Skip to main content

AI in cyber defence

Estimated read: 25-35 minutes · Builds on: M8: Defensive operations & the SOC

This is a fast-moving topic

Briefings give you the durable shape of a trend, not breaking news. For the latest, see Staying current.

What you'll get from this briefing​

  • Where AI actually helps a defender, mapped across detect → identify → contain → respond.
  • The vocabulary employers use: UEBA, SOAR, security copilots, human-in-the-loop.
  • An honest account of the limits: false positives, adversarial evasion, hallucination, automation bias.
  • Why this changes the L1 analyst's job, and why it doesn't delete it.
  • The Australian hook: AI is now appearing in ASD's Information Security Manual controls.

1. Why the SOC wants AI in the first place​

Recall the M8 picture: a SOC drinks from a firehose of telemetry, and the L1 analyst's day is a queue of alerts, most of them false positives. The two chronic problems are volume (more alerts than humans) and fatigue (real incidents buried in noise). AI's promise in defence is precisely aimed at both: filter the noise, enrich what's left, and speed up everything downstream.

The honest framing you should carry into interviews: AI in the SOC is a co-pilot for the analyst, not a replacement for one, and the organisations that get value from it are the ones that understand what it's doing well enough to supervise it.

2. Detect: finding the signal​

  • Anomaly detection. Instead of only matching known-bad signatures, machine-learning models baseline "normal" for a network, a server, or a user, and flag deviations. This catches novel attacks that signature rules miss (which matters more as AI-assisted attackers churn out variants, see the threat-landscape briefing).
  • UEBA: User and Entity Behaviour Analytics. A term you'll see in job ads. UEBA models the behaviour of each user and device: their normal hours, locations, systems, and data volume. When "Sharon from payroll" suddenly logs in at 3 am from a new country and touches 40 servers, UEBA raises the sort of high-quality alert the M8 impossible-travel tabletop trained you on.
  • Smarter correlation. Modern SIEMs increasingly use ML to group the dozens of low-level events of one attack into a single incident-shaped story, instead of dozens of disconnected alerts.
  • The catch: anomaly detection's weakness is that unusual ≠ malicious. A payroll run, a new starter, a migration: all "anomalies". Poorly tuned, it swaps one flood of noise for another. Tuning and feedback are human work.

3. Identify: triaging faster​

This is the layer that most directly touches the job you're training for:

  • Enrichment on tap. M8 taught you to enrich an alert (IP reputation, hash lookups, user context). AI tooling increasingly does the gathering for you and presents a summary. The analyst verifies rather than assembles.
  • Summarisation and classification. Given a raw alert plus surrounding logs, AI assistants draft "what appears to have happened", suggest a true/false-positive classification, and point to similar past incidents.
  • Natural-language querying. Instead of hand-writing query-language searches, analysts can increasingly ask the SIEM questions in plain language and refine from there, lowering the barrier for newcomers (and raising the value of knowing what the right question is).
  • The catch: the model's summary is a hypothesis, not a finding. The analyst who copies AI conclusions into tickets without verification is automating their own mistakes. M8's discipline (check, verify, document what you actually confirmed) is the supervision skill.

4. Contain: acting at machine speed, with a leash​

  • SOAR: Security Orchestration, Automation and Response. Playbook-driven automation: when X is confirmed, automatically isolate the host from the network, disable the account, block the sender, open the ticket, notify the owner. SOAR predates the current AI wave, but AI is making playbooks more flexible and easier to build.
  • Speed matters here. Ransomware spreads in minutes; automated isolation of a compromised host at 3 am (before a human even picks up the alert) is the difference between one rebuilt laptop and a company-wide incident.
  • The leash: human-in-the-loop. Well-run SOCs put approval gates on high-impact actions. Automatically isolating one workstation? Fine. Automatically shutting down a production server or locking out an executive mid-board-meeting? A human approves that. False-positive containment has a real blast radius, so the rule of thumb is: automate the reversible, gate the destructive.

