TL;DR
- Security teams are looking to AI workflows to offload much of the manual alert triage process that previously required staffing many Tier 1 analysts as the foundational base of a traditional pyramid-shaped SOC model.
- Even in AI-driven SOCs, humans are absolutely required. The use of AI is transforming how, not if, those analysts operate in the modern SOC, which in turn, requires a structural shift.
- Modern SOC architectures are reflective of a V-shaped model where AI-driven security tools absorb more routine analyst work, enabling teams to deploy human expertise faster and with more focus on complex aspects of detection and response.
When Expel launched a decade ago, our team was small and heavy on senior talent. To scale, we had to get creative. We built automations, deterministic workflows, and machine learning models to offload tactical grunt work and assemble rich context from across disparate security tools. Eventually, this became the foundation of Ruxie™, our AI SOC manager, designed to deliver context-driven security at scale. That operational choice of deliberately bypassing the traditional Tier 1 analyst model led us to design a modern architecture years ahead of the industry.
Today, that same blueprint is what context-driven SOCs are racing to adopt, especially as AI agents redefine how humans and machines collaborate. Anton Chuvakin framed the industry’s dilemma well when he warned that layering AI onto an outdated structure is like building a robotic horse to pull a buggy from the 1800s. As Anton noted, legacy methodologies for enrichment, triage, and investigation across the threat lifecycle must fundamentally transform in the AI era.
We couldn’t agree more. In an era where AI makes raw speed table stakes, context is what delivers real decision-making power. We recently had a conversation with Gartner analyst Craig Lawson—who originally coined the term MDR in 2016—on how these AI capabilities act as massive force multipliers for the SOC. That conversation led us to realize we should formalize the new model of security operations as theV-shaped SOC architecture—one where machines take over data gathering, correlation, routine triage, and investigations, and surface the vital business and threat context our analysts need to apply high-stakes human judgment.
In this blog, we’ll illustrate how this inverted SOC architecture allowed Expel’s SOC to scale security operations by uniting human expertise and artificial intelligence, and how this collaboration continues to transform the way we hire, train, and empower our threat analysts.
How the modern V-shaped SOC operates
The premise of the V-shaped SOC inverts the traditional SOC model that was historically designed to support data- and alert-driven security architectures. At the base of the SOC team were Tier 1 junior analysts, who were mainly responsible for triaging noisy alerts and escalating anything that could be an incident to more experienced analysts.Tier 2 analysts would review the escalated alerts, add enrichment and make decisions on them, or escalate them up the pyramid once again to more senior Tier 3 analysts.
Today, threats often break this model. Speed is a requirement, and humans are innately slow compared to machines. Optimizing for speed and accuracy requires the use of AI, automation, and ultimately context to stop threats faster than brute-forced, manual enrichment and triage allows. The V-shaped SOC model replaces the lower base of the SOC pyramid with machine speed (AI, agentic workflows, deterministic logic, machine learning, etc) so human analysts can focus on applying judgement where it matters most.
The Expel SOC has been operating with the V-shaped SOC model since its inception. Ruxie operates at the base of the V, in place of Tier 1 analysts. Ruxie is built on a foundation of automation and has evolved to incorporate ML, AI and agentic workflows as technology has advanced. For 79% of all inbound vendor alerts, Ruxie executes the entire enrichment and context phases by running queries across more than 160 connected tools, pulling cross-platform telemetry, filtering deterministic noise from the queue, and prioritizing the right alerts for the SOC analysts to focus on.
Ruxie doesn’t replace analysts entirely; humans are still needed in a role where judgement and deeper context are most required to validate AI decisions, identify when data is missing, or determine if conclusions of partial evidence are accurate. When an alert requires escalation, analysts immediately open a pre-built case file within Expel Workbench™, where complete background context and a clear recommendation are already populated. To protect against automation bias, analysts remain trained to spot what the AI could not query, ensuring missing telemetry is never mistaken for benign activity.
In Expel’s SOC, this structure provides human experts with undivided cognitive bandwidth to focus on the remaining 21% of alerts demanding true judgment. These are the critical cases where analysts leverage Ruxie’s foundation to confirm active incidents or verify ambiguous activity directly with the customer.
AI unlocks human SOC talent where it’s needed most
Automating the rote work elevates operational talent into two specialized pillars at the top of the V.
- Investigative threat analysts evaluate recommendations, analyze dual-use administrative behaviors, and make high-stakes judgment calls on ambiguous threats.
- Detection and AI engineers take frontline analyst decisions and feed them back into models to continuously refine defensive logic.
Through this combination of automated heavy lifting and structured human handoff, initial analyst triage time drops from half an hour down to minutes.
“Having AI workflows for context, then relying on a human expert to make the final call, offers a level of security we can’t get from an AI-only approach,” notes Jason Waits, CISO at Inductive Automation. “Automation catches things in real time, and human expertise understands context, makes nuanced decisions, and avoids false positives that disrupt operations.”
Fast-tracking the next generation of security talent
What’s missing from this architecture is the traditional entry-level SOC role—the junior analysts who historically learned by sifting through low-signal noise. This shift raises a fair operational question for security leaders: If AI handles initial data gathering, how do we build the next generation without creating passive analysts or increasing enterprise risk?
The answer lies in rethinking how investigative judgment is developed in the first place. As we scaled our own operations at Expel, we realized that sifting through repetitive noise was never an effective training ground. What actually works is exposing analysts directly to hands-on investigation, using structured frameworks like the OSCAR methodology (which we also believe will adapt), so they learn to think critically about threat evidence from day one.
Other disciplines discarded old training assumptions decades ago. Take Middlebury College’s world-renowned Language Schools. Educators recognized that years of memorizing isolated vocabulary lists and conjugation tables only teach students about a language. True fluency requires total immersion, forcing learners to navigate tone, dialect, and real-time conversation alongside expert mentors from day one.
Low-signal alerts are security’s vocabulary lists. Parsing static indicators teaches analysts how to memorize isolated terms, but it never teaches them how enterprise networks actually converse—or how attackers disguise their intent inside routine administrative noise.
AI acts as an immersion engine for the SOC. By automatically pre-assembling telemetry, user baselines, and environmental context into every case file, AI hands junior analysts the operational awareness that once took months of manual querying to build.
Instead of serving as human data routers, junior analysts take direct ownership of high-signal investigations. They evaluate behavioral ambiguity on day one, mastering the dialect and tone of real attacks within guarded operational boundaries, while senior experts asynchronously review and validate their reasoning without stalling live response times.
When they’re immersed in authentic threats backed by complete context, junior analysts develop sharp investigative judgment far faster than legacy triage routines ever allowed.
The path forward
Defending at machine speed requires changing how the security team operates from the ground up. The traditional SOC pyramid was built for an era when manual labor was the only way to process data. Today, AI can, and should, handle that.
Unlocking real operational scale means moving past surface-level triage to accelerate decisions. That requires adapting how your SOC is structured and how your talent is deployed.
AI will not replace the security analyst, but inverted, AI-driven operations will quickly render traditional SOCs obsolete. The point is to elevate human judgment where it matters most.
