While that sounds appealing, it oversimplifies the problem.
The objective is not merely automated detection. The objective is accelerated, risk-informed decision-making.
A defensive AI system should help answer: What is happening? How serious is it? Which assets and identities are affected? What business process is at risk? What response is proportionate and safe?
Instead of forcing analysts to manually collect information from multiple consoles and queues, defensive agents can investigate related signals concurrently and assemble context from identity
systems, endpoints, cloud environments, applications, network telemetry, data controls and threat intelligence.
The output should not be more alerts. It should be a clear, evidence-based risk narrative, including uncertainty, affected assets, possible impact and recommended action.
This is the distinction between conventional automation and an agentic defensive layer. SIEM and SOAR remain essential foundations. Defensive agents build on those foundations by conducting multi-step investigations, selecting relevant tools, adjusting their enquiries as evidence changes and presenting the decision in business-risk terms.
The Case for Bounded Autonomy
If attackers can move at machine speed, defenders cannot rely exclusively on human-speed responses. However, giving AI unrestricted authority would create a new concentration of operational risk.
The answer lies in bounded autonomy.
Bounded autonomy gives defensive agents predefined and limited authority to take low-risk, reversible action without waiting for fresh approval. Examples could include revoking a suspicious session, forcing reauthentication, temporarily blocking a malicious indicator, isolating a compromised endpoint or suspending a risky connection.
These actions are intended to reduce attacker momentum while investigation continues. They must be time-bound, observable, auditable and reversible.
But there must always be limits. If an action could interrupt customer services, stop financial transactions, affect production, create regulatory exposure or cause material business loss, human judgement must remain in control.
The central question is no longer whether machines should act. It is whether the organisation has clearly defined when machines may act safely.
Governance and Risk Acceptance Become Strategic Capabilities
One of the most important questions in AI-enabled defence is: Who accepts the risk when an automated system is allowed to act, or when it is prevented from acting?
Technology teams naturally focus on what can be automated. Leadership must decide what should be automated.
Every organisation needs a formal risk-acceptance and sign-off mechanism for automated response use cases. The decision cannot sit only with the SOC or the technology provider. It should bring together the security owner, business owner, system owner and, where relevant, risk, legal, privacy and compliance stakeholders.
For each response scenario, the organisation should define: the threat conditions that trigger action; the confidence and evidence threshold; the assets and environments in scope; permitted actions; prohibited actions; duration and rollback requirements; monitoring and audit expectations; escalation paths; and the accountable go or no-go authority.
Approval should be granted per use case and reviewed when the underlying technology, threat, data source or business process changes. A response that is safe for a standard employee endpoint may not be acceptable for a payment platform, production server or safety-critical environment.
In the future, cyber resilience will not be measured only by detection capability. It will also be measured by how clearly an organisation has defined decision rights, automation boundaries and accountability.
AI Does Not Fix Weak Foundations
There is another reality we must acknowledge: AI cannot compensate for poor cybersecurity hygiene.
If organisations lack accurate asset inventories, reliable identity governance, effective detection engineering, data classification, complete telemetry or clear ownership, AI can turn incomplete information into faster and more confident-sounding decisions.
Poor visibility combined with automated action creates operational risk.
The strongest AI-enabled SOCs will therefore be built on strong cyber fundamentals: current asset and identity context, well-engineered detections, reliable data, rehearsed response processes, protected service identities and decision rights established before an incident begins.
Technology can accelerate decisions. It cannot replace sound security foundations.
The Future SOC: Human Accountability, Machine Execution
The SOC of the future will not be fully autonomous, and it will not be fully human-driven. It will be a partnership.
Machines will increasingly support data collection, correlation, investigation, risk scoring, evidence enrichment and low-risk containment.
Human analysts and leaders will remain responsible for testing evidence, defining exceptions, assessing business consequences, accepting material risk and addressing legal, regulatory and strategic implications.
As automation expands, accountability becomes more important, not less.
Organisations will trust defensive AI when its authority is limited, its reasoning and evidence can be examined, its actions are traceable, and its mistakes can be reversed before they spread.
Trust is not created by removing people from the process. It is created by defining where machine authority ends and human responsibility begins.
Latest News
