Loading...
New
See what manual alert triage really costs your security team.
New
See what manual alert triage really costs your security team.
See what manual alert triage really costs your security team.
See what manual alert triage really costs your security team.
Loading...
In October 2026 docs for 10 AI SOC solutions, Microsoft's Security Alert Triage Agent (generally available for user-reported email only), Prophet Security, and Simbian need the least customer-written logic for a new alert type. Intezer and 7AI publish escalation rates, each measured differently. All 10 reduce dependency on human analysts and still leave some work for a person.
Ask which AI SOC solutions reduce dependency on human analysts, and most vendors answer with an hours-saved number. Read the documentation and you can see where the analyst went: a review queue, a runbook editor, a memory-cleanup task, or a managed service billed by the month.
Some of that work should stay. But a tool that turns your Tier 1 SOC analyst into a full-time runbook editor has renamed the dependency, and your headcount plan won't show it. Splunk's State of Security 2025 found that 46% of the 2,058 security leaders it surveyed spend more time maintaining their tools than defending the organization. An AI SOC that needs constant upkeep adds to that number.
We build Simbian, so read the comparison knowing that. Every claim below about the other nine tools comes from their public documentation as of October 28, 2026. We read the documentation; we didn't run the tools.
Take a hypothetical alert. A user reports a phishing email in the middle of the night, and the tool investigates and calls it malicious. In most of these tools, someone still reads the verdict and approves or runs the password reset. In some, that person also decides whether the tool should remember the lure. That someone might be your analyst, your detection engineer, an admin pruning memory next month, or a vendor's night shift.
Five questions find out which.
After an AI SOC goes live, analyst work moves to five places: verdict review, response approval, logic for new alert types, teaching the tool, and night cover. Who ends up doing that work tells you more about an automated SOC than any vendor's savings figure. Vendor docs give very different answers, though you wouldn't guess it from the agentic SOC pitch.
Some tools close false positives on their own. Exaforce can auto-close them so they "never reach your queue," and Microsoft's Security Alert Triage Agent resolves them in user-reported email. Others put a person in front of every result. Dropzone AI's documentation sends completed investigations to a review queue where "human analysts evaluate the AI's conclusions," and suggests reviewing 10 to 15 or more investigations a day in the first few weeks. Microsoft's Agent also leaves a malicious alert "open and in progress for an analyst."
Reviewing every verdict makes sense in week one, while you decide whether to trust the tool. If review is still mandatory in month six, your Tier 1 analysts are spending the shift re-reading its verdicts.
Nearly every AI SOC tool gates response by action type. Each gate waits for someone to notice it, and at night that can take a while. CrowdStrike says Charlotte AI "does not take automated response actions by default," and Microsoft's triage Agent stops at the verdict, leaving response to your existing tools.
In a trial, count approvals per 100 alerts and time the ones that land overnight. Check that each approved action names its approver and can be rolled back.
In several AI SOC tools, your detection engineers write the logic for each new alert type, as a runbook, a workflow, a prompt, or a strategy. Torq's knowledge base says the Socrates Agent's runbook step "will fail if the relevant case doesn't have an associated runbook." Generated action plans still need a person to "review each Action's instructions and methods and make any necessary modifications." For its Agentic SOAR, CrowdStrike asks you to define "the triggers, data, rules, agents, and actions" for every workflow.
Simbian isn't at zero here either. Someone on your team, the AI Skill Manager, still encodes how you work into the skills the Agents run.
Most of these tools learn from analyst feedback in some way. They differ on who looks after what gets learned. Dropzone's documentation says its admin-written Custom Strategies need "regular review and pruning," and schedules recurring cleanup of stale Context Memory records. Exaforce's product page says future triage decisions pick up a pattern automatically once analysts keep correcting it, and a Torq blog says "whatever the analyst decides retrains the model." Neither documents an approval step, which leaves open who checks what the model absorbed.
Microsoft's triage Agent sits at the other end. An analyst gives feedback in plain language, the Agent drafts it as a lesson, and an authorized user reviews it before it enters memory. For now that works only on email and collaboration alerts.
Six of the 10 AI SOC vendors we checked (Prophet Security, 7AI, Exaforce, CrowdStrike, Microsoft, and Google) sell managed human cover for overnight alerts. Prophet calls its version an "optional 24x7x365 human-in-the-loop service" in which "an expert engages within 30 minutes." Intezer also keeps its experts on call for the most complex incidents.
