AI-Human Collaboration in Modern SOCs

"AI-Human Collaboration in Modern SOCs," a SANS First Look published by SANS Institute in March 2026, examines whether security operations centers that decline to adopt AI-assisted capabilities can keep pace with rising alert volume and AI-accelerated attacks. The paper, sponsored by TandemTrace, draws on the SANS 2025 SOC Survey and third-party research to make the case for hybrid AI-human SOC models.

Key findings:

• A mid-sized organization receiving 4,500 alerts daily would need nearly 94 full-time analysts working without breaks just to give each alert 10 minutes of attention
• Two-thirds of SOC teams cannot keep pace with alert volume, and nearly half of all alerts go completely uninvestigated, according to the SANS 2025 SOC Survey
• Security analysts spend 80% to 90% of their time chasing false positives from traditional SIEM and SOAR tools
• The global cybersecurity workforce gap has reached 4.8 million people
• About 80% of phishing emails now incorporate AI-generated content
• CrowdStrike's threat report puts average attacker breakout time at 48 minutes, while traditional SOC workflows measure response in hours or days
• Research on human-AI teaming suggests hybrid teams outperform both pure-human and pure-AI approaches by roughly 25%
• ML-based anomaly detection reduced time-to-discovery for zero-day threats by 43% compared to signature-based tools
• Organizations using AI-powered security tools identify and contain breaches roughly 108 days faster, translating to approximately $1.76 million in reduced breach costs
• Organizations that shift from reactive to proactive defense report 30% reductions in mean time to detect and respond

The paper argues that alert volume and attacker speed have outpaced what human-only SOC teams can realistically absorb, and that the gap is a math problem as much as a talent problem. Rather than treating AI as a replacement for analysts, the paper frames the highest-performing model as one where AI handles investigation at machine speed while analysts retain authority over decisions, validation, and context. It positions this hybrid approach, illustrated through the TandemTrace platform, as an emerging standard rather than a niche tool, while noting that fully human SOCs may still suit highly regulated environments or very small organizations. The paper's data draws on the SANS 2025 SOC Survey, CrowdStrike threat reporting, and published human-AI teaming research, alongside the author's own analysis of alert-volume economics and SOC workflow timing.