The operations of Security Operations Centers (SOCs) have undergone a fundamental transformation, largely driven by the integration of artificial intelligence into investigative workflows. This shift enables analysts to operate with machine-like speed while focusing their expertise on critical decision-making.
Historically, security investigations were a laborious process of manually correlating scattered data from disparate tools. An alert might originate in one system, endpoint activity in another, network telemetry in a third, and threat intelligence in yet another. Analysts spent significant time acting as the integration layer, piecing together fragmented information. This manual correlation was slow, did not scale effectively, and often meant investigations were retrospective rather than real-time.
The environment at Cisco Live 2026 provided a clear illustration of this evolution. The SOC demonstrated a workflow where investigations seamlessly moved between various platforms, including XDR, Splunk Enterprise Security, Secure Firewall, Secure Malware Analytics, Endace, and Wireshark, augmented by AI-assisted analysis. This allowed analysts to dedicate more time to interpreting the meaning of the data rather than simply gathering it.
This change is not about replacing human analysts but about removing friction from their work. Comments from SOC team members at the event highlighted this shift, with one remarking on the ease of "vibe coding" and another questioning why anyone would choose not to use AI. This indicates AI is becoming a standard tool for security practitioners, much like search engines or automation scripts became commonplace in the past.
A significant development is the rise of analyst-driven automation. Previously, custom integrations or workflow enhancements required lengthy requests to engineering teams. Now, AI coding assistants are lowering the barrier to development, allowing security analysts to build solutions themselves. Repetitive tasks, system integrations, or workflow improvements can now be prototyped in hours, empowering a new generation of "analyst-builders."
This trend aligns with the concept of an "Agentic Workforce," where security operations increasingly resemble teams of specialists working collaboratively. Detection platforms identify threats, correlation engines link events, AI systems summarize findings, investigation tools gather evidence, and automation platforms execute responses, all while human analysts validate conclusions and make final decisions.
One real-world investigation at Cisco Live involved malware detected from a downloaded executable. An XDR incident, triggered by a Secure Malware Analytics verdict, provided an immediate starting point. The XDR platform automatically correlated telemetry from multiple sources, allowing the analyst to pivot seamlessly to Secure Malware Analytics, then Splunk, and other tools to identify the originating host, destination server, and download activity. This integrated workflow significantly reduced the time spent gathering evidence, allowing the analyst to focus on understanding the situation.
Another investigation dealt with numerous XDR incidents related to HTTP authentication traffic. Instead of manually reviewing hundreds of individual alerts, analysts used integrated tools to pivot from XDR to Splunk, Endace packet capture data, and Wireshark. This analysis revealed that legacy Basic Authentication attempts, not an active attack, were triggering the alerts. The team confirmed this behavior and identified a remediation strategy, which included filtering these noisy events upstream to improve SOC efficiency and reduce alert fatigue. This outcome exemplifies the modern SOC's focus on not just closing incidents but also refining detection pipelines.
