What you asked our SOC

Can you trust AI in the SOC? In the final session of the SOC Office Hours series, Critical Start CTO and Co-Founder Randy Watkins tackles the question head-on. He explains how Critical Start pairs SOC AI with human analysts, why every AI action is auditable, and why deterministic systems should anchor any AI-driven security operation. He also walks through how the team responded to PHP to Shell and answers live questions on shadow AI, conditional access, vendor evaluation, and starting a SOC career.

Key takeaways:

• Poll results from the series: 46% want a full audit trail before trusting AI in the SOC, 50% say AI helps most with triage and alert noise, and 26% want human sign-off on AI decisions.
• SOC AI starts from analyst investigation procedures, gathers hundreds of data points, and presents a ledger of evidence. Analysts validate or challenge the verdict, and the two reach a joint verdict.
• Critical Start has seen roughly a 60% reduction in time to investigate (TTI) across alert types.
• The Trusted Behavior Registry resolves known-good alerts before they reach AI or analysts. Deterministic lists don’t hallucinate, and the service keeps running if AI is slow or down.
• Two-person integrity applies to response actions, and AI has no direct access to response APIs.
• Randy’s six steps to a faster SOC: a critical asset list, best-practice logging, onboarding missing log sources, current on-call contacts, pre-authorized response actions by asset tier, and phishing-resistant MFA with conditional access.