Skip to content
Cyber Unboxed
AI + SOC Workflows

AI + SOAR: Automating the Boring Half of Response

SOAR platforms run playbooks automatically. Adding AI can help with the fuzzy steps, as long as risky actions stay under human control.

2 min readAdvanced Sep 24, 2026

Explain Like I'm Not a Hacker

An automatic assistant that prepares everything, then asks 'should I press the big red button?'.

The 30-second explanation

Playbooks handle repeatable steps automatically. AI can help with the parts that need reading and judgement, but blocking an account or isolating a server should still need a person's approval.

How it works

  1. 1

    1. Trigger

    An alert starts the playbook.

  2. 2

    2. Enrich

    Automation gathers context; AI summarises.

  3. 3

    3. Approve

    A human approves any risky action.

  4. 4

    4. Act & log

    The action runs with narrow permissions and is logged.

A typical playbook collects context (who is the user, what is the asset, is the indicator known), then decides what to do. AI fits in the reading and drafting parts: summarising an email, classifying an alert, writing the ticket note. The risky part is action. Isolating a machine or disabling an account can cause real harm if wrong, so those steps should require approval, use narrow permissions and log everything. Treat any text the AI reads as untrusted, because it may contain instructions aimed at the automation.

Real-world example

A playbook summarises a phishing report and proposes deleting the message from all mailboxes. An analyst reviews the summary and approves the deletion. If the AI had wrongly matched a harmless notification email, the approval step would have caught it.

How to spot it

  • Actions with no approval

    Containment steps fully automated on AI output.

  • Broad connector permissions

    Automation accounts that can do far more than needed.

  • Unstructured AI output

    Free text feeding decisions.

  • No audit trail

    No record of what ran and why.

What to do

  1. 1Require approval for containment and deletion steps, at least until you have evidence of reliability.
  2. 2Give automation connectors the least privilege they need, and log every action.
  3. 3Make AI steps return structured fields, and treat any text they read as untrusted.

Stay curious. Stay safer.

This is one piece of a bigger picture. Explore more real-world examples, concepts and tips to build your cybersecurity awareness.

Explore More

Keep reading