Name the SOC tasks where AI helps and where it is risky.
Load, clean and explore security logs in a notebook.
Use an AI assistant for queries and summaries, and catch its errors.
Hands-on projects and labs
Load a Security Datasets scenario into pandas and find the attack by hand.
Ask an AI assistant to write five detection queries, test each against real data, and record how many were wrong.
Done when you can…
Explain to a SOC manager where AI should and should not be used in triage.
Show an example where an AI assistant was confidently wrong, and how you caught it.
Beginner
AI in the SOC: what works today
ML is proven for spam, malware classification and anomaly spotting. LLMs are good at summarising, translating and drafting queries. Neither replaces an analyst's judgement.
Use assistants to explain a log line, write a KQL or SPL query or summarise an alert. Check every answer, and never paste data your organisation does not allow into a tool.
Assistants invent field names, misread timestamps and miss what is not in their context. Models drift as attackers and systems change. Plan checks for both.
Attackers use AI for convincing phishing, voice and video deepfakes, faster reconnaissance and malware help. Know what has really been seen, not just what is feared.
Build and evaluate an anomaly detection model on real logs.
Train a malware or phishing classifier and measure it honestly.
Evaluate an LLM triage assistant against analyst decisions.
Extract and verify intelligence from reports with an LLM.
Hands-on projects and labs
Build an anomaly detector for logins from Security Datasets and tune it to fewer than five alerts a day.
Train a classifier on EMBER, test it on a later time period and report the drop in performance.
Build an LLM triage helper for 50 labelled alerts and compare its verdicts with the labels.
Done when you can…
Show a model that adds real value beyond the existing rules, with numbers.
Explain why a detection model's accuracy on old data does not prove it works today.
Intermediate
Anomaly detection
Find unusual logins, data transfers or processes compared with normal behaviour. Unusual is not the same as malicious, so tune for useful alerts, not just strange ones.
Combine sender reputation, URL features, page content and language signals. AI-written phishing removes the old spelling-mistake clues, so other signals matter more.
Give an LLM the alert, the related events and a checklist, and ask for a summary and a suggested verdict. Measure its accuracy against analysts before trusting it.
LLMs can extract indicators and ATT&CK techniques from reports, translate sources and cluster activity. Check extractions against the source, since models make up indicators.
Use AI in an investigation while keeping every claim tied to evidence.
Build a SOC agent with read-only access, approvals and full logging.
Test AI security tools for prompt injection.
Measure whether an AI tool really improves SOC outcomes.
Hands-on projects and labs
Investigate a CyberDefenders or Security Datasets scenario with an AI assistant, and mark which of its claims you could verify.
Plant a prompt injection in a test email and see whether an AI triage tool you built is fooled.
Run a before-and-after trial of an AI triage helper on a set of labelled alerts.
Done when you can…
Deliver an investigation report that used AI, with every finding traced to evidence.
Recommend, with data, whether a SOC should adopt a given AI tool.
Advanced
AI-assisted forensics
LLMs can summarise timelines, explain artefacts and draft reports. Keep the evidence chain intact: every AI claim must point back to an original artefact you checked.
Detectors look for traces of generation, but they fail on new generators. Combine them with provenance standards and process checks, such as call-backs for payment requests.
Open problems include detection that resists adaptive attackers, trustworthy LLM investigation and measuring real-world impact. Publish datasets and results others can reproduce.
Security teams drown in alerts, logs and reports. Machine learning has been used for years to spot spam, malware and unusual logins; large language models now help analysts summarise alerts, write queries, read threat reports and draft incident notes.
This roadmap is about using AI well in defence: choosing the right technique, building and evaluating detection models, putting assistants into analyst workflows safely, and understanding that attackers adapt and that AI makes confident mistakes. It also covers new threats that need AI to detect, such as AI-written phishing and deepfakes.
Why it matters
Every major security vendor now ships AI features, and SOC teams are expected to use them. Analysts who can tell where AI helps, measure it and catch its errors are more valuable than those who either ignore it or trust it blindly.
Typical job roles
EntrySOC analyst using AI toolsUses AI assistants for triage and queries, and checks their work.
Mid-levelSecurity data scientistBuilds and evaluates ML models for detection, classification and anomaly spotting.
Mid-levelDetection engineer (AI)Combines rules and models into detections, and automates workflows with AI.
SeniorAI security automation engineerBuilds AI agents and pipelines that do parts of SOC work, with guardrails.
LeadHead of security AIDecides where AI is used in the security programme and how it is measured.
Prerequisites
Security Operations beginner and intermediate stages: logs, SIEM, alerts and triage.
NIST Cybersecurity Framework (CSF) 2.0A common way to describe and improve an organisation's security, organised as Govern, Identify, Protect, Detect, Respond and Recover.
OWASP GenAI Security ProjectHome of the OWASP Top 10 for LLM Applications and guidance on securing generative and agentic AI.