Why an AI SOC means company owners can sleep better at night

There is a particular kind of tiredness that belongs to people who own or run a company. It is not the tiredness of a long day. It is the low hum of things that could go wrong while you are not looking, and for most owners the list has, in the last few years, acquired a new entry near the top: somebody, somewhere, running an attack against the business at two o'clock on a Saturday morning while the IT contractor is asleep and the office is dark. This article is about why that entry can come off the list, and I want to make the argument carefully, because the phrase "AI SOC" is currently being used to sell a great many things, some of which do not exist.

What has actually changed about attackers

Let me start with what is real, because there is enough of it without embellishment.

Attacks have got faster. CrowdStrike's 2026 Global Threat Report puts the average time for a criminal intruder to break out from the first compromised machine to the rest of the network at twenty-nine minutes, about two-thirds faster than two years earlier; the fastest they observed was twenty-seven seconds, and in one case data was leaving the network four minutes after the attacker got in. Sophos's Active Adversary Report 2026, drawn from 661 incident response cases across seventy countries, found a median of three and a half hours from the start of an intrusion to the attacker reaching Active Directory, which is to say the keys to everything, and a median of three days from compromise to detection. Those two figures together are the whole problem: the attacker needs hours and the defender is taking days.

Attackers have started using AI in earnest, and not in the way the marketing suggests. The interesting development is not AI writing better phishing emails, though it does. It is AI removing the human bottleneck from the attacker's side of the operation. Anthropic's threat intelligence report for September 2026 describes a Chinese espionage group running thirteen standing collection agents on schedules with no human oversight, a criminal crew escalating a stolen token to full administrative access in about three hours and reaching roughly two hundred downstream organisations through a single SaaS supplier, and a Russian group whose tooling rebuilt and redeployed its own malware when a security product caught it. Google's Threat Intelligence Group reported in the same month an actor who compromised cloud infrastructure and then planned, built and ran an agent-driven credential harvesting campaign inside six hours, with the agents doing the vulnerability scanning, the troubleshooting and the IP rotation themselves. CrowdStrike counted an eighty-nine per cent year-on-year increase in operations by AI-enabled adversaries. The human operator now decides who to hit and how to get paid; the machine does the rest, in parallel, without getting tired or going home.

And attackers time their work. This is the oldest trick in the book and AI has made it cheaper. Sophos found that eighty-eight per cent of ransomware encryption and seventy-nine per cent of data theft in its cases happened outside business hours. Semperis's 2025 Ransomware Holiday Risk Report found that just over half of the organisations it surveyed across nine countries, the UK among them, had been hit on a weekend or holiday, and, in the same survey, that seventy-eight per cent of companies cut their security operations staffing by at least half at those times and six per cent had nobody on at all. Attackers know this. It is not a coincidence that the ransom note appears on a Saturday; it is scheduling.

What our own data shows

The chart below is the volume of log data our SOC platform indexed each day for the thirty-one days to 27 September, in gibibytes, across the client estates we monitor. It is a blunt instrument, but a useful one: when an estate is quiet the volume is flat, and when something is happening across it, whether scanning, credential attacks, exploitation attempts or the noise of our own containment, the volume climbs.

For most of the month the platform indexed a little over five hundred gibibytes a day, with a median of 537. Then, in the last week, it did not. Tuesday 22 September came in at 2,712 GiB, five times the median, and Wednesday at 1,601. After one ordinary day, Friday 25 September reached 3,249 GiB, six times the median and the largest day of the month, and the surge ran into Saturday at 1,403 before subsiding on the Sunday. The Friday and the Saturday alone account for a fifth of the entire month's volume. Those four days were automated attack activity against our clients' estates, arriving at a rate and with a variety that only tooling produces, and the heaviest of it was launched on a Friday afternoon and ran through the night.

I am not going to over-read one month of one metric, and the Tuesday surge is a reminder that attackers do not only work weekends. But the shape of that Friday bar is the shape the industry data predicts, and it is the shape that ought to inform how an organisation thinks about who is watching at that hour.

