Prophet Security Report Highlights Urgent Need for AI in SOCs

Security Operations Centers (SOCs) are facing unprecedented strain. The newly released State of AI in Security Operations 2025 report from Prophet Security highlights an industry under siege by data overload, talent shortages and an escalating “alert problem.”

The survey of nearly 300 security leaders found that 40% of alerts go uninvestigated and 60% of teams have experienced breaches tied to ignored alerts. With average alert dwell time hovering near an hour, traditional approaches are faltering against increasingly agile adversaries.

Against this backdrop, Grant Oviatt, Co-founder and Head of Security Operations at Prophet Security, discussed the report’s findings with SecurityInfoWatch and what they mean for security teams.

Alert fatigue and analyst burnout

Oviatt emphasized the toll alert overload is taking on SOC teams. Analysts are often trapped in a cycle of triaging and investigating repetitive alerts, most of which are false positives. “SOC team members morale is at an all time low, many analysts feel like they’re a hamster on a wheel constantly triaging, investigating alerts, many of them false positives, which leads to burnout and attrition,” he said.

The average analyst tenure, once two years, has now dropped to just 12 months.

He sees artificial intelligence (AI) as a critical turning point. Instead of analysts spending hours on low-value tasks, AI can take on the scale and speed of investigations. “The analyst’s role is not to echo the machine, but to guide and challenge it,” Oviatt explained.

He added that AI serves as a force multiplier, investigating at scale, surfacing hidden patterns and accelerating response. Analysts contribute the judgment, contextual awareness and adversarial mindset that machines lack.

“Together, this partnership elevates investigations from quick pattern matching to meaningful, outcome-driven security decisions,” he said.

Balancing compliance and AI adoption

One of the report’s more surprising findings is that data privacy and regulatory compliance, not job loss fears, are the biggest barriers to AI adoption in the SOC. Oviatt echoed this, stressing that transparency and trust must come first.

“Security teams should look for solutions that are transparent, providing clear reasoning for the investigations they perform and clear logs for auditability,” he advised. Starting with read-only access and gradually expanding permissions as confidence grows can help teams build trust. Enforcing governance controls around data residency, anonymization, and retention is equally important. Keeping humans in the loop for high-impact decisions ensures compliance without sacrificing efficiency, he said.

Measuring ROI to gain executive buy-in

For many security leaders, demonstrating ROI is critical to sustaining investment in AI-enabled SOC tools. Oviatt pointed to tangible KPIs that resonate at both the technical and business levels: mean time to triage an alert, backlog size, percentage of alerts investigated, analyst throughput per shift, and false positive rates.

“Security leaders should communicate results in terms that fellow executives understand: reduced risk of breach, faster recovery, and reclaimed analyst capacity or hours saved,” Oviatt said. This translation from metrics to business outcomes is essential for ongoing executive support.