The AI SOC Hit Production. Only 10% of Buyers Call It Excellent.

The AI SOC stopped being a pitch deck eighteen months ago. It's a line item now, and a chunky one.

Billions are moving into agentic triage platforms, LLM-backed co-pilots wedged into SIEM consoles, and detection engineering assistants that promise to read every alert so your tier-1 analyst doesn't have to. Deployment velocity is real. Adoption numbers look like a hockey stick that finally earned the comparison.

Then you ask the buyers how it's going.

Only about 10% describe the value as excellent. The rest land somewhere between useful and we're still tuning it. That gap — between what got bought and what got delivered — is the entire story for 2025.

Why the first wave underdelivered

Most v1 AI SOC products were wrappers. A frontier model, a RAG pipeline over your alert corpus, a chat box. They summarized. They correlated. They occasionally hallucinated an attacker IP into existence.

What they didn't do is close tickets without a human.

For an identity-heavy SOC, that matters. Triaging an OIDC token replay or a suspicious SAML assertion isn't a summarization problem. It's an authorization problem dressed up as a detection one. Did the refresh token rotate per RFC 6749 §10.4? Did the IdP issue a new sid claim? Was step-up MFA enforced on the sensitive scope, or was the scope quietly inherited from a long-lived session?

A co-pilot that summarizes the alert without answering those questions has saved you nothing. You still page the on-call.

What the second wave has to deliver

Two things, honestly.

First, agentic action with scoped authz. The agent needs its own identity, its own least-privilege role, and an audit trail that survives a regulator's subpoena. If your AI SOC agent runs as a shared service principal with SecurityAdmin, you've built a beautiful lateral movement path. Treat the agent like any other workload identity: short-lived credentials, attested calls, per-action consent.

Second, ground truth. Models that reason over telemetry need deterministic anchors — directory state, session inventories, token issuance logs. Without that, the agent is improvising. With it, the agent can answer the question a human analyst actually asks: is this session legitimate right now?

The honest read

Would MFA have stopped most of the alerts these tools are triaging? In a lot of cases, yes. Phishing-resistant MFA and short refresh-token lifetimes would have closed the incident before the SOC saw it. The AI SOC is partly compensating for identity hygiene debt that nobody wants to pay down.

That's fine. Tools meet you where you are. But renewal conversations in Q2 will be ugly if the second wave ships another co-pilot and calls it agentic.

The budget is committed. The patience isn't.