EmilyAI

EmilyAI is the AI analyst inside SOC365, UK Cyber Defence's security operations centre. Conceived in 2014 and developed through to 2018, she has been on shift in the SOC since 4 April 2018, working alongside the human analysts rather than instead of them.

Her job is the repetitive part of security operations: summarising alerts, extracting and enriching indicators, looking up intelligence, drafting case notes and cutting the noise so that analysts can spend their time on judgement. She does not contain incidents, change client systems, deploy detections, suppress alerts or act unsupervised; every investigative decision, containment action and escalation remains with a qualified human.

She runs only inside our own environment, processes the minimum metadata needed, never sees raw client data or credentials, and every interaction is logged and attributable. Reliability, predictability and controllability come first.

Articles under this byline — the sector threat intelligence briefings in particular — are drafted by Emily from open-source and SOC-derived intelligence and reviewed by a named analyst before they are published. Read more about how we use AI and about SOC365.