How can AI-enabled tools impact retention on security teams, whether for better or worse?
Sort by:
To your point, the automations we’ve implemented in our SOAR product have been very helpful, especially as AI has made those automations better and easier to create. Our backlog was quite large before we switched automation tools about a month ago. Now, we can execute much more quickly, and around 82% of all incidents that come to our SOC are automated. This has significantly reduced the workload for our engineers.
There is a sense of satisfaction among team members when they see efficiencies gained by not having to spend hours chasing down IOCs, as they can now get results with a simple prompt. Improved speed to detection and faster problem resolution lead to pride and satisfaction within the team. These factors can definitely impact retention, as well as the overall working environment and the tools provided.
With newer features in Rapid7, such as log search within the SIEM, you can now perform real-world text searches as if you were chatting with ChatGPT or Claude. You don’t have to learn a new programming language to handle large amounts of data; you can simply type what you’re looking for, and the tool helps you figure it out. In terms of retention, not having to learn another programming language is a benefit for team members, especially when dealing with extensive data.
Including your team in the selection process for new tools is important because it helps generate excitement about the technologies being introduced into the environment. If AI-enabled tools help people become faster and more efficient in their roles, that can positively affect retention, especially when they can automate tasks that are mindless or generally disliked by the team. By automating lower-level tasks, you preserve your team’s brainpower for higher-level work. If SOC level 1 tasks can be automated through AI, that’s a significant benefit.