Security operations centers have spent years stacking tools to solve alert volume issues that the tools simply can’t fix. Elastic N.V. sees the AI-powered SOC as a way to break that cycle.

The problem is structural, according to Mike Nichols (pictured), general manager of security at Elastic. Analysts are burning out because their tools generate more noise and chaos than any human team can absorb. Elastic’s answer is Alert Zero, an approach in which AI agents prioritize alerts so analysts can focus on validated threats. Machine speed handles the volume, while human judgment guides the consequential decisions.

“We hire and pay for these detectives to come work in our environments, but in most of our security operations centers, they’re beat cops writing traffic tickets all day long,” Nichols said. “Imagine if you could eliminate that work, and they really are just showing up at the scene of the crime and doing their analysis and investigation.”

Nichols spoke with theCUBE Research’s Krista Case at Black Hat USA, during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed Elastic’s approach to agent-assisted security operations, emerging vendor lock-in risks in the AI-powered SOC market and where human judgment remains indispensable.

AI-powered SOC requires open architecture, human oversight and trust-first automation

Elastic’s Attack Discovery investigates alerts much as a human analyst would, hunting raw events, checking entity risk scores and corroborating findings across data sources before flagging a confirmed attack. The result is a short list of validated security threats instead of walls of raw alerts. When Attack Discovery finds a detection gap, it drafts a new detection rule and routes it for human approval. On the endpoint side, Elastic’s threat research team continuously monitors sources such as VirusTotal, automatically generating and deploying YARA rules when a vulnerable driver is disclosed.

“The model vendors have done amazing work at getting really efficient in cost and performance,” Nichols said. “Now we can go through every single alert, give it a confidence score and couple that with Attack Discovery.”

Nichols also identified vendor lock-in as a growing concern when organizations select an AI vendor. If an AI SOC vendor’s model is a black box, all the agentic operating procedures built on top of it are also stuck there. Elastic’s response is a bring-your-own-model strategy based on open architecture, workflow visibility through OpenTelemetry tracing and plain-language workflow authoring that team members can audit and modify.

“[Large language models] are now becoming the vendors’ new lock-in mechanism,” Nichols said. “If you pick an amazing AI SOC vendor who has a black box or proprietary model … if you decide to move off of that vendor in the future, how do you take all that work you’ve done somewhere else? It’s proprietary, it’s built into that ecosystem.”

Here’s the complete video interview, part of SiliconANGLE’s and theCUBE’s coverage of Black Hat USA:

(* Disclosure: Elastic N.V. sponsored this segment of theCUBE. Neither Elastic nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)

Photo: SiliconANGLE