Count bought 24/7 coverage as human analyst hours when you compare tools, even where it's the right call for a small SOC team.
Tools that work overnight inside approval gates, Simbian included, still need a person whenever an action requires sign-off.
By their October 2026 documentation, Simbian, Prophet Security, and Microsoft's Security Alert Triage Agent need the least customer-written logic before investigating an unfamiliar alert. Microsoft's Agent covers user-reported email in general availability. Torq, CrowdStrike, and Dropzone AI lean hardest on logic your team writes and maintains: runbooks, Agentic SOAR workflows, and admin-written strategies.
The 10 we checked are Simbian, 7AI, CrowdStrike Charlotte AI, Dropzone AI, Exaforce, Google SecOps, Intezer, Microsoft's Security Alert Triage Agent, Prophet Security, and Torq. Intezer says fewer than 2% of alerts are escalated to a human. Exaforce's 0.06% escalation rate covers its MDR service, people included, and 7AI shows one customer's week with 193 of 6,119 alerts escalated. The three figures measure different things. We chose these columns because they're where the tools differ most, including where Simbian differs.
| Tool | Verdict review | Response approval | New alert types | Who maintains the learning | 3 a.m. coverage |
|---|---|---|---|---|---|
| Simbian | Every alert to a verdict, with a confidence rating | Gate any action; lift gates one action type at a time | No playbooks; an AI Skill Manager encodes team knowledge as skills | Analyst corrections and its own proposals go to one approval queue | Software; gated actions wait for a person |
| 7AI | Every alert; 96% deflected in one customer's week | You approve what executes | Skills written by your team or generated for review | Not documented as a product feature | Paid 24x7 team (PLAID ELITE) |
| CrowdStrike Charlotte AI | Falcon detections; routing by your playbooks | No automated response by default | You define triggers, rules, and actions in Agentic SOAR workflows | Corrections improve Agents (shared context in pre-beta); governance not documented | Falcon Complete analysts |
| Dropzone AI | In-scope alerts; every result queued for review | Low-risk automatic, high-risk approved | Admin Custom Strategies | "Regular review and pruning" by admins | Software; no managed service documented |
| Exaforce | Every alert; false positives can auto-close | Approval gates where needed | Natural-language playbooks; custom logic on request | Automatic; no approval step documented | MDR analysts |
| Google SecOps | About 10 per hour per tenant; over that, manual | Response Agent in preview, approval by default | Customer-built remediation playbooks | Thumbs up or down | Mandiant Managed Defense |
| Intezer | Under 2% escalated (vendor figure) | Automatic or analyst-approved | Plain-language Workflows; help migrating SOAR playbooks | Feedback tunes triage; approval not documented | On-demand access to Intezer experts |
| Microsoft Security Alert Triage Agent | GA for user-reported phishing and malware email; malicious alerts stay open | Verdict only | Setup wizard | People give feedback and approve each lesson (email and collaboration alerts) | Defender Experts |
| Prophet Security | Every alert; says when it can't conclude | Approved action types, backtested | Plain-language guidance | Previewed and backtested before applying | Optional human service (Watchtower) |
| Torq | Every alert gets a verdict; low confidence escalated | High-impact actions need approval | Runbooks for Socrates to follow; generated action plans reviewed by people | Retrains on analyst verdicts; approval not documented | Not documented |
Every row comes from each vendor's public pages as of October 28, 2026. "Not documented" means we couldn't find it, and the capability may still exist. Simbian's row comes first; the rest are alphabetical. Simbian doesn't publish an escalation rate.
Only a trial on your own alerts shows how often a tool gets a verdict wrong. SentinelOne Purple AI and UnderDefense aren't in the table, so run the same five questions on them yourself. Volume limits are their own question, covered in our test of AI SOC tools on full alert coverage.
Treat vendor staffing figures with care. CrowdStrike's "more than 40 hours of manual work per week" is modelled at five minutes per alert. Two of Prophet's case studies assume one analyst handles 1,400 investigations a year in one and 4,200 in the other. Before you compare two hours-saved claims, ask for the minutes-per-alert assumption behind each.
Keep human approval on any action that touches an employee or is destructive and hard to reverse, and keep human sign-off on what the tool learns. Those are judgment calls, and your team should own them. In ISC2's 2025 Cybersecurity Workforce Study, 72% of respondents said reducing security personnel significantly increases the risk of a breach.
