AI SOC vendors are selling a future that production deployments haven’t reached yet

This report investigates the disconnect between AI SOC vendor claims and real-world practitioner experience, finding narrow, cautious adoption focused on low-risk tasks (alert enrichment, summarization), frequent “pilot purgatory,” unreliable autonomous investigation/response in live environments, risks of suppressed alerts and degraded analyst judgment, and recommends vendors prioritize safety, reliability engineering, explainability, and evidence-backed metrics rather than prophetic marketing.