How a traditional SOC is organised
Many SOCs are built in tiers. Tier one analysts watch the queue, take the first look at each alert and decide whether it needs more attention. Tier two analysts take what tier one passes up and investigate in depth. Tier three, often a small group of senior people, handles the hardest cases, hunts for threats no rule has found and improves detection.
Because attacks do not keep office hours, the queue has to be covered around the clock. That means shifts, or an outside provider for nights and weekends, and it means handovers. At the end of each shift, open cases and half-finished thoughts pass from one person to the next, in notes or a short conversation.
The model has lasted because it works. It puts newer staff on the high-volume work, saves experienced people for the cases that need them, and gives junior analysts a path to learn.
Where the traditional model is strong
People bring things to an investigation that are hard to write down. An experienced analyst knows which teams run odd jobs, which servers are fragile, and which kind of alert has meant trouble before. They can pick up the phone and ask the owner of a machine what they were doing. They notice when something is off in a way no rule describes.
People are also accountable in a way software is not. When a decision has consequences for the business, such as taking a system offline during trading hours, it matters that a named person made it with full knowledge of the situation.
- Knowledge of the business and its people.
- Judgement on unusual, high-stakes cases.
- The ability to ask questions the data cannot answer.
- Accountability for decisions that affect the business.
Where it strains
The strain falls on tier one. The first look at an alert is repetitive work: open the alert, find the machine, look up the user, search for related events, check an address against threat intelligence, write a note. It has to be done carefully every time, and much of the time it ends with nothing found. That combination wears people down, and it makes the role hard to keep people in.
Volume makes it worse. When alerts arrive faster than the queue can be cleared, analysts start to skim, close familiar-looking alerts without full checks, or let older alerts wait. Handovers add their own gaps. A detail noticed at two in the morning may not make it into the notes, and the next shift starts again from the alert.
Night cover is the hardest part to staff. Fewer people are on, those who are may be less experienced, and a slow look costs most when an attacker has chosen a quiet hour on purpose.
What an AI first look changes
An AI SOC moves the first look from tier one to an agent. The agent does not get tired, does not skim at the end of a long shift and works the same way at three in the morning as at three in the afternoon. Each alert gets the same core checks, and the agent goes further when what it finds calls for it.
It also writes everything down. Every question it asked and every record it read is kept, so the record of the investigation does not depend on someone remembering to take notes. That changes handovers: the next person picks up a finished first read with its evidence, not an alert and a line of shorthand.
What it does not change is who decides. The agent’s output is a verdict and a recommendation. The analyst reviews it, agrees or corrects it, and the decisions that affect the business stay with people.
How the two work together
In practice the two models meet in the middle. The agent takes the first look at everything. People review its verdicts, starting with those it calls real attacks or suspicious, and check a sample of the ones it calls harmless. Their corrections feed back, so the agent learns the company’s habits over time.
The tiers do not vanish, but their work shifts. Junior analysts spend more time reviewing evidence and less time gathering it, which is closer to the skill they need to grow. Senior analysts get more time for hunting and detection, because fewer routine cases reach them. At night and at weekends, the agent works the queue and the person on call starts from finished investigations.
The gain is consistency as much as speed. Each alert gets a real look, including the ones that would have been closed on sight at the end of a busy shift.
Counting the cost of the first look
The first look is paid for in staff hours, and it is worth counting them for your own team before comparing options. The sum is simple. Multiply alerts by minutes and divide by sixty to get hours of first look a day. Multiply that by the hourly cost for the daily cost, and by the working days in a year for the annual figure. Then add what a simple count misses: the night and weekend cover you pay for whether alerts arrive or not, and the time spent on handovers.
Compare that with what the alternative costs, and with what it leaves your people to do. A first look that is cheaper but leaves analysts checking each verdict all over again saves little. One that hands over a verdict with evidence a person can check quickly changes the sum.
You need four numbers, all from your own records:
- How many alerts reach a person each day.
- How many minutes a first look takes on average.
- What an hour of an analyst’s time costs, with overheads.
- What you pay for shift cover, regardless of volume.
Where armor360 fits
armor360 is built for the first look. It collects alerts from Elastic Security, Splunk, Microsoft Sentinel, CrowdStrike Falcon or Microsoft Defender, investigates each one, and hands a person a verdict with its confidence and evidence. It recommends; people decide and act.
Its running cost is about $0.10 of compute per investigation, an estimate of what it costs to run rather than a price. Pricing is by quote, sized to what you protect, with no charge per person, and the calculator on the pricing page works through the staff-hours sum above on numbers you can change.