What an AI SOC is, and is not

Here is where I want to be more precise than the market is. A security operations centre has three jobs: notice that something is happening, decide what it means, and act. AI changes the economics of the first two dramatically and the third only where a human has decided in advance that it should.

We built EmilyAI in 2018, originally for periods of high alert volume and complex investigations, and she has been running inside our SOC ever since. She extracts indicators from alerts, checks them against historical context and our own intelligence holdings, which at the time of writing run to twenty-six million malicious IP addresses, six hundred and twenty thousand malicious domains and half a million phishing domains, drafts the structured case notes an analyst would otherwise write by hand, and flags the low-value alerts worth tuning out. What she does not do is as important as what she does. She cannot take containment actions, she does not change anything in a client's environment, and she never operates without an analyst directing her. She runs inside our own environment and sees only the metadata an analyst gives her. Every action is logged and attributable.

That design is deliberate, and it is the opposite of what "AI SOC" often means in a sales deck. The value of AI in a SOC is not that it replaces the analyst's judgement. It is that it removes the reasons an analyst's judgement arrives late. At three in the afternoon on a Wednesday, a duty analyst with a full shift around them can triage an alert in a few minutes. At three in the morning on a Saturday, a lone analyst facing a surge of the kind in the chart above is the bottleneck the attacker is counting on. EmilyAI's job is to make sure that analyst is never alone with the raw alert queue: the enrichment is done, the context is gathered, the noise is already suppressed, and what reaches the human is a small number of decisions, each with the evidence laid out. The attacker has removed the human bottleneck from their side. This is how you remove it from yours without removing the human.

The action layer is separate, and it is where machine speed is allowed. Our DecoyPulse deception network places decoy hosts, services, file shares and credentials inside a client's environment that nothing legitimate ever touches, so an alert from one is close to certain. Where a client has pre-authorised it, a decoy trigger can fire Pulsar, our endpoint control agent, to isolate the machine, block the outbound connection or rate-limit the traffic before the analyst has finished reading the alert. The machine acts at machine speed on the narrow set of signals where the client has already decided that acting is right; everything else waits for a person.

Put the three layers together and the picture at 02:00 on Saturday 26 September looks like this. Behavioural analytics, engineered detections and the deception network are watching every estate continuously and firing within seconds of the first hostile action. EmilyAI is enriching, correlating and drafting, so the duty analyst is looking at cases rather than a firehose. Pre-authorised containment is already isolating what the decoys caught. And a named human, on shift, is making the calls that matter and picking up the telephone to the client if one needs to be made. Nobody had to be woken, because nobody was asleep.

Why this is the reassuring answer

I run a company as well as a SOC, and I know that what an owner is buying is not detection. It is the ability to close the laptop on Friday.

The plain version of that promise is worth more than the inflated one. A SOC that claims its AI defends you autonomously is asking you to trust that a model, unsupervised, will make the right call about isolating your finance server at 2 a.m., and to accept that when it makes the wrong one there was nobody to stop it. A SOC that says its AI makes the human on shift fast enough to matter, and that machine speed is used only where you have said it may be, is describing something you can actually rely on, because you can see who is responsible for each part of it. Our own tagline is "someone is always watching, someone you can name", and the AI is what makes the second half true at the hours when it used to be hardest.

There is also a practical point about proportion. For a mid-sized organisation the alternative to a managed, AI-assisted SOC is not a better in-house one; it is a part-time one. The Semperis figures are what part-time looks like in practice: the security function that exists Monday to Friday and thins out precisely when the attacker is most active. Building true round-the-clock coverage in-house means at least five or six analysts, a platform, detection engineering, intelligence feeds and somebody to keep all of it working, which is why almost nobody below a certain size does it and why the weekend remains the attacker's favourite time. A managed SOC spreads that cost across many estates, and the AI spreads each analyst across more of them without diluting what they can do. SOC365 is priced per device per month, from £5 a device at scale, which is the sort of number that makes twenty-four-hour cover a line item rather than a project.

