When the Whole Company Adopts AI: What It Does to Your SOC

Summary: An analysis of roughly 16.9 million SOC alerts found about 73,000 (0.43%) were AI-related, a share that grew 685% between February and June 2026 and rose every month in that window. Of the AI-related alerts, 94.1% were noise, 5.8% were genuine security risks such as agents run with permission-bypass flags, and 0.02% were real attacks, none of which was a compromise caused by the organization's own agent.
Why it matters: Only 5.4% of AI-related alerts were escalated to a human analyst, while a single detection at one customer produced 55% of all critical verdicts, so the small set of genuine exposures - permission-bypass flags, unauthorized tunnels, risky OAuth grants - is exactly what the flood of false positives tends to bury.

Read the original at The Hacker News ↗