#Side by side
| SOAR | AI SOC agent | |
|---|---|---|
| Logic | Deterministic playbooks | Model plans investigation per alert |
| Coverage | Alert types with a playbook | Any alert with data access |
| Maintenance | Playbooks break when tools or formats change | Prompts/policies; less brittle to format changes |
| Failure mode | Stops or misroutes on unknown input | Confident wrong verdict (needs grounding) |
| Auditability | Exact, by construction | Requires cited evidence per claim |
| Response actions | Strong, well-governed | Should call governed actions (often via SOAR) |
#How each fails, and how to catch it
SOAR fails loudly: a playbook hits an unexpected field and stops, and someone notices. An AI agent fails quietly: it closes a real alert with a fluent, wrong explanation. That asymmetry dictates the controls. Require every verdict to cite the queries and results it relied on; escalate when evidence is missing rather than closing; seed known-malicious activity weekly and track the false-negative rate; and review a random sample of closed alerts with a senior analyst. Our base-rate analysis shows why closure rates alone are not a quality measure.
#The practical architecture
Use the agent for investigation and verdicts; use SOAR (or equivalent) as the governed actuator for response. The agent proposes "isolate host X", the playbook executes it with the same approvals and logging as today. Measure the agent's false-negative rate on seeded attacks; our base-rate analysis shows why closure rates alone mislead.
Talk to an operator.
Thirty minutes, no slides. We'll show you what bad AI finds in one of your systems.
Book a briefing