The Autonomous SOC Was a Promise SOAR Never Kept

David Melamed is Head of Emerging Technologies at Torq. He joined through Torq’s acquisition of Jit, which he co-founded and has led as CTO since 2020, building agentic security on a production Context Graph. A cloud security veteran with 20+ years of experience, David previously held senior technical roles at Cisco (via the CloudLock acquisition) and MyHeritage.

For all the gods and monsters in The Odyssey, the ship mostly moves for one reason: men row it. Divine wind is promised often and arrives sometimes, but it never lasts. Sooner or later, the sail goes slack, and the crew bends back over the oars and moves the ship the only way that reliably works, by hand.

Security operations were promised a wind, too. We called it SOAR (which stands for Security Orchestration, Automation, and Response), and the pitch was that you would set it up once and the SOC would start to run itself. How convenient, right?

But… it never did. And understanding exactly why it did not is the difference between falling for the same promise a second time and knowing what to demand instead.

Here is the claim up front. SOAR’s automation worked. What failed was the idea behind it: that enough flowcharts, stacked together, would add up to a SOC that runs itself. The industry is about to repeat that mistake with AI, and the only protection is to demand proof before you buy the promise.

We Have Heard This Promise Before

SOAR arrived as the answer to the problem described in the first and second posts in this series: too many alerts, too few people, and decisions that would not scale. The pitch was clean: encode your analysts’ playbooks once, wire the tools together, and the machine runs the repetitive work while humans supervise. In a nutshell: the self-driving SOC.

Teams bought it, built it, and then found out what they had actually bought.

What You Actually Bought Was Maintenance

A playbook automates the steps a human mapped in advance. That works for the narrow, stable path: this specific alert type, this enrichment, this ticket, this case. But unfortunately, security does not stay on the narrow path. A new detection, a renamed field, an unexpected response from a tool, an edge case nobody foresaw, and the playbook breaks, usually quietly, and usually at the worst moment.

So someone has to keep it alive. Every integration change, every new alert source, every tuning cycle adds to a backlog of playbook upkeep. The automation that was supposed to free the analyst turned the analyst into its mechanic. Ask anyone who has lost a Friday afternoon to a playbook that broke because a third-party vendor quietly renamed a field. The work did not disappear. It just moved from investigating alerts to maintaining the thing that was supposed to investigate alerts.

And it shows up in the data, not just in the war stories: 80% of security leaders say they rely on disconnected point tools, 80% say that fragmentation creates operational complexity, and 85% would prefer a single unified platform. The wiring was never finished because in a stack that keeps changing, it never can be.

The Mistake Was Deeper Than Brittleness

Brittleness was the symptom. But the real reason SOAR could never deliver autonomy lies in the premise beneath it.

SOAR asks you to encode judgment as part of the flowchart. But the hard part of a Tier 1 analyst’s job is not executing known steps. It is deciding what to do when the situation matches no known step. That is judgment, and judgment is not a decision tree with more branches bolted on. You cannot pre-write the response to a case you have never seen. So the exact work that would define an autonomous SOC, handling the alert nobody scripted, was the one thing a playbook, by its nature, could not do. SOAR automated everything except the part that actually required an analyst.

To be fair to the category, orchestration and automation were never the problem, and they are not going away. Wiring tools together and executing a known response at machine speed is real value. The error was believing that enough of those wired-together steps would add up to judgment. They never do.

The Same Promise Is Back on the Table

Now a new generation of vendors promises autonomy again, and most of the demos look exactly like the self-steering ship: clean data, a confident verdict, a slide that says “autonomous.” The lesson from SOAR is not to stop believing in automation. It is that the promise and the proof are different things, and the gap between them only shows up after you have signed, when the platform meets your real stack, your real volume, and your real compliance rules.

So treat the new promise the way a burned crew treats a fresh guarantee of fair winds. Make it prove it holds in your environment before you trust it to carry the ship. Ask the questions a polished demo is built to avoid:

• Can it reason across your whole stack, or only the clean slice on the slide?
• Can it show its work, or only hand you a verdict?
• Can you govern what it is allowed to do?
• Can it prove impact with named customers and real numbers, not logos on a wall?

Torq published a list of 20 such questions for exactly this reason: the honest answers are what separate a real AI SOC from a repackaged one, and we would rather you ask them of everyone, us included.

What SOAR Could Never Do

There is one thing that genuinely separates this wave from the last, and it is not more automation. It is reasoning: the ability to make sense of context and work an investigation that no one pre-scripted, choosing the next step based on what the last step turned up, the way a human analyst does. That is the single capability a flowchart could never capture, and it is why the autonomous SOC is finally a real conversation rather than a rerun of 2016.

Odysseus got home the moment he stopped waiting for a wind to do the work for him and started navigating by judgment. Security operations are at the same point. SOAR was the last promised wind. What comes next is not a better flowchart. It is a different kind of propulsion.

Next in this series: From playbooks to reasoning, what agentic AI actually changes, and why it can finally do the one thing SOAR never could.