Building the SOC of the future: How AI can optimize federal cyber operations

Federal security operations centers are confronting unprecedented data volumes, increasingly sophisticated threats, complex technology environments and rising operational costs. Legacy SOC models that rely heavily on manual investigation, disconnected tools and static detection rules are becoming difficult to sustain.

Frontier artificial intelligence offers an opportunity to rethink how security operations are designed and delivered. However, modernization is not simply a matter of adding another AI tool to an already crowded technology stack. During a recent video discussion produced by Scoop News Group for Deloitte, Manny Medrano, Director of the Global Security Operations Center in Diplomatic Technology at the Department of State, and Kunmi Akingbade, Cyber Principal at Deloitte & Touche LLP, said the next-generation SOC will require an integrated operating model that connects intelligent detection, rapid response, cost-optimized architecture, governance and continuous workforce development.

From reactive monitoring to predictive operations

As Akingbade explained during the discussion, many SOC analysts still move between multiple dashboards, investigate large volumes of low-fidelity alerts and manually assemble the context needed to determine whether an event represents a genuine threat. This reactive model limits the time available for threat hunting, strategic analysis and adversary-focused decision-making.

Akingbade emphasized moving toward a more predictive and data-driven model. By analyzing activity across endpoint, cloud, identity, network and log environments, AI can identify patterns and relationships that may be difficult for human teams to recognize at speed and scale.

This transformation depends on an integrated cyber data foundation. Agencies should connect information from SIEM platforms, endpoint detection and response systems, cloud environments, identity tools, vulnerability platforms, network infrastructure, and threat intelligence sources. A modern cyber lakehouse or intelligence fabric can make this information available for analytics, investigation and automated response.

The goal is to move beyond isolated dashboards and static rules toward an operating model that gives analysts timely context and a broader view of adversary behavior.

AI as an amplifier for security teams

Both Medrano and Akingbade stressed that an autonomous SOC should not be viewed as a replacement for analysts. Instead, it should amplify human capability by allowing technology to manage the burden of scale while people remain responsible for judgment, intent, risk acceptance and mission impact.

AI can improve security operations in several connected areas, including alert enrichment, intelligent triage, natural-language threat hunting, detection engineering, automated playbooks and incident reporting.

AI can also enrich alerts with threat intelligence, similarity analysis, prior verdicts and related telemetry before an analyst begins an investigation. Analysts can then start with relevant context rather than working from a blank investigation. In addition, AI can centralize alerts, prioritize those most likely to represent true positives and suppress repetitive notifications.

Natural-language interfaces may further improve threat hunting by allowing analysts to ask questions in plain English and translate them into structured queries across endpoint, cloud, identity and log sources. Human review remains essential: analysts must validate AI-generated queries, understand the data being examined and determine whether results support an operational decision.

Connecting detection with response

Medrano emphasized that improving mean time to detect is only one part of SOC modernization. Agencies must also reduce the time required to isolate and remediate threats.

Automated playbooks can convert investigation and response steps into repeatable workflows integrated with identity, cloud, endpoint and infrastructure tools. Depending on operational risk, analysts may execute approved actions immediately or review and adjust them before execution.

This human-in-the-loop model is especially important in federal environments, where an incorrect patch, account lockout or containment action could disrupt critical operations. An automated response should therefore include approval thresholds, testing, monitoring, segmentation and rollback procedures.

AI can also support preventive activities such as vulnerability prioritization, patch planning, configuration management, infrastructure-as-code and detection-as-code. These capabilities can reduce the likelihood and impact of incidents.

Building a sustainable operating model

Medrano cautioned against adding AI as another disconnected product and urged agencies to make better use of existing investments. Agencies should first determine whether existing platforms can support alert enrichment, orchestration, natural-language querying, detection engineering and automated reporting. They should also evaluate overlapping tools and the cost of ingesting and retaining large volumes of security data.

Both speakers emphasized that technology modernization must be matched by workforce modernization. Analysts need training in AI-enabled investigation, query validation, automation oversight, detection engineering and adversarial thinking. Leaders must also explain how roles will evolve and provide practical opportunities to build confidence.

A single platform or autonomous agent does not define the SOC of the future. It is an operating model that integrates data, intelligent automation, dynamic detection, resilient architecture, governance and a continuously developing workforce. Agencies that build this partnership deliberately will be better positioned to respond at the speed and scale of the modern threat environment.

Learn more about how Deloitte helps federal agencies become more efficient and more responsive.

This video panel discussion was produced by Scoop News Group for CyberScoop and underwritten by Deloitte.