Real AI opportunity in the SOC is faster decisions, not fewer people

Securonix and Orient Technologies say their expanded partnership will use AI to improve analyst efficiency and response, while keeping humans in control of critical security decisions.

Securonix and Orient Technologies are pushing back against the idea that artificial intelligence will simply reduce the number of people required to run security operations centres, arguing instead that AI's immediate value lies in helping analysts process large volumes of information and make decisions faster.

Speaking exclusively to CRN India, Dipesh Kaura, country director, India and SAARC, Securonix, and Ajay Sawant, chairman and managing director, Orient Technologies Limited, said AI is being used for high-volume and repetitive SOC tasks, while humans remain responsible for decisions that require business context or could have a significant impact on an organisation.

Sawant said AI can analyse and correlate large volumes of security events, enrich alerts with additional context, search through large datasets, summarise incidents, prioritise alerts and assist with routine reporting.

The objective, he said, is to reduce the time analysts spend gathering and processing information so they can focus on investigation and decision-making.

“AI is definitely changing the way security operations are performed. But I personally believe the motive of AI is not to remove humans from the SOC,” Sawant said.

He said the human role becomes particularly important when a response involves a critical production system, an important user account or a major security incident.

“Decisions such as isolating a critical production system, disabling an important user account, responding to a major breach or determining the business impact of an incident are areas where customers will continue to want experienced security professionals involved,” he said.

For Kaura, however, the first distinction that needs to be made is between AI and automation.

“AI is artificial intelligence, and it is not automation,” Kaura said. “It is a supplement to the person sitting there and taking decisions such as yes, no, activate, deactivate or quarantine as part of day-to-day cyber defence.”

He said automation in the SIEM and SOC environment primarily comes through security orchestration, automation and response, or SOAR, which is designed to handle regular and repetitive tasks generated by security alerts.

AI, by contrast, is being used to improve the efficiency and effectiveness of the analyst working with those alerts.

Kaura said an analyst may have to work through thousands or tens of thousands of alerts and determine which require action. AI can bring together the relevant context and help the analyst reach a decision faster.

“What AI for Securonix is doing right now is improving the speed of detection, the accuracy of detection and the decisions that need to be taken at the time of response,” he said.

He said the potential time saving is significant. Work that could previously take a day or a day and a half could potentially be completed in around an hour or an hour and a half with AI assistance.

But Kaura rejected the idea that this automatically translates into a reduction in SOC headcount.

“We are not saying that if your SOC had 20 people, you will now require only five people,” he said.

The value, he said, is in improving how alerts are handled, what the analyst sees and how confidently a decision can be taken.

SOC success moves beyond alert volumes

The changing role of the analyst is also being accompanied by a shift in how customers measure the effectiveness of their SOCs.

Sawant said organisations have traditionally focused on operational measures such as the number of alerts or incidents handled. Customers are looking at how quickly a SOC can detect, investigate, contain and recover from an incident.

That includes mean time to detect, or MTTD, mean time to respond, or MTTR, containment time and recovery time.

“The success of a SOC should not be measured by the number of alerts or events it generates, but by how effectively it reduces risk, limits business disruption and enables the organisation to respond within the required timelines,” Sawant said.

He said resilience is becoming particularly important because no organisation can guarantee that it will remain completely secure.

“How quickly you can come back to normalcy is a major factor that everybody is looking at,” he said.

The focus on outcomes is also extending to cybersecurity investment. Sawant said management wants to understand the return from the money being spent on security and compliance.

That remains difficult to quantify because the value of an attack that never happens cannot be measured directly. Customers can, however, assess potential downtime, critical systems protected, data-loss exposure and potential financial impact.

Regulatory requirements are another factor influencing how organisations assess SOC performance, with Sawant pointing to India's evolving cybersecurity and data protection requirements.

The result is a broader definition of SOC effectiveness, moving from the volume of activity handled by the security team to the reduction of risk and business disruption achieved by that team.

Trust becomes part of the security outcome

For Kaura, however, technology and metrics are only part of the equation. The ability to provide dependable support when a security incident occurs is becoming an important consideration for customers and partners.

He said the cybersecurity market has no shortage of products or attacks. The harder question for a customer is what happens when something goes wrong and whether there is an ecosystem that can support the organisation through that event.

That is an important part of the expanded Securonix-Orient relationship, which gives Securonix a larger India-based technical and services organisation around its platform.

Kaura said the objective is to give customers and partners confidence that they are not relying only on an OEM but have an extended team invested in the Indian market.

“If there is downtime at 11 o'clock, they want to know whether they will be able to call someone and whether someone will take the call and come down to help them,” he said.

The support model is particularly relevant in cybersecurity because an organisation may have invested in multiple technologies but still face a serious operational challenge during an incident.

Kaura said the ecosystem being built around Securonix is intended to provide that additional layer of confidence through people, skills and local support.

“Investment in people is always the best investment because, at the end of the day, technology is driven by people, and people buy from people,” he said.

For Orient, that investment sits alongside its broader cybersecurity services strategy. The company has more than 1,600 employees, including around 1,200 technical professionals certified across different technology vendors, while 80 to 100 people are being trained for Securonix.

The company is also investing in SOC capability, cybersecurity resources and processes as part of its broader partnership with Securonix.

That puts the emphasis on a model where AI handles scale and repetitive work, security platforms provide the underlying detection and response capabilities, and trained people remain accountable for decisions and customer outcomes.

Sawant described the future SOC as neither completely human nor completely autonomous.

“The future SOC is therefore neither completely human nor completely autonomous. It will be an AI-augmented SOC where AI handles speed, scale and repetitive work, while humans provide judgement, accountability and decision-making,” he said.