Artificial intelligence has become indispensable when it comes to managing cyber risks. This naturally raises the question of whether AI could not take over the work of security analysts entirely. The short answer is: no. However, that is not the end of the matter. The real strength of a modern managed SOC lies in the fact that artificial intelligence and humans work hand in hand.
Processing huge amounts of data
A Managed Security Operations Centre processes an enormous amount of telemetry data every day. Every alert, every process execution, every system login and numerous other events provide clues. These indicate whether attackers are moving within the network or whether the activity is normal. The challenge for the team of analysts is not to gather as much information as possible. Rather, it is a matter of filtering out the truly relevant events in order to detect attacks and respond to them.
Most alerts turn out to be harmless once they have been analysed. Nevertheless, we must first assess every anomaly. This is where artificial intelligence can provide valuable support.
AI as a tool to speed up analysis and support evaluation
Day-to-day operations in a SOC are not just about data volumes, but also about speed. Analysts, for example, examine complex PowerShell commands, command lines or log files and need to quickly understand how they work and the context behind them. Artificial intelligence can then provide support in the form of an ‘intelligent sparring partner’: it summarises extensive information, provides background context and, where necessary, refers to technical documentation. This eliminates a large part of the manual research. The team of analysts can therefore reach an initial assessment more quickly as to whether the activity is malicious or not. This saves them valuable time for the actual investigation. Particularly in the case of ongoing cyber-attacks, this time advantage is crucial for minimising the damage.
Whilst artificial intelligence is very helpful, caution is still required: it never knows the full context. For example, it does not know what specific network characteristics a company has and which processes are therefore acceptable and which are not. A single command may appear suspicious, even though an administrator has deliberately executed it as part of maintenance work. Conversely, a seemingly harmless process may actually be part of a targeted attack.
“AI only evaluates the information available to it. It is still up to humans to decide whether it is actually a security incident”, says Christoph Schulze.
In their work, the team of analysts takes into account the specific circumstances within the organisation, such as the network structure, known processes, previous incidents and other company-specific factors. The specialists at German Cyber-Defense receive this information during the G DATA MXDR onboarding process. Furthermore, in the event of a confirmed attack, the team of experts decides which measures to take. Artificial intelligence supports this process by providing suggestions. Ultimately, however, it is a human who makes the final decision on the next course of action and bears responsibility for it. The nature of the response is either agreed with the customer or initiated directly, as it has generally been agreed upon in advance. It is precisely this combination of technical support and human experience that ensures decisions remain well-founded and transparent. Furthermore, this helps to reduce false alarms.
Decisions cannot be automated
Cybersecurity is rarely black and white. Many situations can only be properly assessed once lessons learnt from previous incidents have been taken into account. The team of analysts identifies patterns, scrutinises results and critically examines whether the AI’s recommendation is in fact plausible. It is important to note that even modern AI systems make mistakes. They may misinterpret correlations or arrive at inaccurate assessments due to a lack of information. That is why the specialists at G DATA do not accept AI results at face value. They serve as a support, but not as a substitute for the technical expertise of the analyst team.
It is also clear, however, that development is still in its infancy. In a managed SOC, many processes are repeated on a regular basis. In future, AI could recognise that certain events have already been assessed as non-critical dozens of times and provide analysts with a corresponding assessment. Automatic responses to clearly identified threats, such as the temporary isolation of a compromised system, are also becoming increasingly important in this context. The final check, however, remains with humans.
A problem that is often underestimated in the day-to-day work of an analyst team is what is known as ‘alert fatigue’. The SOC processes numerous alerts every day, many of which turn out to be harmless. Anyone who spends hours repeatedly assessing similar cases inevitably runs the risk of becoming too accustomed to the routine and overlooking critical differences. This is precisely where artificial intelligence can demonstrate its strengths: it never tires, assesses every incident according to the same criteria and detects even minor deviations from known patterns. This enables it to draw the analyst team’s attention specifically to events that actually warrant closer investigation. This not only saves time but also improves the quality of the analysis.
Cooperation is the future
These days, people often say: it’s either AI or humans. In the field of cyber security, however, the guiding principle is quite clear: skilled professionals working alongside artificial intelligence. AI processes large volumes of data, summarises information and speeds up routine tasks. Meanwhile, experienced analysts bring contextual knowledge, a sense of responsibility and the ability to correctly assess complex situations. It is precisely this interplay that makes a modern Managed Security Operations Centre so powerful and effective. Successful cyber defence does not come about through intelligent algorithms alone, but through intelligent decisions.
