COMMENTARY: A story I heard recently stuck with me. A
CISO deployed a security information and event management (SIEM) platform to modernize his company’s security operations, expecting better visibility and automation.
What did they get instead? Over 7,000 alerts a day. That’s not modernization. That’s mayhem.
This isn’t merely an alert problem. It’s a process problem. Despite all the dashboards and detection rules, defenders are still put in the position to manually create and apply context, respond reactively, and make decisions under pressure. Is it any wonder defenders are burned out, threats are missed, and the
security operations center (SOC) always operates in defensive mode?
[
SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]
Cybersecurity has a human problem. While we face
a talent shortage, we really need to look more carefully at how we treat the people we already have. Analysts are buried in noise, pulled into incident calls at all hours, and fighting a battle in which attackers only need one win, while defenders can’t afford a single mistake. That’s not sustainable.
We don’t need more dashboards. We need better processes. And that’s where AI can make a real difference —
not just by automating tasks but by improving how people work.
Fix the process, not just the alert count
Anyone who’s spent time in a SOC knows most alerts aren’t actionable. The false positives, duplicates, and low-fidelity signals all add up. We hire analysts to investigate, decide, and defend. We’re not letting them do that. We saddle them with hours of triage and manual context-building. Over time, that wears them down, and then focus slips, accuracy drops, and consistency in how alerts are handled starts to break down.
Security teams are drowning in tools that don’t talk to each other. Instead of streamlining operations, we’ve introduced more tools and portals. Dashboards, even the strategic ones, are only as effective as the context and clarity behind them. That’s where AI can change the equation, stitching together fragmented signals, surfacing what matters, and helping analysts act confidently rather than wading through noise.
Elevate analysts with the right tools
Fixing broken processes starts with supporting the analysts operating within them. Some worry AI will replace them. It does the opposite. It frees them up to apply their experience and judgment, which machines can’t replicate.
Many analysts spend most of their time triaging alerts, enriching data, and escalating basic issues. AI can handle that once it’s trained. What it can’t do is bring advanced critical thinking, intuition, or creativity that analysts offer.
Imagine an analyst opening their dashboard and seeing a prioritized list of five alerts with detailed context, supporting evidence, and recommended actions instead of a wall of 7,000 blinking notifications.
That’s not a fantasy. That’s what AI does. And it’s what analysts deserve.
Match adversarial AI with smarter defense
We’re not the only ones using AI. Threat actors move fast, using large language models (LLMs) to write phishing emails that sound human, generate malware on demand, spoof internal communications, and even improve their grammar. These tools give them the speed and scale they didn’t have before.
Defenders don’t have the luxury of waiting. Matching that speed means making AI a core part of their workflows. Attackers have embraced AI to move faster and smarter. It’s time defenders had the same edge.
Invest in people, not just performance
There’s a tendency to frame AI around ROI and cost savings. But its most important benefit might be that it gives people better days at work. Talk to any security leader, and they’ll say that their teams are tired. We’ve asked humans to do what machines were built for. That’s not efficient, and over time, it becomes demoralizing. Reducing noise, eliminating sleepless nights, and helping analysts focus on meaningful threats improves security posture and the team’s quality of life.
That’s the real promise of human-centered AI — helping people sleep better, think clearly, and spend their time on work that matters. Amid all the hype and headlines, it’s easy to forget that cybersecurity is still a human field. We’re not just protecting systems. We’re protecting the people behind them. And the people on the front lines — the SOC analysts, the engineers, the incident responders — need tools that support them, not stress them out.
Change requires hard work, but in my experience, from startups to global enterprises, the most urgent problems don’t wait for committee decisions. They’re being solved by teams recognizing that the old ways don't work.
We need to stop thinking of AI as a threat to jobs and start thinking of it as a way to help people reach their full potential. Give teams better tools, reduce the grind, and let analysts do the work only humans can do.
Because in this industry, the stakes are high. If defenders are exhausted, distracted, or overwhelmed, no single tool will save them. But AI that supports people and doesn’t replace them? That’s the difference between success and failure.
Tom Findling, co-founder and CEO, Conifers.aiSC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
