Corelight field CTO urges human review before SOC agents act
Original title: Bringing AI into the SOC means watching for shadow AI and loose permissions
Vince Stoffer says teams should watch shadow AI, least privilege, change audits, and network use of AI.
In a Help Net Security video, Corelight field CTO Vince Stoffer discusses AI in security operations and attacker use of the same tools. He says LLMs help with vulnerability analysis, detection engineering, SIEM rules, and small programs over packet or Zeek metadata, and that agentic triage users report faster work and fewer false positives. He argues a human should remain in the loop before agents block or respond. He also urges controls for shadow AI, least privilege, auditing, and network monitoring of AI use.
Unconfirmed: Faster triage and fewer false positives are reported by users, not independently measured.
- Stoffers says attackers use AI for agentic operations, zero-day creation, and social engineering.
- He says models are also surfacing a wave of vulnerabilities.
- Junior analysts can use the tools to inspect network data more deeply.
- A downloadable AI adoption field guide is linked with the video.
- Organizations
- Corelight
From the original article
1 min read at helpnetsecurity.com
In this Help Net Security video, Vince Stoffer, Field CTO at Corelight, talks about how AI is changing work in the SOC and how attackers are using the same tools. He explains how LLMs help with vulnerability analysis and detection engineering, including writing SIEM rules and small programs that analyze packets or Zeek metadata.
helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.