Thinking Fast and Slow in the SOC: The Case for Combining Autonomous AI with Analyst Copilots

Summary: A contributed article by Intezer's CMO argues that SOC teams are misapplying AI by asking human analysts to triage the bulk of alerts and by running frontier models directly against raw detection data. It cites research on more than 25 million enterprise alerts finding 98% can be resolved autonomously with under 2% warranting human review, and that an enterprise with 450K alerts per year can expect 54 real threats hidden in low-severity alerts.
What's compelling: The article's claim is that 54 real threats per year sit in the low-severity pile at a 450K-alert enterprise, missed not by choice but because cognitive capacity runs out behind 4,000 other alerts. It also warns that enterprises outsourcing investigation to an MDR provider do not own the detection rules, case history, and triage logic that accumulate in the vendor's platform, leaving an analyst copilot with nothing to work from.

Read the original at The Hacker News ↗