5. Respond: investigating and writing up​

  • Investigation assistance. AI helps reconstruct timelines from logs, suggests what an attacker's next step usually is (mapped to the ATT&CK techniques you met in M8), and proposes hunting queries.
  • Drafting. Incident notes, timelines, and stakeholder comms drafted by AI, edited by the analyst. M8 called ticket-writing the underrated hireable skill; AI raises the floor on speed, but the judgement about what actually happened (and accountability for it) stays human.
  • Threat hunting. Assistants make hypothesis-driven hunting ("show me anything that looks like credential dumping in the last 30 days") accessible to smaller teams.
  • Security copilots. The market category name for AI assistants embedded in security tooling: Microsoft Security Copilot is one shipping example of the category. Treat vendor claims the way M8 taught you to treat any alert: verify before trusting.

6. The limits: give this section equal weight​

Interviewers respect candidates who can criticise the shiny thing:

LimitWhat it means in practice
False positives, stillAI reduces noise but also generates it when poorly tuned; "the model said so" is not a triage verdict.
Adversarial evasionAttackers probe and mimic "normal" to slip under behavioural models. Detection is an arms race, not a solved problem.
Hallucination & over-trustLanguage models state wrong things confidently: fabricated indicators, wrong technique mappings, plausible-but-false summaries. Verification is the analyst's job.
Automation biasHumans defer to machine output, especially under time pressure. SOC culture has to reward challenging the tool.
Data & privacySecurity telemetry is sensitive. What logs feed which model, hosted where? (In Australia, think APPs, M5.)
Explainability"Why did it flag this?" matters for evidence, audits and tuning; opaque models make that hard.

7. The Australian hook: AI reaches the ISM​

Evidence that this has moved from vendor slideware to governance reality: ASD's Information Security Manual (ISM), the Australian government control framework you met in M5, began incorporating AI-related guidance from late 2025, with updates through 2026 adding controls in areas such as using AI to augment detection and AI-assisted software development. The ISM is revised periodically, so check the current version at cyber.gov.au rather than quoting specifics from memory, but the direction is the takeaway: Australian organisations are now expected to govern their use of AI in security, not just experiment with it. For a GRC-track learner, "AI controls are appearing in the ISM" is a genuinely current, genuinely Australian talking point.

8. What this means for your career​

  • The L1 job is changing, not disappearing. Less manual log-grepping and evidence-gathering; more verifying, deciding, tuning and documenting. The centre of gravity moves toward judgement, which is trainable, and which this course has been training.
  • Fundamentals are the supervision skill. You can only catch an AI's wrong answer about TCP, or triage, or an ATT&CK technique if you know the right one. Everything in M1-M8 is what makes you employable alongside these tools.
  • Say yes to the tooling. In interviews, the balanced answer lands: "AI is genuinely useful across detection, triage, containment and response. I'd use it as a co-pilot and verify its output, because hallucination and automation bias are real." That's a senior-sounding sentence a career changer can honestly say.

Self-check​

Q1. Map one concrete AI capability to each stage: detect, identify, contain, respond.

Detect: anomaly detection / UEBA baselining normal behaviour and flagging deviations. Identify: automatic alert enrichment and summarisation to speed triage. Contain: SOAR playbooks auto-isolating a compromised host (with human approval gates for high-impact actions). Respond: timeline reconstruction, drafting incident notes, and AI-assisted threat hunting.

Q2. Why do well-run SOCs keep a human in the loop for containment actions?

Because false-positive containment has real blast radius (isolating production systems or locking out the wrong people causes its own outage). The rule of thumb: automate the reversible, gate the destructive. Humans approve high-impact actions.

Q3. Name three distinct limits of AI in defence and the analyst behaviour that compensates for each.

Any three of: hallucination/over-trust → verify model output before acting on it; automation bias → a culture of challenging the tool; adversarial evasion → don't rely on one detection method (defence in depth); noise from poor tuning → human feedback and tuning; privacy/data concerns → govern what telemetry feeds which model (APPs); explainability → document what you verified, not just what the model said.

References & further reading​