AI in the SOC: What Could Go Wrong?

Two enterprise security leaders presented findings from six-month AI pilots in their SOCs at RSAC 2026: a manufacturing SOC used an LLM as a read-only triage assistant and saw improved discovery/response times and reduced false positives with strict governance, while a financial SOC found AI helpful for summarization and reducing analyst fatigue but unsafe when given full control, leading to human-only final actions and caution about regulatory and OT risks.