* [Blog](https://www.paloaltonetworks.com/blog)
* [Palo Alto Networks](https://www.paloaltonetworks.com/blog/corporate/)
* [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/)
* Let AI Handle the Heavy L...

# Let AI Handle the Heavy Lifting in the Modern SOC

[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2F2024%2F03%2Fai-in-the-modern-soc%2F)  
[](https://twitter.com/share?text=Let+AI+Handle+the+Heavy+Lifting+in+the+Modern+SOC&url=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2F2024%2F03%2Fai-in-the-modern-soc%2F)  
[](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2F2024%2F03%2Fai-in-the-modern-soc%2F&title=Let+AI+Handle+the+Heavy+Lifting+in+the+Modern+SOC&summary=&source=)  
[](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https://www.paloaltonetworks.com/blog/2024/03/ai-in-the-modern-soc/&ts=markdown)  
\[\](mailto:?subject=Let AI Handle the Heavy Lifting in the Modern SOC)  
Link copied  
By [Dena De Angelo](https://www.paloaltonetworks.com/blog/author/ddeangelo/?ts=markdown "Posts by Dena De Angelo")  
Mar 13, 2024  
7 minutes  
[Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown)  
[Points of View](https://www.paloaltonetworks.com/blog/category/points-of-view/?ts=markdown)  
[Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown)  
[AI](https://www.paloaltonetworks.com/blog/tag/ai/?ts=markdown)  
[AI in cybersecurity](https://www.paloaltonetworks.com/blog/tag/ai-in-cybersecurity/?ts=markdown)  
[AI's Impact in Cybersecurity](https://www.paloaltonetworks.com/blog/tag/ais-impact-in-cybersecurity/?ts=markdown)  
[Autonomous soc](https://www.paloaltonetworks.com/blog/tag/autonomous-soc/?ts=markdown)  
![](https://www.paloaltonetworks.com/blog/wp-content/themes/panwblog2023/dist/images/audio-icon.svg)  
Donnie Tindall -- AI Revolutionizes Cyberthreat Defense  
*00:00* *00:00*  
Volume Slider  
10s 10s  
10s 10s  
Seek Slider

*["AI's Impact in Cybersecurity"](https://www.paloaltonetworks.com/blog/tag/ais-impact-in-cybersecurity/?ts=markdown) is a blog series based on interviews with a variety of experts at Palo Alto Networks and Unit 42, with roles in AI research, product management, consulting, engineering and more. Our objective is to present different viewpoints and predictions on how artificial intelligence is impacting the current threat landscape, how Palo Alto Networks protects itself and its customers, as well as implications for the future of cybersecurity. In our interview with Donnie Tindall, we discuss how AI is altering our cyberthreat defense strategy.*

The cybersecurity field is experiencing a paradigm shift as artificial intelligence (AI) emerges as a game-changer. Innovation is happening on the daily with both defenders and attackers alike deploying AI into unseen territories, testing to see what's possible. It's like a penetration test on steroids. It's a new frontier fueled by ones and zeros, wielded by those who wish to protect or those who desire to do damage.

To delve into this fascinating territory, we spoke with Donnie Tindall, a seasoned expert at Unit 42 Security Consulting. His unique perspective sheds light on how AI is revolutionizing the way we defend against cyberthreats, presenting both exciting possibilities and ongoing challenges.

## AI on the Front Lines

Donnie's work primarily focuses on utilizing AI to combat web scraping, where malicious actors harvest data from websites. The key lies in AI models that analyze web traffic, flagging suspicious patterns that indicate data extraction attempts. However, the power of AI extends beyond mere detection. Donnie emphasizes the crucial role of human review in ensuring accuracy and minimizing false positives. This human-AI partnership, where machines handle the heavy lifting and humans provide expert oversight, strikes a vital balance in the fight against cybercrime. He explains a little of his process:

*"We focus on the web scraping piece of it. So, engineers built a set of models to look at... inbound web traffic to their website and determine, 'Is this user scraping our data?' They did a lot of modeling on what that sort of behavior should look like.*

*After about 6 months, they realized these models were making tons and tons of decisions over time, but they had no idea if they were the right decisions. So, they actually brought us in to do what they refer to as 'human review,' where we sample subsets of these AI models' decisions and determine, 'Was this the right call? Is this user scraping or is this a benign activity?'*

*We help categorize and feed those back into the model over time to help it learn and change its detections and decisions. So, my kind of hot take, if you will, is that obviously there's lots of chatter everywhere all over the internet about the jobs that AI is going to replace. But ...it's also going to create some new categories of jobs that we may not have considered... somebody has to keep these things on the rails and make sure they're doing what they're supposed to do."*

## Automating the SOC

Security operations centers (SOCs) are the nerve centers of cybersecurity. They're monitoring for and responding to threats, teeming with copious amounts of data from numerous and often disparate sources. Traditionally, managing a SOC has been a labor-intensive process, with analysts sifting through mountains of alerts, determining which were critical and needed immediate attention, and which were false positives. This is a mind-numbing exercise, repeated ad infinitum by security analysts struggling to stay ahead of the deluge.

