Corelight Field CTO Discusses AI Changes in SOC and Shadow AI Risks
AI tools change SOC work and help attackers, requiring attention to shadow AI, least privilege, and network monitoring for AI use.
Key points
- LLMs assist in vulnerability analysis and detection engineering, including writing SIEM rules.
- Attackers use AI for coordinated operations, zero-day creation, and social engineering.
- Experts advise monitoring for shadow AI and enforcing least privilege access controls.
Vince Stoffer, Field CTO at Corelight, discusses how AI is changing work in the security operations center and how attackers are using the same tools. According to a video report by Help Net Security, these tools are transforming how both defenders and attackers operate within network environments.
Stoffer explains that large language models now assist with vulnerability analysis and detection engineering tasks. These tools can write security information and event management rules and create small programs to analyze network packets or Zeek metadata. Users report that agentic triage systems lead to faster work and fewer false positives.
Operational Changes and Threat Evolution
Junior analysts are able to dig deeper into network data when supported by these AI systems. However, Stoffer says a human in the loop is still needed before agents take blocking or response actions. This requirement ensures that automated decisions are reviewed by humans before execution.
For attackers, AI supports coordinated agentic operations and the creation of zero-day exploits. The technology also enables more convincing social engineering campaigns. Stoffer notes that AI models are currently finding a wave of new vulnerabilities, further accelerating the pace at which threat actors can identify and exploit weaknesses in systems.
Organizational Impact and Governance
The widespread adoption of AI tools means organizations must watch for shadow AI usage across their infrastructure. Stoffer advises implementing least privilege access controls and auditing changes made by automated systems. Network monitoring tools can help track AI use across the organization, providing insights into how these tools are being deployed.
What should you do?
Security teams should assess their current AI usage to identify any shadow AI instances. Implementing strict least privilege policies for AI agents can reduce the risk of unauthorized actions. Regular audits of changes made by automated systems will help maintain control over security operations and ensure that human oversight remains effective.
Background: Large language models
Large language models are a specific type of neural network trained on text. Generative AI is the broader umbrella term for any system that creates new content, including images and code. Not all generative AI uses large language models, but most modern text generators do.
What to do and how to stay safe: Corelight
- Audit current AI tool usage to identify and mitigate shadow AI risks within the organization.
- Enforce least privilege access controls for all AI agents and automated security tools.
- Implement network monitoring to track AI activity and ensure compliance with security policies.
- Maintain human oversight for all automated blocking or response actions taken by AI systems.
Step-by-step guide: Detection Engineering Best Practices for Reliable Alerting
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How are attackers using AI in security operations?
Attackers use AI for coordinated agentic operations, creating zero-day exploits, and executing convincing social engineering campaigns.
What benefits do AI tools provide to security analysts?
AI tools help with vulnerability analysis, writing SIEM rules, and analyzing network data, leading to faster work and fewer false positives.
What governance steps does Corelight recommend for AI adoption?
Corelight recommends watching for shadow AI, enforcing least privilege, auditing changes, and using network monitoring to track AI use.
