AI enhances SOCs but human expertise vital against threats

Techday NZ

25-04-2025

N-able has published its first annual report examining the current landscape and future prospects of Security Operations Centres (SOCs), drawing on operational data from Adlumin's Managed Detection and Response (MDR) SOC team.
The report, titled the 2025 State of the SOC Report, analyses the increasing complexity of cyberthreats and the evolving role of SOCs in defending against them, with a particular focus on the impact of artificial intelligence (AI) and the continued necessity of human oversight.
According to N-able, the prevalence and sophistication of cyberattacks continue to rise, pushing SOCs to adapt beyond traditional response mechanisms. The implementation of AI within SOC operations is identified as central to improving efficiency, notably by automating tasks that were once handled manually and allowing analysts to divert attention to critical threat anticipation and response.
Vikram Ramesh, Chief Strategy Officer at N-able, commented on the findings: "Today's cybersecurity environment demands more than detection—it requires precision, adaptability, and speed. This report reinforces what we're seeing across the industry: cyber resiliency hinges on integrating AI with expert-led response.
"We're focused on building security operations that are resilient by design, capable of adapting in real-time, and ready to meet future challenges. Adlumin's SOC exemplifies our mission of delivering protection that's not just reactive but proactively built to anticipate and outpace evolving threats."
The report's conclusions are based on frontline incidents from Adlumin MDR SOC between December 2024 and February 2025. During this period, the SOC processed nearly 500,000 security alerts and raised 83,171 escalations. The report confirms that ransomware was a persistent major threat, with 2,684 ransomware incidents handled in that timeframe.
AI is credited with significant gains in SOC efficiency, with applications reducing analysis time and lessening the need for extended human review. The report highlights that AI can identify indicators of compromise in as little as 10 seconds. It is estimated that AI-managed automation now enables 70% of all incident investigations and remediation actions to be handled without direct human input.
Despite the gains from automation, the report underscores that specialised human expertise is still a cornerstone of SOC effectiveness. According to the findings, 86% of security alerts generated escalate to tickets, reflecting the fact that most incidents still require human validation or intervention to resolve effectively.
Another trend noted in the report is the shifting locus of threat detection. Endpoints remain the primary source, accounting for 56% of detections during the study period. However, cloud environments are quickly narrowing the divide, now representing 44% of all threat detections. The report also notes that nearly all breaches in cloud settings require account containment as part of remediation efforts.
Will Ledesma, Senior Director of MDR Cybersecurity Operations at Adlumin, shared perspective on the recent changes: "In 2024, the threat landscape escalated. The Adlumin MDR SOC was on the front lines of that shift, responding to thousands of escalations. What we've seen is clear: AI in cybersecurity is no longer just about enrichment; it's about adaptation. The State of the SOC Report reflects our journey: the threats we faced, the wins we earned, and how we continue to advance and evolve for businesses looking to outpace threats in 2025."
The report is designed to provide actionable insight for SOC operators, IT decision-makers, and cybersecurity professionals assessing the adoption of AI technologies in their operations. The experiences of the Adlumin SOC team during the observed period are presented as evidence of the tangible benefits and current limitations of AI in security management, with a clear emphasis on the necessity for ongoing human expertise.
N-able's research is one of several ongoing industry examinations into the integration of automation and AI in cyberdefence and its implications for organisational resilience against accelerating digital threats.