With SOC teams receiving an average of 11,000 alerts per day, according to [Forrester Research](https://start.paloaltonetworks.com/forrester-2020-state-of-secops), security analysts are often plagued with burnout. In a [report by the Ponemon Institute](https://www.devo.com/company/newsroom/ponemon-institute-and-devo-technology-study-reveals-65-of-cybersecurity-analysts-consider-quitting-due-to-burnout-lack-of-visibility/) that assessed the performance of SOCs, it was revealed that 65% of IT security operations personnel admitted that the stress levels within the SOC environment had led them to contemplate switching careers or leaving their current jobs. Additionally, 66% of the survey participants expressed a high likelihood that seasoned security analysts would decide to resign from their SOC positions.

Thankfully, AI is transforming the SOC landscape by automating mundane tasks like alert triage, allowing even smaller SOC teams to handle large workflows (not possible in the past) with limited manual and siloed tools. Imagine the AI handling the initial sorting and identifying the most critical threats for human analysts to focus on. This frees up valuable resources, allowing security professionals to delve deeper into complex investigations and implement effective countermeasures.

With [Cortex XSIAM®](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown), artificial intelligence plays a pivotal role, particularly in the intricate process of data stitching. This critical procedure involves the aggregation of data from various threat vectors, the grouping of diverse events, and the presentation of these events as a coherent incident narrative.
![Image depicting Cortex XSIAM: bringing it all together.](https://www.paloaltonetworks.com/blog/wp-content/uploads/2024/03/word-image-315938-3.png)
Cortex XSIAM is the AI driven security operation center platform that brings together security data from across the enterprise, network, endpoint, identity, cloud and attack surface.

Without the power of AI, this task presents a formidable challenge. In the absence of AI, security analysts would find themselves manually navigating through multiple product consoles to collect data, and often suffering from "swivel-chair syndrome." Subsequently, they would painstakingly compile this information, often resorting to notepads or Excel spreadsheets. This workflow would then require them to meticulously analyze the data to identify the underlying thread connecting these events. Such a manual approach would not only be time-consuming but also inefficient in swiftly detecting issues and proactively addressing security concerns.

## A Glimpse Into the Future

The integration of AI into cybersecurity is still in its early stages, but the future holds immense potential. Donnie paints a captivating picture of possibilities. Imagine an AI-powered internet traffic cop, who analyzes global web traffic in real time and automatically blocks identified attacks before they reach their targets. This centralized defense system could be a game-changer in the fight against cybercrime.

However, Donnie also acknowledges the challenges that lie ahead. As attackers become more sophisticated, they will undoubtedly learn to exploit the vulnerabilities of AI models. The arms race between attackers and defenders will continue, with AI serving as a powerful tool on both sides.

Answering the question: "What types of cybersecurity threats or attacks do you think AI powered systems are particularly effective at detecting and preventing?" Donnie responds:

*"I would imagine right now, a lot of that is going to be in the known vulnerabilities and exploits, like what CVEs have been documented. Obviously you can dump the entire MITRE database into a learning model and detect any of those attacks. What I expect the struggle to continue to be, as it already is without AI, is the zero-day attacks or the stuff that just hasn't been prevalent enough to be broadly analyzed and torn apart and figured out how it works. I think that's going to be the real power of the AI...to help us find those in the wild."*

## Navigating the AI Frontier

As we embrace AI in cybersecurity, it's crucial to recognize that it's not magic. Human expertise remains irreplaceable, providing the strategic direction and critical thinking that AI currently lacks. The key lies in building a strong partnership between humans and machines, harnessing the strengths of each to create a robust and adaptable defense against ever-evolving cyberthreats.

> How frequently do we need to check in, and how frequently is too unreasonable to expect for humans to be able to keep up with the AI?

Donnie's insights serve as a valuable reminder that while AI technology is rapidly advancing, the fundamental principles of cybersecurity --- vigilance, adaptation and collaboration --- remain the cornerstone of our digital safety.

By understanding the current applications, future possibilities and ongoing challenges of AI in cybersecurity, we can prepare ourselves for the exciting journey ahead. As Donnie aptly concludes, "...the battle between attackers and defenders continues, with AI becoming increasingly sophisticated on both sides." Let us leverage this powerful technology responsibly and strategically, ensuring that the future of cybersecurity is one of proactive defense and collective resilience.

