Three Jobs, Kept Distinct

How work splits in an AI-ready SOC
AUTOMATION/01
→ handles the CERTAIN
"Known steps, predictable outcomes"
  • Enrichment
  • Ticketing
  • Blocking known-bad
AI/02
→ handles the VARIABLE
"Choosing and running the right investigative steps, then making sense of the results"
  • Investigation path selection
  • Correlation
  • Sensemaking
PEOPLE/03
→ handle the NOVEL
"Genuinely new behavior, ambiguity, and judgment"
  • New attacker behavior
  • Business judgment
  • Deciding what to codify for AI next
▸The multiplier is codified expertise applied at scale, not AI replacing the expert.
Bolting AI onto existing tasks makes them faster but leaves the shape of the work untouched. The gain comes from keeping these three jobs distinct: automating the certain, letting AI run the variable, and reserving people for the novel. The model follows Stephen Tate (infosecuriosity), Most SOCs Are Thinking About AI the Wrong Way (Jun 2026), which the playbook's Resource Index cites.
© 2026 Ken Connell. All rights reserved.
AGENTIC SECOPS