The Defensible AI-SOC: SOC Modernization for the Mythos Era | Corelight

I know, I know. AI-SOC, modernization, Mythos all in one headline, coming from the person that said they can't stand marketing buzzwords and hype? Hear me out. I still see a lot of initiatives around SOC Modernization floating around (hello, 2015 called and wants its trend back). What SOC leaders are really talking about is innovating across their infrastructure to incorporate AI's benefits, which makes sense. And Mythos-class models that are accelerating vulnerability exploitation at machine speed are increasing the urgency for this change. I get that.

When I think about incorporating AI across the SOC, particularly in response to urgent challenges like Mythos, I immediately worry about trust and transparency. Modern defense requires absolute certainty, not mystery verdicts. If I can't see the data, explain the detection, or evaluate the workflow steps, how can I defend the outcome?

I really like the notion of a "defensible" AI-SOC. If you want to build one that withstands compliance audits, real-world scrutiny, and can take on AI-adversaries, you need to think holistically about four things: the data that feeds your agents and models, transparent machine-speed detection, trusted agents, and explainable AI-assisted workflows. That is a lot to take on, but the path is actually pretty straightforward.

See: Invest in evidence to de-risk AI decision making

If you want to modernize your SOC, start by modernizing the data you use. Feeding generic firewall logs or noisy NetFlow aggregates into an LLM or multi-agent setup yields incomplete context and inaccurate verdicts. We tested this. In Capture the Flag benchmarks built around real Salt and Volt Typhoon scenarios, AI agents powered by frontier models like Claude 4.6 scored 95% accuracy on complex forensic questions when backed by Corelight network telemetry. Give those exact same agents firewall logs, and their performance drops below 50%. Give them NetFlow, and they stall out under 20%. The choice of model barely mattered. The data did.

Detect: Stop the exploit with auditable, machine-speed detection

You cannot patch your way out of modern attack speeds. Static signatures and IOC matching still have a role, but relying on them to detect zero-day exploits or algorithmic attacks won't cut it. When the next exploit lands faster than a patch cycle, you need to be ready to detect the intruder, and that requires AI/ML-powered detection. Corelight uses AI/ML to surface threats that signatures miss, and every verdict is backed by actual Zeek® log entries rather than confidence scores or behavioral summaries. The result is a complete evidence chain that analysts can inspect, detection engineers can write against, and regulators can audit. Because we all know: a detection you cannot explain is a detection you cannot defend. Corelight's latest detection package release doubles down on two of the most pressing challenges for SOCs:

• Shadow AI & AI risk exposure: Employees are piping enterprise data into unvetted tools right now. Corelight passively surfaces over 180 AI services on your wire, from commercial LLMs and coding assistants to proxy aggregators and foreign providers such as DeepSeek and Qwen. We not only show you the unapproved AI, but detect when usage deviates from your normal baseline, whether that’s an employee using a risky foreign AI, or accounting staff suddenly testing an unauthorized AI coding tool.
• Multi-stage intrusion coverage: You need detections that span the full attack path, from credential theft and lateral movement to quiet C2 beaconing and data exfiltration. Corelight’s latest detection package uses on-sensor machine learning to baseline normal behavior in your environment and flag what deviates: unusual outbound transfers, unexpected admin share access, and RDP connections that break the pattern. Activity across the entire intrusion lifecycle is correlated into a single auditable timeline, so your team sees the full story and not just a fragment.

Build: Grounded AI Agents

Today’s frontier LLMs are very cyber–capable, but capable is not deterministic. Feed an LLM open-ended prompts and raw logs, and there is no guarantee the same query will produce the same conclusion twice. That is not a foundation you can build auditable security operations on. To build agents you can trust, you need to make the AI output deterministic, grounding it with domain-specific skills and investigative logic that runs securely across cloud and hybrid environments, without sacrificing context or relying on external cloud APIs. To give AI agents actual investigative discipline, we built the Corelight Agent Builder Library. We packaged years of elite Zeek and forensic methodology into structured, machine-readable blueprints. Instead of loose LLM reasoning, these blueprints enforce strict, step-by-step logic pathways for triage, protocol pivoting, and behavioral analysis. These use the same investigation methodology that powers Corelight's own Agentic Triage, broken into modular building blocks that benefit L1 analysts, DIY agent builders, and even air-gapped environments:

• For L1 analysts: The Agent Builder Library lets you build agents that triage alerts the way a senior incident responder would. An agent investigating a DNS tunneling alert follows the same structured decision tree as a senior incident responder would: check query entropy, identify payload encoding patterns, pivot to the source host, and confirm the C2 channel. Your L1 analysts don’t need Zeek expertise to get expert-level results, and they can triage up to 10x faster.
• For teams building their own AI agents: The library provides domain-specific skills you can drop into Splunk, Elastic, or any platform that supports agentic automation. Without Corelight's playbooks, even a capable LLM won’t know what to check. It may miss steps, skip context, and reach the wrong conclusion. With them, your agents execute structured, expert-authored logic that covers the full investigative path, acting like a Corelight expert out of the box. The reasoning is inspectable. The results are auditable. When a regulator asks how your AI reached a conclusion, you can show the work.
• For air-gapped and classified environments: The Agent Builder Library is fully exportable. Teams operating in environments where cloud AI is prohibited can bring Corelight's investigation methodology directly into their approved on-premises AI systems, SOAR workflows, or analysts' hands. Same expertise, zero cloud dependency.

Investigate: With transparent, explainable workflows

Speed without trust is, well, just increased risk. Automated triage is supposed to eliminate manual burden, not create more work for analysts stuck double-checking opaque alerts. As Agent Lux, Corelight's multi-utility AI agent, I can tell you that when I execute an investigation, I operate on a few core principles:

1. Show the evidence chain: Lead with the finding, follow with the precise evidence, and end with the recommended move. No buried lede, no black-box scores.
2. Remove the barriers to investigation: No analyst should be blocked by query syntax. With Natural Language Query (NLQ), plain-English questions translate directly into functional LogScale Query Language (LQL) syntax, letting junior analysts run deep forensic queries on day one. The playbooks tell you what to look for. NLQ lets you find it.
3. Close the loop where analysts already work: Autonomous verdicts should not live in a separate portal. SIEM verdict export routes pre-investigated findings, complete with their full logical reasoning chain, straight into existing SIEM and ticketing workflows. Analysts validate and act. They do not reconstruct.

The Bottom line

SOC modernization today is not about upgrading old technology to the latest version or putting in more tools. And certainly it is not about replacing human defenders with "AI everywhere". Machine-speed attacks and skill shortages have changed what SOC modernization actually means. Today's analysts need to combine speed with trust. When regulators demand an audit trail under NIS2 or SEC disclosure rules, "the AI flagged it" isn't a defense. Don't settle for mystery verdicts. Build your AI-SOC on open data, transparent detections, and explainable workflows. That's how you stay defensible.