EP242 The AI SOC: Is This The Automation We've Been Waiting For?

In this episode of the Cloud Security Podcast by Google, hosts Tim Peacock and Anton Chuvashkin interview Augusto Barros, a Principal Product Manager at Profit Security, about AI SOC (Security Operations Center). They discuss the definition of AI SOC, its potential to automate triage and investigation, and its impact on detection capabilities. The conversation explores how AI SOC can expand the throughput of handling detection events, reduce the concern of overwhelming the SOC with new detections, and potentially eliminate the need for a tier-one analyst. They also delve into how AI SOC compares to SOAR (Security Orchestration, Automation, and Response), the metrics for measuring the success and progress of AI SOC, common misconceptions about AI, and the future of AI SOC beyond triage, including improving detection rules and streamlining response steps. Augusto provides a tip for AI SOC adoption, emphasizing the importance of transparency in investigations to build trust and adoption. He also recommends the book "Noise: A Flaw in Human Judgment" by Daniel Kahneman and "Security Chaos Engineering" by Kelly Shortridge.