Disclaimer: Opinions expressed are solely my own and do not reflect the views or opinions of my employer or any other affiliated entities. Any sponsored content featured on this blog is independent and does not imply endorsement by, nor relationship with, my employer or affiliated organisations.

A two-part series on the new bottleneck emerging in AI-powered SOCs, and why solving investigation created a better problem to solve.

Let me start with some good news: We're actually winning at AI-powered security operations.

No, really. Hear me out.

Over the last two years, AI has genuinely transformed the middle of the IR cycle, investigation and triage. Vendors build amazing AI SOC analysts that can handle the 5Ws (Who, What, When, Where, Why), enrich alerts with context, and reach accurate verdicts in seconds instead of hours.

The middle is getting solved. AI can investigate alerts at scale, and it does it well (of course if you implement it right)

And now? The industry is shifting left. We're seeing platforms tackle data pipelines, log normalization, and even detection engineering itself. AI is helping us build better detections, optimize coverage, and reduce false positives at the source.

This is real progress. We should celebrate it.

But here's what's happening as a result of this progress: we're moving the bottleneck.

This edition is sponsored by Binalyze

When AI handles investigation and triage brilliantly, and when detection engineering improves to generate higher-fidelity alerts, you end up with a new challenge:

You now have more True Positives and Inconclusive alerts that require deep investigation and incident response.

Let me break this down with a real example:

Before AI (the old bottleneck):

After AI in the Middle (current state):

See what happened? You went from "drowning in alerts" to "drowning in incidents that need forensic investigation and response."

This is actually a better problem to have, you're working on real threats now, not noise. But it's still a bottleneck.

Related to this blog, there isa podcast episode, check it out:

While the bottleneck has clearly shifted right, smart organizations are discovering that forensic automation platforms can actually enhance investigation at every stage, not just the deep forensic response. 

Even during AI triage, when your AI SOC analyst is determining whether that alert is a True Positive or False Positive, having instant access to forensic artifacts can dramatically improve verdict accuracy:

This means fewer alerts stuck in "Inconclusive" limbo and more confident verdicts earlier in the process. The forensic infrastructure you build for deep investigation also makes your AI triage more effective.

When your AI SOC analyst escalates a True Positive or marks something as Inconclusive, here's what actually needs to happen:

The AI hands you a verdict:

TRUE POSITIVE: Lateral movement detected

User: john.doe

Source: WORKSTATION-047  

Target: DC-01 (admin share accessed)

Confidence: HIGH

MITRE: T1021, T1570

Recommendation: Immediate forensic investigation and containment

Great! Now what?

Your analyst (or IR team) needs to:

And here's the kicker: most of this is still manual, slow, and inconsistent.

As you solve the middle (investigation/triage) and improve the left (detection engineering), you're naturally generating more high-quality incidents that require the right side of the IR cycle to work properly:

Investigation → Containment → Eradication → Recovery → Lessons Learned

But the right side hasn't kept pace with the middle and left. Here's what's still broken:

What actually happens:

The problem:

Remember my blog series on playbooks? Most IR playbooks are PDFs or wiki pages that say things like:

Lateral Movement Response:

1. Isolate affected systems

2. Collect forensic evidence

3. Determine scope of compromise

4. Reset credentials

5. Document findings

This is guidance for humans, not executable automation.

When your AI SOC solution escalates 20 True Positives per day, you can't manually execute these steps 20 times. You need:

Even when you know what needs to be done, executing it requires:

So containment that should happen in minutes takes hours or days because you're stuck in Slack threads and email chains getting approvals.

Let me map this against the SecOps AI Shift Map I introduced in my previous blog:

Left Side (Detection & Data):

Middle (Investigation & Triage):

Right Side (Response & Recovery):

Here's a concept I don't hear talked about enough: Investigation Debt.

Investigation Debt is what accumulates when you have True Positives or Inconclusive alerts that you can't properly investigate with complete forensic evidence.

Every time you:

You're accumulating Investigation Debt.

And here's what makes this dangerous: that lateral movement alert you couldn't fully investigate three months ago might have been your initial compromise. But you didn't collect the forensic evidence, logs rotated, the attacker cleaned up, and now you're doing incident response in the dark.

The irony is that better AI in the middle makes Investigation Debt more visible.

Before AI, you had so much noise you didn't even know which alerts were real. Now AI is flagging possible True Positives for you, and you're realizing: "We don't have the capacity to properly respond to all of these."

So what does the right side need to keep pace with the middle and left?

When a True Positive alert fires, evidence collection should happen automatically, not manually:

This needs to be triggered by alert severity, not analyst memory.

Response actions need to be automated but with proper safety rails:

This is where SOAR was supposed to help, but as I wrote in my Shift Map blog: we failed at SOAR not because the tech was bad, but because our processes were a mess.

Here's where we are:

✅ Middle is getting solved - AI handles investigation and triage brilliantly

🔄 Left is improving - Detection engineering and data pipelines are getting AI assistance

❌ Right is the bottleneck - Forensic collection, response execution, and recovery are still manual

The solution isn't to slow down the middle or left. The solution is to build the right side infrastructure to match.

That means: