Sekoia's David Bizeul on Gartner's ISOC category, AI agents and the changing role of SOC analysts
In an interview, Sekoia Chief Solution Officer David Bizeul argues that the next SOC will combine human analysts with AI agents. He discusses Gartner's Integrated Security Operations Center (ISOC) category, which is designed to challenge the traditional SIEM model by bringing SIEM, CTI, SOAR and AI agents into one platform. He expects analysts to move toward critical thinking, skepticism and mentoring agents, while agents take over repetitive triage and investigation. The piece is vendor commentary, not an incident or threat report, and contains no vulnerabilities or indicators.
Detalhes técnicos
- ISOC solutions keep core SIEM functions (data ingestion and normalization, structured event storage, detection rules). They add integrated CTI, SOAR and AI agents for triage, investigation, task definition and detection engineering.
- Sekoia ties each detection rule to a runbook that records the detection rationale, attack type, potential impact, investigation questions for the agent and false-positive risk. Analysts can tune these runbooks and give feedback on why an agent's answer was wrong.
- Proposed metrics: Mean Time to Detect (MTTD, ideally seconds), Mean Time to Investigate (MTTI), Mean Time to Respond (MTTR, with playbook automation), the share of alerts removed by automated triage to reduce alert fatigue, and SOC Total Cost of Ownership (TCO). Bizeul says he is working on a TCO framework.
- Bizeul says threat actors already use AI and that attack volume could grow 10x to 100x or more, so SOC teams must become more efficient.
Remediação
- Do not trust agent output blindly. Make agent reasoning steps reviewable and let analysts adapt the process to the organization's procedures.
- Keep training junior analysts, for example by having them review agent investigations and runbooks, to avoid an expertise gap in about 10 years.
- Review SOC staffing against the growth of the attack surface instead of cutting headcount without changing the operating model.
Linha do tempo
-
Sekoia's David Bizeul on Gartner's ISOC category, AI agents and the changing role of SOC analysts
ler a análise desta fonte ocultar
In an interview, Sekoia Chief Solution Officer David Bizeul argues that the next SOC will combine human analysts with AI agents. He discusses Gartner's Integrated Security Operations Center (ISOC) category, which is designed to challenge the traditional SIEM model by bringing SIEM, CTI, SOAR and AI agents into one platform. He expects analysts to move toward critical thinking, skepticism and mentoring agents, while agents take over repetitive triage and investigation. The piece is vendor commentary, not an incident or threat report, and contains no vulnerabilities or indicators.
Technical Details
- ISOC solutions keep core SIEM functions (data ingestion and normalization, structured event storage, detection rules). They add integrated CTI, SOAR and AI agents for triage, investigation, task definition and detection engineering.
- Sekoia ties each detection rule to a runbook that records the detection rationale, attack type, potential impact, investigation questions for the agent and false-positive risk. Analysts can tune these runbooks and give feedback on why an agent's answer was wrong.
- Proposed metrics: Mean Time to Detect (MTTD, ideally seconds), Mean Time to Investigate (MTTI), Mean Time to Respond (MTTR, with playbook automation), the share of alerts removed by automated triage to reduce alert fatigue, and SOC Total Cost of Ownership (TCO). Bizeul says he is working on a TCO framework.
- Bizeul says threat actors already use AI and that attack volume could grow 10x to 100x or more, so SOC teams must become more efficient.
Remediation
- Do not trust agent output blindly. Make agent reasoning steps reviewable and let analysts adapt the process to the organization's procedures.
- Keep training junior analysts, for example by having them review agent investigations and runbooks, to avoid an expertise gap in about 10 years.
- Review SOC staffing against the growth of the attack surface instead of cutting headcount without changing the operating model.