28% of Security Alerts Go Uninvestigated as SOC Teams Test AI

Security operations centres are increasingly experimenting with artificial intelligence, but many teams still face basic operational gaps that could limit how effectively AI agents are deployed, according to a 2026 survey of more than 250 CISOs, SOC leaders and security practitioners.

The survey found that 40 per cent of security teams already use AI every day, while another 56 per cent are testing it. Only 4 per cent said they had no plans to adopt AI. At the same time, respondents said 28 per cent of security alerts are never investigated, highlighting the workload pressures facing many SOC teams.

The findings suggest that AI adoption in security operations is moving rapidly, but readiness depends on more than simply deploying an AI tool. Teams need sufficient data access, reliable context, clear investigation standards and defined rules governing what an AI agent is allowed to do.

Missed Alerts Remain a Major SOC Problem

Alert overload remains one of the biggest operational challenges for security teams.

According to the survey, 60 per cent of respondents said an alert that had previously been ignored or missed later developed into a serious issue such as a breach or downtime.

Security teams also reported that lower-severity alerts often wait for investigation or are closed in bulk because analysts must prioritise critical and high-severity incidents first.

A complete investigation may require analysts to move across multiple systems, including SIEM platforms, endpoint detection tools, identity providers, cloud consoles and email security systems.

The report said noisy detections are sometimes disabled because teams do not have enough time to tune them, while threat hunting and detection engineering are often delayed until analysts have spare capacity.

Staffing also remains a concern. In some SOCs, only a small number of senior analysts handle the most difficult investigations, while nights and weekends may have limited coverage.

AI SOC agents are being positioned as a way to reduce this burden by beginning investigations as alerts arrive, collecting context from multiple security systems and documenting the evidence behind their conclusions.

Data Access and Context Are Critical

An AI security agent can only investigate activity that it is able to query.

If an agent has access to endpoint telemetry but not identity information, for example, it may be able to explain what happened on a device but not determine which user account was responsible.

The report identifies three areas as particularly important for technical readiness: API access to relevant security tools, access to organisational context and reliable data pipelines.

Security teams may need to provide AI agents with access to SIEM, EDR, identity platforms, cloud environments, email systems and important SaaS applications.

Context is equally important. Information such as asset criticality, user roles, business units, VIP lists and known legitimate activity can help an AI system distinguish malicious behaviour from normal administrative activity.

The report recommends that organisations review several recent incidents and identify every query a senior analyst used to resolve them. Any query that an AI system would be unable to run represents a visibility gap that should be addressed before deployment.

Privacy Is the Most Common AI Security Concern

Data privacy remains one of the biggest barriers to AI adoption in security operations.

Forty-four per cent of respondents cited concerns about data privacy and how AI models are trained as the most common obstacle to deployment.

The report recommends that security teams ask vendors whether customer data is used to train AI models and where organisational data is processed.

Such questions are particularly important for SOC environments because security platforms routinely handle sensitive information, including employee identities, endpoint activity, authentication records and incident data.

Teams are also encouraged to ensure that the log sources used by AI systems are complete and reliable.

A delayed or unavailable data source can cause an investigation to appear complete even though important evidence is missing.

Human Oversight Remains the Default

Despite growing interest in autonomous security operations, most organisations are not ready to give AI agents unrestricted control.

The survey found that 57 per cent of teams require a human to review every AI decision before an alert can be closed.

For incident response, 44 per cent said AI recommends actions that people then carry out, while 30 per cent allow AI to perform low-risk remediation independently.

No respondent reported allowing AI to operate with completely unsupervised autonomy.

The report recommends that organisations clearly define which actions require human approval before beginning an AI SOC pilot.

Sensitive operations such as isolating endpoints, disabling user accounts or blocking domains may initially remain under direct human control.

A gradual deployment model can begin with read-only investigation access and expand permissions only after the system demonstrates reliable performance.

SOCs Need a Written Investigation Standard

Another major readiness requirement is a clear definition of what constitutes a completed investigation.

In many security teams, this standard may exist only in the experience of senior analysts rather than in formal documentation.

The report recommends that organisations document the evidence required to close common alert types, the circumstances that require additional verification and the conditions under which an alert can safely be classified as benign.

Teams should also record baseline metrics before introducing AI.

Useful measurements include the percentage of alerts investigated, mean investigation time, the delay between an alert being generated and first reviewed, and the number of previously closed cases that are later reopened.

The survey found that a thorough investigation takes an average of 75 minutes, while alerts can wait close to an hour before anyone begins reviewing them.

Internal AI Projects Often Fail to Reach Production

Some security teams are choosing to build their own AI tools instead of purchasing commercial platforms, but the survey suggests that this approach carries significant challenges.

Among organisations already using AI, 72 per cent had attempted to develop internal AI tools.

Of those projects, 46 per cent were abandoned, failed to reach production or were eventually replaced by a commercial product.

The report argues that building a working AI prototype represents only part of the effort.

Production systems also require ongoing integration maintenance, management of API changes and rate limits, repeated evaluation when models change, security testing against prompt injection and detailed audit trails explaining automated decisions.

These operational requirements can significantly increase the cost and complexity of maintaining internally developed AI security systems.

AI Readiness Depends on SOC Fundamentals

The findings show that AI agents may help security operations teams reduce alert backlogs and free analysts for threat hunting and detection engineering, but successful deployment depends on the strength of existing security operations.

A SOC does not necessarily need to be highly mature before adopting AI. However, it needs reliable access to security data, clear investigation procedures, healthy telemetry pipelines and defined limits on automated actions.

The most important preparation may therefore be less about the AI itself and more about whether the organisation has documented how investigations should work, what information analysts require and which decisions must remain under human control.

As AI adoption accelerates across security operations, teams that address those fundamentals first are likely to be better positioned to use AI agents without creating new visibility, privacy or control risks.