Confessions of an AI sceptic
If you work in security, scepticism is part of the job. You have seen tools promise to stop everything and stop very little. You have watched "next-generation" become a marketing word. So when someone tells you an AI can run part of your SOC, the reflex is to ask what it gets wrong, and who finds out.
That reflex is healthy. It is also, as it turns out, the best possible starting point for adopting AI well.
The nightmare
Ask a sceptic to describe the AI SOC they fear, and the picture is consistent.
- A black box. An alert goes in, a verdict comes out, and nobody can say why.
- Silent closures. Thousands of alerts quietly marked benign, with no way to tell a good call from a lucky one.
- Actions nobody approved. An endpoint isolated in the middle of a board meeting because a model was confident.
- Confidence without humility. A system that never says "I'm not sure", because it was never built to.
- Blame with nowhere to land. When it goes wrong, the regulator asks who made the decision, and the honest answer is "the software".
None of these fears is irrational. Each one describes a real way automation fails. The mistake is assuming they are the price of using AI at all.
The dilemma
Here is the problem. The alternative to AI is not a careful analyst reviewing every alert. It is a tired analyst reviewing some of them.
Alert volumes keep rising, and teams do not grow to match. So every SOC quietly triages its triage: severity and gut feel decide which alerts get a proper look, and the rest get a glance. Nobody signs off on that decision. Nobody audits the skipped pile. Out of hours, for many smaller teams, nobody is looking at all.
So the sceptic faces a real dilemma. Keep doing it by hand and accept that some alerts will never be investigated. Or bring in AI and risk every item on the nightmare list.
The status quo already has a black box. It is called "the alerts we didn't get to".
What turns the nightmare around
The way out is to treat each fear as a requirement. If the AI cannot answer it, it does not belong in your SOC.
- A black box. Every verdict comes with its evidence, its reasoning and a confidence level.
- Silent closures. Closures, escalations and overrides are reported separately, so you can sample what was dismissed and why.
- Actions nobody approved. Nothing acts unless you have enabled that action, for that site, above a threshold you set, with a stricter bar for disruptive actions.
- Confidence without humility. It stops for a person when confidence is low, when its models disagree or when evidence is missing.
- Blame with nowhere to land. Every decision and action is logged, and a person can override any verdict.
This is the standard LuceraAI is built to. A council of specialist agents investigates each alert, two independent models from different providers must agree on the result, a devil’s advocate argues against it, and disagreement goes to a person rather than being averaged away. Teams can start in Observe mode, where nothing acts on the estate at all, and only move to automated response where the evidence has earned it.
Industry analysts give buyers the same advice: verify AI SOC claims on your own alerts before you pay for them. A sceptic should take that literally.
A colleague, not a replacement
The sceptic's other fear is quieter but just as real: if the AI does the investigating, what happens to the analysts?
The honest answer is that the job changes, and for the better. Most analyst hours today go on the least skilled part of the work: opening an alert, pulling the same logs, checking the same sources, and closing it again. That is the work AI does well, because it is repetitive, evidence-driven and never finished.
What AI does not do well is judgement. Knowing that a finance director travels every March. Spotting that a "routine" alert lines up with a contractor leaving last week. Deciding whether to wake someone at 3am. Those calls stay with people, and a well-built AI SOC is designed to hand them over, not hide them.
What the AI takes on, and what your analysts keep:
- Gathering evidence for every alert. Your analysts decide what the evidence means for your business.
- Checking the same sources, every time. Your analysts spot the context no data source holds.
- Closing clear false positives, with a receipt. Your analysts sample and challenge those closures.
- Flagging when it is unsure. Your analysts make the calls it hands over.
- Remembering patterns your team has approved. Your analysts approve, overturn and teach it.
Every override an analyst makes is recorded, and an overturned pattern pauses automatically. The AI learns from your team's judgement rather than replacing it.
For a lean team, the result is not fewer people. It is the same people spending their time on the cases that need them, with the evidence already gathered when they arrive.
The dream
Built this way, AI stops being the thing a sceptic fears and becomes the thing a sceptic would design. Picture the morning after a quiet night:
- Every alert from overnight has been investigated, not just the ones someone had time for.
- The routine closures sit in a list you can sample, each with the evidence that justified it.
- Two cases are waiting for a person, each with a plain note on why the AI stopped.
- One action was taken, an action you had switched on, and the log shows exactly why it cleared the bar.
Your analysts spend the morning on judgement calls instead of first-pass triage. Your board gets a record it can follow. And the sceptic in the room gets to keep asking hard questions, because now there are answers to check.
The point is not to trust AI more. It is to need less trust, because everything can be checked.
Where a sceptic should start
- Write down your nightmare list. Turn each fear into a question for any vendor.
- Measure your skipped pile: sample twenty alerts closed last week without a full look.
- Run a read-only evaluation on your own alerts, with nothing allowed to act on your estate.
- Compare the AI's verdicts with your analysts' decisions, and ask for the metrics it could not produce.
.png)