Hand the rest to the tool: alert investigation and enrichment, routine false positives, the first look at a night alert, runbook authoring, and memory pruning. That work grows with every new alert source, and so does SOC analyst burnout.
Your analysts' skill is one more dependency worth keeping on purpose. A tool that shows the evidence behind each verdict (the queries it ran, what came back, and why it concluded what it did) lets an analyst audit the work and learn from it. Score-only output invites automation bias. Review turns into rubber-stamping, and your team loses the habit of catching the tool when it's wrong.
Test AI SOC solutions by counting human touches on two weeks of your own closed alerts, from every source and severity. Run the same six measures on every tool in your AI SOC evaluation, including the one you already favor, and compare week two with week one.
| Measure | What to count | What good looks like |
|---|---|---|
| Touches per 100 alerts | Every open, edit, approval, or close by a person | Falls between week one and week two |
| Mandatory review rate | Verdicts your policy requires someone to read before close | Drops as trust builds, by your choice |
| Approval wait | Median minutes from proposed action to approval, office hours and nights | Nights look like office hours |
| Authoring hours per new alert type | Time spent writing runbooks, strategies, prompts, or routing rules | Close to zero for a type it hasn't seen |
| Repeat corrections | The same correction made twice | None after the first approval |
| Escalation completeness | Escalations that arrive with what was already checked | Nobody redoes the investigation |
If touches fall while authoring hours or repeat corrections climb, the dependency moved.
Simbian needs no playbook to investigate an alert type it hasn't seen, and it takes the first look at each alert day and night. Its AI SOC Agent investigates to a verdict and acts in the tools you already own, while your team keeps the approvals.
As of October 2026, it averages under four minutes from detection to response, and 95% of the responses it proposes are approved by the customer's own analysts. Their call, not ours.
You decide which actions need approval, and you lift those gates one action type at a time. Skill changes follow the same rule. When a pattern recurs, Simbian writes the proposed improvement itself and submits it for approval. A human approves before anything is applied.
Your people move up from Tier 1, Tier 2, and playbook work to running and governing the Agents. At Bottomline, 80% of the investigation is done before an analyst opens a case. Alert coverage rose from about 30% to close to 100% without new Tier 1 hires. "We're no longer thinking about a pipeline of work that we've got to have 20 people to solve," said Blaine Brennecke, Director of Security Operations at Bottomline.
Run the same six measures on Simbian. To see the touch count on your own alerts, book a demo and bring your last two weeks of closed alerts.
Q: What are AI SOC solutions? AI SOC solutions are software Agents, often called AI SOC analysts, that triage, investigate, and in some cases respond to security alerts from the security tools you already run. Your analysts review their conclusions rather than raw logs. The tools differ most in how much human review, setup work, and paid overnight cover they still need.
Q: Which AI SOC solutions reduce dependency on human analysts the most? By their own documentation, Microsoft's Security Alert Triage Agent (email alerts, in general availability), Prophet Security, and Simbian need the least logic written by your team for unfamiliar alerts. Intezer and 7AI publish escalation figures, each measured differently. Simbian investigates without a playbook, an AI Skill Manager on your team encodes how you work as skills, and your team keeps the approvals.
Q: Can an AI SOC take over Tier 1 SOC analyst work? Depending on the tool, it can take much of the Tier 1 queue, including alert triage, enrichment, routine false positives, and the first pass on alerts that arrive overnight. Tier 1 analysts move up to the judgment calls: approving destructive or employee-facing actions and deciding what the tool should learn.
Q: How do you evaluate AI SOC vendors for human in the loop? List which actions pause for approval before they run and which run on their own with an audit record. Check that every approval names the person who gave it, that each action has a rollback path, and that each verdict shows its evidence, since a bare score invites automation bias. Ask how often analysts override the tool.
Q: How does AI reduce SOC analyst burnout? AI reduces SOC analyst burnout by taking the repetitive Tier 1 work behind alert fatigue off your analysts. It only helps if that work doesn't come back as runbooks and memory cleanup for your engineers, so measure human touches per 100 alerts and authoring hours together during a trial.
Q: Which AI SOC analyst is best for my team? The best AI SOC analyst for your team is the one that leaves the fewest human touches per 100 of your own alerts, with authoring hours included. Run every candidate on the same set of closed alerts and compare approval wait and repeat corrections. Vendor hours-saved figures rest on different assumptions, so they can't settle it.
