Artificial intelligence is making its way into security operations centers, where large language models help analysts with vulnerability analysis and detection engineering. According to Corelight Field CTO Vince Stoffer, these tools can write SIEM rules and small programs that analyze packets or Zeek metadata. Teams using agentic triage report faster work and fewer false positives, and junior analysts are able to dig deeper into network data than before.
Still, Stoffer stresses that a human must remain in the loop before agents are allowed to take blocking or response actions. On the offensive side, attackers are using AI for coordinated agentic operations, zero-day creation, and highly convincing social engineering. The same AI models are also surfacing a wave of vulnerabilities that security teams need to address.
To keep AI adoption from introducing new risks, Stoffer advises organizations to watch for shadow AI, enforce least privilege, audit changes, and use network monitoring to track AI use across the enterprise. These steps help ensure that AI becomes a controlled asset rather than a hidden liability in the SOC.