Survey Finds AI Widely Adopted in Security Operations
Prophet Security's August 2026 State of AI in the SOC report found that 40% of 250 surveyed security leaders and practitioners use AI in daily SOC workflows. The ViB-fielded survey also found that 56% are evaluating or piloting AI tools, while 72% of current users reported cutting alert investigation time by at least 25%.
Prophet Security's State of AI in the SOC 2026 report found that 40% of 250 surveyed security leaders and practitioners use AI in day-to-day security operations center workflows. The survey, fielded by ViB and published by Prophet Security on August 3, reported that another 56% of respondents are evaluating or piloting AI tools, while 4% had ruled out adoption.
The report places those adoption figures against a substantial alert-handling backlog. Respondents received roughly 100 alerts per day at the median, while the mean in the largest environments approached 1,000. Prophet Security reported that 74% received at least 50 daily alerts and 27% received 500 or more.
Investigation backlog and reported AI gains
According to the report, a full alert investigation took about 75 minutes on average, with a median of roughly 45 minutes. Alert dwell time, measured from alert generation to analyst pickup, averaged 55 minutes. The report found that the average organization left 28% of alerts uninvestigated, and 60% of respondents said an ignored or uninvestigated alert had later proved material.
Forty percent of respondents had disabled, or considered disabling, a detection rule because they lacked resources to investigate the resulting alerts, according to Prophet Security. Security Boulevard's coverage of the study also reported that 56% of respondents had seen an increase in AI-driven attacks over the prior year, most commonly phishing and social-engineering campaigns displaying signs of large language model-generated content.
Among organizations already using AI, 72% reported reducing alert investigation time by at least 25%, including 18% reporting reductions greater than 50%, according to the survey. However, the report also found that 46% of teams that built their own AI tooling had scrapped or replaced it.
"The organizations seeing the greatest success aren't replacing analysts with AI," Prophet Security co-founder and CEO Kamal Shah told Security Boulevard. "They're using AI to investigate every alert, reduce response times, and free experienced defenders to focus on higher-value work like threat hunting, detection engineering, and incident response."
What the survey can and cannot establish
The findings are survey responses rather than independently measured operational outcomes, so the reported time reductions do not establish that AI alone caused the improvement. Still, organizations facing comparable alert volume, staffing, and triage constraints commonly evaluate automation where human investigation queues create coverage gaps.
The 46% replacement or abandonment rate for internally developed AI tools is also a caution against treating deployment as a one-time model integration. In comparable security automation programs, operational value depends on factors such as alert-data quality, workflow integration, analyst review, evaluation criteria, and reliable escalation paths.
Key Points
- 1Prophet Security's survey found 40% daily AI use, while 56% were piloting or evaluating tools, making SOC adoption broadly relevant.
- 2Respondents using AI reported faster investigations, but 46% of teams building tools internally had scrapped or replaced them.
- 3High alert volumes and uninvestigated queues illustrate why security teams evaluate AI, though self-reported survey data cannot prove performance.
Scoring Rationale
The survey offers timely operational benchmarks for teams evaluating AI-assisted security triage and investigation. Its relevance is tempered by its vendor-published, self-reported methodology, but the alert backlog and tool-replacement findings provide useful implementation context.
Sources
Primary source and supporting public references used for this report.
Practice with real Social Media data
90 SQL & Python problems · 15 industry datasets
250 free problems · No credit card
See all Social Media problems
