[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ft2_M6-GeFiaJoryq7fcQAUJ82rzbcTxlM-CII5YKx2I":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"4b34f67b-754b-435c-910b-22cc7dcd928a","The SOC Doesn't Need to Start Over with Every Alert","the-soc-doesn-t-need-to-start-over-with-every-alert-5859eb","Security leaders keep debating whether AI will produce an entirely new class of cyberattack. The nearer change is quieter and already visible: AI has made a failed attack cheap to retry. The routine version looks like this. An attacker lands on a low-privilege cloud account, and the first try at privilege escalation goes nowhere. That dead end used to cost hours of documentation reading,","Security leaders face a quieter but significant shift: AI has made failed attacks cheap to retry by automating research, troubleshooting, and script debugging that previously cost hours. Threat reports from Google, Anthropic, and others document state-backed actors and cybercriminals using generative AI for reconnaissance, exploitation development, and credential harvesting. The key defensive challenge is that AI compresses the attacker's loop (observe, hypothesize, test, adjust), while SOC operations remain fragmented by queues and tool silos that break the defender's feedback loop.","AI accelerates mid-stage attack workflows, compressing time between reconnaissance and exploitation loops.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fthe-soc-doesnt-need-to-start-over-with.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEg0sz5D5hiSWYuUfbRDYDloMNzbx5dpvVQjC5ZVoYzIgvWL_Tkyx8AjNHjZ27RAwaPbCIQXNWB6o_FYzxjimFYHY2pHfp6m6b97tARxhdhqSHBkp2lYpfekwVLvUIm63ruwsHR7RlQkR-2jfOPELG2hjZrrYr9JYr4ndSfVaYIajhTpmB6Ud0DIXz1D_uI\u002Fs1600\u002Fsoc-1.jpg","2026-09-25T11:30:00+00:00","2026-09-25T14:00:52.102162+00:00",7,[17,20,22,25],{"name":18,"type":19},"Google","vendor",{"name":21,"type":19},"Anthropic",{"name":23,"type":24},"Generative AI","technology",{"name":26,"type":24},"Two-factor authentication","839da5c1-3c34-47e2-9499-f7201640e3ac",{"id":27,"icon":29,"name":30,"slug":31},null,"AI Security","ai-security",[33,38,43],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":39},{"id":40,"icon":29,"name":41,"slug":42},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":44},{"id":45,"icon":29,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18,21],{"controls":51,"vendors":129},[52,81,110],{"slug":53,"name":54,"problem":55,"products":56},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":82,"name":83,"problem":84,"products":85},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xsiam","Cortex XSIAM","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xsiam","AI-driven security operations platform that centralises security data, detection, automation and response for the SOC.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"splunk","Splunk","\u002Fvendor-logos\u002Fsplunk.png","enterprise-security","Splunk Enterprise Security","https:\u002F\u002Fwww.splunk.com\u002Fen_us\u002Fproducts\u002Fenterprise-security.html","SIEM for detection, investigation and response, on premises or in the cloud.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"abstract-security","Abstract Security","\u002Fvendor-logos\u002Fabstract-security.png","abstract-composable-siem","Abstract Composable SIEM","https:\u002F\u002Fwww.abstract.security\u002Fplatform","SIEM built from separate parts for collection, AI-assisted detection and tiered retention, which can be adopted one at a time.",{"slug":111,"name":112,"problem":113,"products":114},"soc-automation","SOC automation and AI analysts","Alerts arrive faster than the team can investigate them, so real attacks wait in the queue or are closed unread.",[115,120,121],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":116,"product_name":117,"url":118,"description":119},"splunk-soar","Splunk SOAR","https:\u002F\u002Fwww.splunk.com\u002Fen_us\u002Fproducts\u002Fsplunk-security-orchestration-and-automation.html","Security orchestration and automation that runs playbooks to investigate and respond to incidents in seconds.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"7ai","7AI","\u002Fvendor-logos\u002F7ai.png","7ai-agentic-security-platform","7AI Agentic Security Platform","https:\u002F\u002F7ai.com\u002Fplatform","AI agents for alert triage, investigation and threat hunting in one platform for the SOC.",[130],{"slug":131,"name":18,"logo_path":132,"roles":133},"google","\u002Fvendor-logos\u002Fgoogle.png",[134],"reported_by",{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":148},"ai-accelerated-attacks-outpace-fragmented-soc-defenses","AI-Accelerated Attacks Outpace Fragmented SOC Defenses","Generative AI has fundamentally compressed the attacker's iteration cycle, enabling threat actors — including state-sponsored groups — to automate reconnaissance, exploit development, and credential harvesting at minimal cost and high speed. Meanwhile, SOC teams remain hampered by siloed tools and alert queues that break the defender's ability to maintain continuous context across an attack sequence. This asymmetry means that a failed attack is no longer a meaningful deterrent, as adversaries can cheaply retry with adjusted tactics within minutes. The core problem is not a lack of data but a lack of connected, persistent analytical context — defenders must close this feedback loop before AI-enabled adversaries widen the gap further.",[140,141,142,143,144,145,146,147],"CIS Control 13 – Network Monitoring and Defense","CIS Control 17 – Incident Response Management","NIST SP 800-61 Rev. 2 – Computer Security Incident Handling Guide","NIST SP 800-137 – Information Security Continuous Monitoring","MITRE ATT&CK – Reconnaissance (TA0043) and Resource Development (TA0042)","NIST AI RMF – Govern 1.2 (AI risk in organizational context)","ITIL 4 – Continual Improvement Practice","NIST CSF 2.0 – DE.AE (Adverse Event Analysis)",{}]