What can cybersecurity leaders do to manage the potential risk of increased pressure or strain on SecOps teams working with new AI-enabled tools? How do you set these teams up for success when AI is integrated into their workflows?
Sort by:
It’s important to define what success looks like at the end of the AI implementation. That’s something I try to do as well—focus on how these tools help us improve. We may need to adjust our approach along the way, but having a clear vision of the desired outcome is key.
If you involve your team at the beginning of the tool selection process, they are much more likely to be on board. Our team genuinely enjoys exploring different AI tools, and we encourage them to test these tools in our sandbox environment. They then return to leadership with feedback on which tools look promising, having had the opportunity to experiment firsthand. Once they’re involved in this way, they are fully supportive of the implementation. We have not experienced any issues with retention because our team appreciates being given the chance to play with the tools first and help decide which ones to adopt. Involving people from the start gives them a sense of ownership, which leads to a faster and more successful rollout, and ultimately a better return on investment.
For us, AI is not about reducing staff or impacting retention in terms of headcount. Instead, it empowers associates to better tackle challenges that were previously overwhelming, such as vulnerability management. AI is not eliminating jobs; it is taking repetitive tasks off people’s plates so they can focus on higher-value work. This enables the team to operate at a higher level of maturity. Achieving advanced levels of maturity in our security program requires automation and refinement, which we cannot reach with traditional staffing models alone. AI-enabled tools are helping us achieve these goals, rather than simply adding something new or reducing workload for its own sake.
In our environment, the SOC is currently outsourced as a managed service, but we are focused on how AI can be leveraged to drive down ticket volumes through tier 2 and tier 3 automation. This will allow engineers to spend more time building and creating value, rather than constantly responding to incidents. We’re actually increasing headcount to support custom AI development, not reducing it. Our teams are excited about the opportunities AI brings them to do more meaningful work. It represents the next evolution of risk and opportunity in security, and our teams are eager to see how we will use, enable, and protect it.