Why security automation must evolve in the age of AI

COMMENTARY: Speed has always been a priority in security operations. But in today’s SOC, speed without precision can exacerbate the damage of a cyberattack. A hasty, overbroad automated response can disrupt core systems and business operations, eroding trust and driving costs.

It’s time for organizations to start thinking differently about the role of security orchestration, automation, and response (SOAR) in the SOC, especially in the age of AI.

[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]

Attackers have evolved, and their timelines are shrinking: The average eCrime breakout time dropped to 48 minutes, with the fastest recorded at 51 seconds, leaving defenders little time to react.

Legacy SOAR tools often operate on the periphery of the SOC. They rely on patchwork integrations with detection systems and act only on the limited data those connections offer. That narrow view leads to automation decisions based on partial context, increasing the risk of doing too much or not enough.

Making matters worse, many traditional SOAR deployments require coding skills and complex customization. Instead of empowering analysts, they create new bottlenecks. A tool meant to save time often ends up underused or ignored when it is needed most.

Meanwhile, modern adversaries increasingly rely on legitimate tools, credentials and cross-domain movement to bypass traditional defenses. Without the ability to correlate signals across endpoint, identity, cloud, and network data, their movements can appear harmless, until it’s too late.

Why unified SOAR and SIEM matter

When SOAR capabilities are built into a modern SIEM and tied to a unified data foundation, they offer both speed and precision. A modern SIEM ingests, normalizes, and correlates telemetry across the enterprise in real time. When paired with automation, each response is driven by the full context of an incident, not fragments.

This level of integration transforms SOAR from a reactive playbook executor into a precision instrument. Containment decisions are based on asset criticality, the adversary’s location in the environment, and the potential blast radius, not just the triggering alert.

Integrated SOAR and SIEM shift the SOC from blunt responses to surgical ones. If a compromised identity gets detected, automation can disable only that account, revoke tokens, and block cloud access without affecting unrelated users. If an endpoint becomes compromised, it can be isolated in seconds while preserving the rest of the network. Analysts no longer need to pivot between multiple platforms, reducing delays and minimizing errors. The same console that surfaces the threat also provides the tools to respond.

The AI advantage

The combination of SIEM, SOAR, and AI promises to become even more powerful when used together. AI-driven automation can:

AI acts as a precision multiplier for analysts, filtering noise, highlighting the highest-risk activities, and ensuring every automated response is both informed and effective.

Consider an intrusion where an attacker exploits an unmanaged VPN appliance, pivots into virtualized infrastructure, and then moves into productivity suites. In a disconnected SOC, endpoint security may only see part of the activity, while the VPN compromise never surfaces in the system monitoring cloud access. By the time analysts connect the dots, the attacker may already have escalated privileges and exfiltrated data.

With SOAR tied to a modern SIEM, these signals are correlated in real time. The automation engine sees the VPN anomaly, the unusual cloud logins, and the endpoint changes as parts of the same intrusion chain. Containment steps are often immediate and targeted: disabling compromised accounts, revoking tokens, and isolating endpoints, while leaving unaffected systems untouched.

Recent data from our 2025 Threat Hunting Report shows interactive intrusions are up more than 25% year-over-year, cloud intrusions have more than doubled, and social engineering and malware-free attacks are accelerating. Adversaries are moving faster, adapting quicker, and hiding more effectively within legitimate traffic. The SOC can no longer afford to react slowly or act blindly; it must operate at machine speed with machine-level precision. Speed without precision risks collateral damage; precision without speed leaves openings for the attacker.

The future of the SOC will belong to organizations that combine SIEM, SOAR, and AI to unify visibility, enrich decisions, and automate context-aware responses.

In a landscape dominated by rapid ransomware crews and stealthy cross-domain operators, unifying detection and response under one architecture is no longer an advantage: it’s a necessity. The SOCs that endure will think and act at machine speed.

Ajit Sancheti, general manager, Falcon Next-Gen SIEM, CrowdStrike

SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.