How to Use AI Responsibly to Prevent SOC Analyst Burnout

The security operations center (SOC) market was valued at more than $40 billion in 2024, projected to grow at a 7.9 percent CAGR between 2025 and 2034, according to Polaris Market Research.

This movement toward centralized management is a natural response to increasingly complex logistics. Globalization, growth, and expansion all require security teams to cover more ground, and a dedicated hub enables them to do this remotely as a unified front, with shared data to coordinate observation and response strategies.

For all its benefits, this centralization has also led to a flood of input as alerts from multiple distributed sites are now funnelled into a single destination. In a 2025 survey of 282 security leaders, Prophet Security found that SOC analysts now handle between 1,000 and 5,000 alerts per shift and spend 3 hours per day on manual triage. This leaves up to 67 percent of incidents unaddressed due to time constraints and the expectation that many of the alerts are false positives.

Beyond the blind spots created by information overload, SOC analyst burnout from prolonged vigilance affects human decision-making, speed, and accuracy, creating further vulnerabilities. Agentic artificial intelligence (AI) is being used to address these shortcomings by processing alerts on a scale that could take a mid-sized team hundreds of hours to accomplish. 

Agentic AI and Alert Triage in SOCs

Although traditional AI is used throughout the security pipeline, it is partly responsible for the noise that SOC teams must filter. Cameras use AI to detect motion, classify the object sighted, and generate an alert for human review. For a smaller, localized team handling an automated notification, resolving it can take a few minutes; at a large enterprise SOC scale, the scale quickly becomes apparent.

Agentic AI is a fundamentally different beast, serving as a buffer that contextualizes and evaluates input before it reaches human operators. The core differentiators of agentic AI are its ability to iterate on reasoning, learn to use tools, and make autonomous decisions based on memory, objectives, and contextual risk.

Because of these capabilities, agentic AI can be used for several tasks that would otherwise require manual attention from a SOC analyst.

One example is how the technology can be applied to an after-hours intrusion event.

A standard workflow for such an incident might include multiple alerts from different sources, such as security cameras, noise sensors, and perimeter controls. Each would produce a different notification, slowing the time it takes an operator to gather clear information about the event.

With an agentic AI workflow, the technology could consolidate multiple signals into one incident, collect access logs, review employee schedules, and look at video surveillance footage. The agentic AI workflow could then evaluate risk to the organization based on time of day, authorization for entry, and other contextual factors. It would then create a risk summary, bolstered by video clips and relevant log data, into a report that could be escalated for human review if deemed necessary.

This process mitigates automation’s tendency to create more work by providing clear context and prioritization. Agentic AI can meaningfully reduce investigation time by curating relevant information and reducing the number of notifications that reach SOC analysts, filtering out false alarms based on defined and evolving parameters that analyze multiple data streams.

Agentic AI’s Shortcomings

While agentic AI can make SOCs more efficient, it has shortcomings that security practitioners need to be prepared to address as they plan to integrate it into their workflows.

Trust and transparency in agentic AI depend on a clearly defined use and compliance with data protection laws, which are particularly relevant in SOC triage, where both video security and worker information play a pivotal role.

Furthermore, despite 67 percent of security leaders in the Prophet Security survey identifying triage as the area where agentic AI can make the most difference, privacy concerns and fears of automation bias remain sticking points to broader adoption. Best practice frameworks, such as the U.S. National Institute of Standards and Technology AI Risk Management Framework, explicitly require human oversight of all decision-making entities and that AI logic be auditable and explainable.

Additionally, physical security staff are used to levels of ambiguity that AI, reliant as it is on precise data, struggles to cope with. This predicament can be mitigated with safety features that escalate unknown variables to SOC operators, but that then creates the very problem they are trying to solve: more low-quality alert noise.

Agentic AI in SOCs is limited to first-level triage, where analysts and operators have a clear, mandatory need for automation. We are already at a point where there are too many alerts for humans to investigate, and this issue will only scale with future growth.

Agentic AI is a solution to this problem. There will only ever be more alert-generating devices; the only question is how teams implement and govern these systems to minimize mistakes. 

Will MacDonald is the director of product management for the Avigilon video security product line at Motorola Solutions, where he oversees the development and strategy of cutting-edge cloud-based video security technologies. Building on his extensive experience as a technology leader, MacDonald plays a key role in driving innovation, scalability, and security within the video security industry.

© Will MacDonald