Security operations centers (SOCs) are facing a changing cybersecurity environment as artificial intelligence enables attackers to improve their workflows, reduce troubleshooting time, and repeat unsuccessful attempts more efficiently. While discussions often focus on whether AI will create entirely new categories of cyberattacks, a more immediate shift is already visible in how existing attack methods are being executed. AI is making failed attempts cheaper to retry by helping attackers analyze errors, modify approaches, and continue testing possible paths toward their objectives. The change does not necessarily introduce new attack techniques, but it reduces the time, effort, and expertise required to move through the less visible stages of an intrusion, including research, troubleshooting, and adaptation.
Recent threat reporting highlights how AI is becoming increasingly integrated into attacker operations. Security researchers have observed threat actors using generative AI for activities such as translation, scripting assistance, research, and troubleshooting. Later reports documented malware samples interacting with AI models during execution and the emergence of underground services offering AI based tools designed for malicious purposes. Security investigations have also shown cases where AI supported activities were involved in areas such as reconnaissance, credential harvesting, and exploitation development. However, security experts emphasize that assessed AI assistance and confirmed large scale deployment are different claims, as attribution remains complex and the overall scope of AI assisted cyber activity is still developing. The broader trend indicates that AI is increasingly becoming part of attacker workflows rather than simply existing as an external resource. Although provider safeguards and abuse prevention measures create additional barriers, they should not be treated as complete security boundaries because attackers can adapt their methods, use alternative models, or divide tasks into smaller activities to bypass restrictions.
For defenders, the challenge is not only detecting threats but also improving the speed and quality of decision making after an alert appears. Traditional security processes often operate through disconnected stages involving threat intelligence, threat hunting, detection engineering, investigation, and remediation. Each function contributes valuable knowledge, but information can become fragmented during handoffs between teams. Important details such as user identity, evidence sources, investigation assumptions, confidence levels, missing telemetry, and business constraints may not fully transfer through alerts or tickets. This creates a situation where analysts repeatedly rebuild the same incident picture instead of working from shared operational knowledge. AI has shortened the feedback cycle for attackers, allowing them to test and adjust approaches quickly, while defenders may still lose valuable time gathering context across multiple systems. A more effective SOC model requires maintaining a shared state that preserves evidence, reasoning, ownership, and previous decisions throughout the incident lifecycle.
The concept of a stateful SOC focuses on creating a continuous operational memory that allows security teams and AI systems to work with a complete understanding of each incident. This approach includes environmental state covering identities, devices, workloads, and business services; evidence state tracking observations and their sources; decision state recording hypotheses and confidence levels; control state defining possible actions, approvals, and responsibilities; and learning state capturing improvements from previous investigations. Such a model allows security platforms, including SIEM, endpoint detection systems, identity platforms, and case management tools, to contribute information toward a unified decision process without replacing existing technologies. It also encourages organizations to treat unknown information as a valid security finding. For example, when endpoint visibility is unavailable because a device is unmanaged, a stateful SOC records the limitation instead of presenting incomplete visibility as confirmation that no malicious activity occurred.
As AI agents become more common in cybersecurity operations, experts suggest that organizations should first establish structured workflows and shared memory before introducing greater automation. AI agents can support threat intelligence analysis, investigation preparation, detection improvement, and remediation recommendations when operating within defined boundaries. However, confidence from an AI generated recommendation should not automatically translate into execution authority. Security teams need clear controls that define when an action can be observed, recommended, approved, or automatically executed based on policies, confidence levels, affected systems, and potential impact. A stateful SOC approach also changes the role of security analysts by reducing repetitive evidence gathering and allowing them to focus more on validating conclusions, assessing business impact, and making informed decisions. As attackers continue using AI to accelerate their processes, security organizations that preserve context, measure decision latency, and convert lessons from investigations into improved defenses will be better positioned to respond effectively.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
