What an AI SOC analyst does in security operations, stage by stage

An AI SOC analyst is a set of AI agents that performs the work traditionally handled by tier-1 and tier-2 analysts in a security operations center (SOC). It watches incoming signals, decides which alerts matter, investigates the ones that do, and carries out response actions under human oversight. Human analysts still own the judgment calls. What changes is how much of their shift disappears into repetitive work before they get to make them.

The term gets used loosely, so the clearest way to explain it is to walk through the alert lifecycle and look at what the AI actually does at each stage. The examples below use Exaforce’s task-specific AI agents, called Exabots, because each one maps to a stage most SOC teams already recognize.

Detection and triage in the first hours of a shift

In a traditional SOC the day starts with a queue. Overnight alerts from identity providers, cloud control planes, SaaS apps, endpoint tools, and email security pile up, and a tier-1 analyst works through them one at a time. Most turn out to be benign. A developer logs in from a new city, a service account touches a bucket it rarely uses, or a scheduled job moves enough data to look like exfiltration.

Exabot Detect runs detections across identity, infrastructure as a service (IaaS), SaaS, endpoint, email, and insider activity. Rather than firing on a single rule match, it evaluates each event against what it already knows about the environment. Exabot Triage then picks up the alert and works it the way a careful tier-1 analyst would. It checks who the user is and what they normally do, how sensitive the resource is, and whether related activity happened nearby in time.

The output is a verdict with its reasoning attached, so an analyst can read why an alert was closed instead of trusting a score. Across Exaforce customers this approach has produced a 90% reduction in false positives. Forcepoint, for example, sees 95% of alerts auto-triaged as verified false positives. The alerts that remain are the ones worth a person’s attention.

Investigation, where tier-2 time used to go

When an alert survives triage it becomes an investigation. For a human tier-2 analyst that usually means a dozen open tabs, pivoting between log search, the identity provider console, cloud audit trails, and a ticketing system while building a timeline by hand and messaging colleagues to ask whether a change was expected.

Exabot Investigate does that correlation work automatically. It pulls identity, configuration, and activity context, reconstructs the sequence of events, and writes up what happened and why it matters. Accton saw a 94% MTTI reduction, from 3 hours down to 10 minutes, where MTTI is mean time to investigate. Lumilens runs at a 6-minute blended MTTI for P0 and P1 findings.

Speed counts most mid-incident, when a wrong assumption can send a team down the wrong path for hours. Guardant Health took ~15 seconds to disprove a suspected AWS account compromise mid-incident, which let responders move on to what was actually happening.

Response and threat hunting

Once an investigation confirms something real, Exabot Respond carries out containment steps under human oversight. That arrangement keeps people in control of decisions with business consequences while removing the delay between a confirmed finding and the first containment step. Forcepoint reports a 14-minute mean time to respond (MTTR) on P0s, and the average alert-to-response time across customers is under 30 minutes.

Hunting is the part of the job that queue-bound analysts rarely get to. Exabot Hunt runs proactive hunts across the environment, and analysts can hunt alongside it in plain English through the Advanced Data Explorer, which queries logs, identity, configuration, code, and threat intel together. Exaforce calls this vibe hunting. An analyst can ask which service accounts authenticated from a new region this week and then follow the thread wherever it leads, without first writing a query in three different syntaxes.

The three models underneath

A single large language model (LLM) pointed at raw logs struggles with this work. It loses track of context over long investigations, reasons differently from one run to the next, and gets expensive quickly on large data sets. Exaforce splits the work across three specialized models instead.

The Semantic Model resolves entities and relationships and maintains a living map of the environment. The Behavioral Model learns what normal activity looks like for human and machine identities, applications, data, resources, and locations. The Knowledge Model is the reasoning layer that synthesizes that context into findings a person can act on. Because events resolve against structured context at ingest, the agents reason over an understood environment rather than guessing from text, which is what makes verdicts consistent and explainable.

How the human analyst’s day changes

With the AI SOC analyst handling first-pass work, the human role shifts toward review, direction, and the problems that need experience. A typical day starts to look more like this:

• Reviewing AI verdicts and reasoning on the alerts that matter, and correcting the agents when context is missing
• Leading incidents once a finding is confirmed, including decisions that need business input
• Running hypothesis-driven hunts with vibe hunting instead of waiting for alerts to surface a threat
• Tuning detections and feeding analyst judgment back so the system improves

The time savings are concrete. Fuze gets back 4+ days of person-hours every 30 days. That time goes back to the work analysts were hired for.

Teams can run the platform themselves, or have Exaforce MDR, a managed detection and response service, run the same Exabots for them around the clock with human analysts overseeing the work.

Request a demo to see an AI SOC analyst work through your own alerts.