#### **Learn More About AI's Impact on Cybersecurity**

[Register for Symphony 2024](https://symphony.paloaltonetworks.com/?utm_source=content-corp-blog&utm_medium=web&utm_campaign=symphony24&utm_content=), April 17-18, to explore the latest advancements in AI-driven security, where machine learning algorithms predict, detect and respond to threats faster and more effectively than ever.

*** ** * ** ***

## Related Blogs

### [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [Points of View](https://www.paloaltonetworks.com/blog/category/points-of-view/?ts=markdown), [Product Features](https://www.paloaltonetworks.com/blog/security-operations/category/product-features/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown)

[#### AI in Cybersecurity --- A CISO's Perspective](https://www.paloaltonetworks.com/blog/2024/03/ai-in-cybersecurity-a-cisos-perspective/)

### [Points of View](https://www.paloaltonetworks.com/blog/category/points-of-view/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown)

[#### Beyond the Hype --- Where AI Can Shine in Security](https://www.paloaltonetworks.com/blog/2024/01/where-ai-can-shine-in-security/)

### [Company \& Culture](https://www.paloaltonetworks.com/blog/category/company-culture/?ts=markdown), [Points of View](https://www.paloaltonetworks.com/blog/category/points-of-view/?ts=markdown)

[#### AI in OT Security --- Balancing Industrial Innovation and Cyber Risk](https://www.paloaltonetworks.com/blog/2024/08/ai-in-ot-security/)

### [Company \& Culture](https://www.paloaltonetworks.com/blog/category/company-culture/?ts=markdown), [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [Product Features](https://www.paloaltonetworks.com/blog/security-operations/category/product-features/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown)

[#### AI Provides an Rx for Cybersecurity in Healthcare](https://www.paloaltonetworks.com/blog/2024/07/ai-provides-an-rx-for-cybersecurity-in-healthcare/)

### [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [Points of View](https://www.paloaltonetworks.com/blog/category/points-of-view/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown)

[#### AI in Cyber Is Here to Stay --- How to Weather This Sea Change](https://www.paloaltonetworks.com/blog/2024/05/ai-in-cyber-is-here-to-stay/)

### [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [Points of View](https://www.paloaltonetworks.com/blog/category/points-of-view/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown)

[#### The Dark Side of AI in Cybersecurity --- AI-Generated Malware](https://www.paloaltonetworks.com/blog/2024/05/ai-generated-malware/)

### Subscribe to the Blog!

Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more.
![spinner](https://www.paloaltonetworks.com/blog/wp-content/themes/panwblog2023/dist/images/ajax-loader.gif) Sign up  
Please enter a valid email.  
By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) and acknowledge our [Privacy Statement](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown). Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder.  
This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply.  
{#footer} {#footer}

## Products and Services

* [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown)

* [Secure AI by Design](https://www.paloaltonetworks.com/precision-ai-security/secure-ai-by-design?ts=markdown)

* [Prisma AIRS](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown)

* [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown)

* [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown)

* [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown)

* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown)

* [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown)

* [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown)

* [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown)

* [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown)

* [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown)

* [Industrial OT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown)

* [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown)

* [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown)

* [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown)

* [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown)

* [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown)

* [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown)

* [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown)

* [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown)

* [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown)

* [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown)

* [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown)

* [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown)

* [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown)

* [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown)

* [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown)

* [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown)

* [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown)

* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown)

* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown)

* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown)

* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown)

* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown)

* [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown)

* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown)

* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown)

* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown)

* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown)

* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown)

* [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown)

* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown)

* [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown)

* [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess?ts=markdown)

* [Incident Response](https://www.paloaltonetworks.com/unit42/respond?ts=markdown)

* [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform?ts=markdown)

* [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners?ts=markdown)

## Company

* [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown)
* [Careers](https://jobs.paloaltonetworks.com/en/)
* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown)
* [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown)
* [Customers](https://www.paloaltonetworks.com/customers?ts=markdown)
* [Investor Relations](https://investors.paloaltonetworks.com/)
* [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown)
* [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown)

## Popular Links

* [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown)
* [Communities](https://www.paloaltonetworks.com/communities?ts=markdown)
* [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown)
* [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown)
* [Event Center](https://events.paloaltonetworks.com/)
* [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center)
* [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown)
* [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown)
* [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown)
* [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown)
* [Tech Docs](https://docs.paloaltonetworks.com/)
* [Unit 42](https://unit42.paloaltonetworks.com/)
* [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd)
  ![PAN logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)
* [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown)
* [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown)
* [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown)
* [Documents](https://www.paloaltonetworks.com/legal?ts=markdown)

Copyright © 2026 Palo Alto Networks. All Rights Reserved

* [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks)
* [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown)
* [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/)
* [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks)
* [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks)
* EN  
  Select your language