Contents
Get a Personalized Demo
See how Torq harnesses AI in your SOC to detect, prioritize, and respond to threats faster.
When we started building Torq four years ago, we had a thesis: the SOC was broken, and automation — real automation, not another tool bolted onto the stack — was the way to fix it. AI has since changed the game entirely. But has it streamlined the SOC, or introduced new complexity?
We wanted to find out. We partnered with Sapio Research to survey more than 450 CISOs and SOC leaders across four countries.
The short answer: AI is everywhere. It’s delivering real value. And it’s creating a new set of problems that nobody planned for.
AI Works. The Way It’s Deployed Doesn’t.
I’ll start with the good news, because there is plenty of it. 90% of security leaders say AI has positively impacted SOC workload. 85% say it’s reduced stress and burnout. 83% agree their AI tools deliver on vendor promises. That’s not a market that’s disappointed with AI. That’s a market that’s seen what it can do.
But underneath those numbers, a more complicated picture is emerging. The average SOC is running 7 AI-powered tools. 80% still rely on fragmented point solutions rather than a unified platform. And 92% of leaders cite at least one factor actively reducing their trust in AI.
This is the paradox we keep hearing in every customer and prospect conversation: AI is working, but the way it’s been deployed — tool by tool, vendor by vendor — is creating the same complexity it was supposed to eliminate.
5 Findings from 450 Security Leaders
We organized the findings around five themes that surfaced consistently across geographies, company sizes, and seniority levels.
1. AI Is Everywhere in the SOC, But Unified Nowhere
Teams are running 7 tools with AI on average, but 80% depend on disconnected point solutions. 85% say they’d prefer consolidation. The tools have multiplied. The integration between them hasn’t. This is the finding that hit closest to home for me; it’s the exact problem we set out to solve when we founded Torq.
2. AI Is Carrying the Load; Analysts Are Making the Calls
72% of teams are comfortable with fully autonomous AI on medium-severity incidents and below — the alerts that make up the bulk of SOC volume. Analysts aren’t being replaced. They’re being freed up for the work that actually requires human judgment.
But to push autonomy further, 9 in 10 say they need to see how AI reaches its decisions before they trust it. I hear this constantly from CISOs: “I’d let AI do more if I could see why it’s doing what it’s doing.”
3. The Analyst Role Is Evolving
Analysts spend an average of 8.6 hours per week overseeing AI outputs. That sounds like a problem… until you see that 9 in 10 say AI has positively impacted their workload. Those hours aren’t busywork. They represent a role shift from execution to judgment. This is the future of the SOC analyst: not replaced by AI, but elevated by it. AI handles the processing; analysts make the calls that matter.
4. Trust Is the Limiting Factor on AI Expansion
92% of security leaders cite at least one barrier to trusting AI in the SOC — from data privacy to black-box decision-making. And the #1 thing that would change that? Transparency. 46% say the ability to see how AI reaches its conclusions would be the single biggest confidence booster.
Not more features. Not more AI. Just show AI that shows its work. We took this to heart early at Torq; explainability isn’t a feature we added. It’s how we built the platform.
5. The Market Knows What It Wants
85% of security leaders would prefer a unified AI SOC platform over managing multiple point solutions. 92% say AI must continuously learn and adapt to evolving attack patterns. The desired end state is remarkably consistent across every seniority level, company size, and geography: unified, explainable, and adaptive. This data validates the architectural bet the entire industry needs to make.
What This Means for the Security Industry
97% of CISOs and security leaders are confident AI can handle triage. Only 35% are actually using it there. That gap keeps me up at night — not because teams lack ambition, but because their tools aren’t giving them a way to act on it. Teams won’t extend AI into high-stakes functions unless they can set autonomy thresholds, see how decisions are made, and adjust as confidence grows.
The organizations that close this gap first will be the ones that unlock what AI in the SOC was always supposed to deliver.
That’s what we’re building. This report shows why it matters.