What to ask before you trust anyone's AI SOC

If you are evaluating a provider that leads with AI, there are a handful of questions whose answers cannot be improvised, and they are the same questions we would want to be asked.

Ask who is on shift at 03:00 on a Sunday, by name and by role, and whether they are in the provider's own SOC or subcontracted. Ask what the AI is permitted to do without a human, and to see the list, because if the answer is "everything" you have found a provider that has not thought about failure. Ask what data the AI sees, where it runs and whether any of your telemetry leaves the provider's environment to be processed by a third party's model. Ask what is logged, so that when something goes wrong you can reconstruct what the AI recommended, what the analyst decided and when. Ask what happens on the day the AI is wrong, because it will be, and the answer should describe a human catching it rather than a customer discovering it. And ask for the evidence of the last surge: the chart, the timeline, what fired, how long triage took and when the client was told. A provider that can produce that in an afternoon is one that lives with the data every day. We published a free checklist of questions to ask any SOC provider earlier this month, and these fit alongside it.

The good night's sleep

I have said before that we sell good mornings rather than nightmares, and this is the piece where the two meet. The nightmare is real enough: the attacker's tooling is faster than any human, it works in parallel, and it is scheduled for the moment you are least able to respond. The good morning is also real, and it is not complicated. It is Saturday, the phone did not ring, and when you open the portal there is a case from 02:14 that reads: decoy credential used from a workstation, host isolated automatically under pre-agreed authority, analyst confirmed at 02:19, no lateral movement found, client notified at 02:31, root cause a phishing email opened on Friday afternoon, remediation steps attached. That is what an AI SOC looks like from the owner's side. Not a robot guarding the gate, but a small number of good people who were never overwhelmed, never slow and never asleep, because the machine took everything off their plate except the decision.

Frequently asked questions

Does an AI SOC replace human analysts? No, and you should be wary of one that claims to. AI in a well-run SOC does the enrichment, correlation, noise reduction and case drafting at machine speed so that human analysts spend their time on decisions rather than on the alert queue. Containment at machine speed is limited to signals the client has pre-authorised, such as deception triggers. Judgement, escalation and the call to the client remain human.

What does "always watching" mean in practice? Behavioural analytics, engineered detections, threat intelligence correlation and deception sensors run continuously and fire within seconds of hostile activity, twenty-four hours a day. EmilyAI enriches and triages what fires, and a named duty analyst is on shift at all times to act on it. There is no reduced weekend or overnight service.

Are AI-driven attacks really different from ordinary ones? The techniques are largely the same: phishing, stolen credentials, exploitation of known vulnerabilities, lateral movement, exfiltration and encryption. What AI changes is tempo and scale. Reconnaissance, exploitation, tool development and data processing can be delegated to agents that run in parallel and do not stop, which compresses the time between first access and damage from days to hours or minutes. The defensive answer is to compress detection and triage to match.

Why do attacks cluster on Friday nights and weekends? Because attackers expect fewer defenders to be watching. Industry incident data shows the large majority of ransomware encryption and data theft takes place outside business hours, and most organisations reduce their security staffing substantially at weekends and holidays. Our own September data shows the largest surge of the month beginning on a Friday and running into the Saturday.

What is the difference between EmilyAI and a chatbot bolted onto a SIEM? EmilyAI has been in production inside our SOC since 2018, runs entirely within our own environment, sees only the metadata an analyst gives her, cannot act on client systems and is logged and attributable for every action. A chatbot on a SIEM is typically a general-purpose model with access to your raw telemetry, run by a third party, and its permissions are often the last thing anyone checks.

What does a managed SOC with this coverage cost? SOC365 is priced per device per month on a sliding scale, from £12 a device for small estates to £5 a device above 1,500, with add-ons for identity providers, cloud workspaces and firewalls. The estimator on the SOC page gives an indicative figure in a minute, and a short discovery turns it into a fixed monthly price.