By: Kevin Gonzalez, VP of Security, Operations, and Data at Anvilogic

‍

AI in cybersecurity has finally moved past hype—but most orgs are still using glorified expert systems. In this post, we break down what’s changed, what hasn’t, and how multi-agent models are shaping the future of AI-driven security operations.

‍

Beyond the Hype: What Real AI in the SOC Actually Looks Like

For years, the cybersecurity industry has treated "AI" like a silver bullet, promising solutions to everything from alert fatigue to insider threat detection. In practice, most of what we called AI wasn’t really artificial intelligence at all—it was a patchwork of basic statistical models, human-crafted rules, and machine-learning techniques that required endless tuning and intervention. Now, as large language models (LLMs) and neural networks become accessible and cost-effective, the conversation is shifting. But to separate substance from hype, we need to look closely at what actually changed—and what still hasn’t.

The Old World: Expert Systems Masquerading as AI

Historically, most so-called AI in cybersecurity was really an "expert system" under the hood. These systems applied a mix of clustering algorithms, supervised learning models, and heuristic rules to produce what often looked like intelligent outcomes. But they weren’t autonomous, and they certainly weren’t learning in any deep sense. They relied on human analysts to engineer features, update signatures, and write increasingly complex detection rules.

Why didn’t we do better? Two reasons: data and resources.

Security data has long been a nightmare—fragmented across silos, inconsistently structured, and rarely labeled in a way that supports machine learning. At the same time, running even modest ML models at scale was prohibitively expensive for most organizations, let alone experimenting with deep learning. Data science talent was scarce in security orgs, and compute power was a luxury.

So instead of building true AI, we built clever automations and called it a day.

The Turning Point: Standardized Data and Cheap Compute

What changed? First, we started cleaning up our data. Logging standards like OCSF, broader adoption of OpenTelemetry, and schema unification in SIEMs and data lakes made it possible to structure and normalize telemetry at scale. Second, the cost of compute dropped drastically. GPU-accelerated cloud environments and pre-trained foundation models made it feasible for even small to mid-sized orgs to experiment with LLMs and neural networks.

That set the stage for real transformation. But the way we applied AI in the SOC still needed to evolve.

From Chatbots to Copilots (and the Problems That Came With It)

Initially, LLMs entered the SOC as glorified chatbots. They answered queries about telemetry, summarized alerts, and even drafted incident reports. This was helpful—to a point. But these models weren’t grounded in reality. Their reasoning was strong, but their facts weren’t. We saw hallucinated CVEs, misattributed threat actors, and confidently wrong explanations for real alerts.

Why? Because reasoning without domain context is just pattern-matching at scale.

To solve this, we began embedding LLMs deeper into workflows. Security copilots were born. These tools extended beyond question-and-answer interactions to include enrichment, playbook generation, and even initial triage decisions. But giving a single model that much responsibility introduced new risks—especially when that model had no concept of organizational nuance or operational guardrails.

AI Agents Aren’t Analysts (Yet)

Think about how a real analyst works. They get an alert, break it down, form hypotheses, research evidence, weigh context, and make a decision. Along the way, they tap colleagues, reference tribal knowledge, and often choose not to act if the risk of error is too high.

Now imagine an AI agent doing that in isolation. It might reach conclusions faster, but with no brakes. If it misunderstands a signal, it might flag it as malicious or ignore it entirely. It might even act on that decision, depending on how it's wired. The risk isn’t just false positives or negatives—it's automation without accountability.

Enter the Multi-Agent Model: AI That Works Like a SOC

The next evolution is already underway: moving from single-agent copilots to multi-agent AI systems that mimic the way real SOC teams collaborate.

In a typical multi-tier SOC, alerts flow from Tier 1 triage to Tier 2 investigation and possibly to threat hunting or incident response. Each level provides a different lens, different context, and often a feedback loop that improves decision-making. Multi-agent AI in a SOC seeks to replicate this.

You might have:

• Agent 1: Initial alert enrichment and triage
• Agent 2: Behavior correlation and threat context mapping
• Agent 3: Risk scoring and escalation recommendations
• Agent 4: Quality assurance or final decision review

Each agent operates independently but contributes to a shared decision framework. They can critique each other’s outputs, escalate uncertainty, and even flag when human intervention is required. This reduces the risk of hallucination or overconfidence in a single model’s interpretation.

It’s not perfect. Biases still creep in. But it’s a significant step toward building AI that mirrors the checks and balances of a real SOC.

Where We Go From Here

The gap between AI promise and operational reality is finally narrowing. But there are still pitfalls to avoid:

• Don’t confuse fast answers with correct ones. LLMs can dazzle with their language, but they still need context.
• Avoid over-automation. Just because you can hand off remediation doesn’t mean you should.
• Build for explainability. AI systems need to justify their conclusions just like analysts do.
• Invest in detection engineering. AI is only as good as the signals it sees. Garbage in, garbage hallucinated.

The SOC of the future won’t be fully autonomous. But it will be augmented in meaningful ways—with multi-agent AI systems that replicate how humans reason, collaborate, and decide.

If we get this right, we won't just reduce alert fatigue or shave minutes off triage. We’ll finally give analysts the kind of intelligent augmentation they’ve been promised for over a decade.

And this time, it might actually work.

‍