AI is widespread in security operations, but governance lags

Security teams report faster investigations

The AI Adoption in the SOC report, conducted by Dimensional Research and sponsored by Elastic, found that security professionals use several types of AI, including general chatbots, custom-built tools and native AI features in security products.

The most common security use case was research, knowledge assistance and training, cited by 61% of respondents. Threat intelligence analysis followed at 60%, while documentation and executive summaries accounted for 54%. Investigation acceleration was cited by 52%, and threat hunting by 48%.

Nearly all surveyed teams, 99.8%, said they benefit from AI adoption. Faster investigations were the most frequently reported benefit, at 61%. Other reported gains included an improved overall security posture at 53%, better detection quality at 48%, and analyst operational efficiency and time savings at 46%.

General chatbots create efficiency and security concerns

The survey also found that 85% of teams report negative impacts from AI adoption. Cost was the most commonly cited problem, at 57%, while 50% said most AI outputs require correction or rework before they can be used.

General chatbots such as ChatGPT, Claude and Copilot are used by 75% of teams, compared with 66% using native AI features built into security tools. Respondents said general-purpose tools support a broader range of tasks, cited by 58%, while cost and token management influenced 48% and ease of use influenced 40%.

Elastic describes this use of external assistants as “sidecar AI.” Moving investigation context between tools can create additional work and expose sensitive information through data disclosure, insecure plugin design or insecure output handling. The company also warns that tools with limited context may produce confident responses that do not reflect a team’s complete security telemetry.

Automation is expected to keep human oversight

According to Elastic, 89% of respondents agree that the future of security operations involves automated agentic workflows with detailed human oversight and clear governance. However, only 18% say they currently have a fully developed governance framework.

The survey points toward systems that investigate, correlate and propose actions, while people approve consequential decisions. Elastic says embedded AI can reduce context switching by operating within the investigation workflow and using the data analysts are already reviewing. It identifies transparency, editability, data proximity and human approval as requirements for trustworthy AI-assisted workflows.

The report also links maturity with reported value. All teams with mature AI adoption reported moderate or significant value, compared with 60% of teams at the limited-use stage. For security teams, the findings support greater integration and stronger oversight rather than simply restricting AI use.