The Babysitters' Club: How AI Tooling Made Extra Work for the SOC

Working in the age of AI is a complete trip.

Unlike the Great Cloud Migration, which seemed to last for eons, companies are rushing toward AI like it promised them gold. I remember having to beg leadership just for a small taste of cloud infrastructure back in the day. Fastforward to recently, I was pretty much forced to use AI or risk being branded as insubordinate. What have we all come to?

I'm not an AI hater, but I'm definitely not an uncritical cheerleader, either. I talk about its shortcomings just as much as I celebrate its strengths. I wish I could say that we could leap into AI like we tried to leap into the cloud, but the implications are fundamentally different, aren't they?

In a previous role, I was asked to use an array of tools that had shiny new AI features slapped onto them. I was asked to use said tools to aid in incident investigations, consult it when I needed clarity, feed commands into it, and have it interpret code. In lieu of the intentional training, mentorship, and review needed to build an agile, knowledgeable team, I was essentially handed a new trainer...AI.

Almost in the same breath, leadership issued a warning: Do not trust what it tells you. Double-check it. Doubt yourself if your instincts agree with it. AI is still a big, scary threat.

As Jeff Darrington at Graylog put it in a great breakdown on AI in the SOC, AI only earns trust when it can show its receipts. Without audit trails, reproducibility, and logging, telling teams to rely on AI in SOC environments doesn't solve the issue of the never-ending unsolved alert mountain—it just shifts the burden back onto the teams and becomes a liability. That was my daily reality.

Caught in the daily grind of the unavoidable alert fatigue that plagues every security team, I was also forced to babysit a machine in a workflow I didn’t own, trying to meet expectations that were being invented on the fly. It felt less like working on the cutting edge and more like living on edge, constantly second-guessing whether the tool was right or if I was just too mentally drained to spot its hallucinations. I was drowning in confusion: checking my own analysis while simultaneously proofreading a vendor's black-box AI.

When I recently talked about speed as a capability, I highlighted three things that organizations will be tempted to outsource to AI, but shouldn't: documentation, experiential practice, and socializing security context.

And guess what I watched get outsourced in that very environment? All three. How do you think that went?

AI is a tool. And like any tool, it has to be paired with the human discernment that machines simply cannot replicate yet. You don’t buy a screwdriver and expect it to tell you what needs tightening. You don’t drop a garden hose in the yard and expect it to design your dream landscape. If an organization doesn't have a clear intention behind adopting AI—beyond the vague hope of shaving minutes off a metric or cutting headcount—they are letting something that is still in beta steer the ship.

In my course, Cybersecurity Awareness: AI, I gave learners a reality check:

"AI should complement your expertise, not replace it. It lacks human judgment, context awareness, and sometimes ethical reasoning."

And when the pressure mounts, there is one non-negotiable truth every professional needs to remember:

"AI isn't sitting in the meeting defending your work. You are."

An AI tool with a defined, but bounded purpose can be extremely valuable. But deciding what that purpose is falls entirely on us. Leadership has to determine which workflows are mature enough to benefit from machine assistance before buying whatever shiny toy the vendor pitched over steak and wine.

That is how you set guardrails. And that is how you stop manufacturing extra work for a security team already drowning in unresolved cases.