At machine speed: why SOC capacity is becoming the new bottleneck
Several cybersecurity studies published in 2025–2026 describe different parts of the same problem. Mandiant focuses on real intrusions, Verizon on breach patterns at scale, IBM on financial impact, while IANS and Artico Search examine the budgets and staffing available to security leaders.
Viewed together, the picture is more important than any single statistic: attackers are gaining speed and scale faster than security teams are gaining capacity. Because the 2026 reports largely analyze 2025 incidents, the IANS 2025–2026 benchmark describes the environment in which defenders face these threats.
The attack window is getting smaller
Mandiant’s M-Trends 2026 shows how quickly apparently isolated events can escalate. In some incidents, one threat actor establishes access and hands it to another actor in under 30 seconds. A signal that initially looks low priority can therefore become the starting point of ransomware or another high-impact operation almost immediately.
At the same time, the fundamentals remain under pressure. Mandiant found exploits to be the leading initial infection vector for the sixth consecutive year, accounting for 32% of cases where the entry point was known. Verizon reports a similar trend: vulnerability exploitation has become the most common initial access vector in its dataset, reaching 31%.
The challenge is not only finding vulnerabilities, but closing them fast enough. Verizon found that:
- only 26% of critical CISA KEV vulnerabilities were fully remediated;
- median time to full remediation increased to 43 days;
- organizations faced roughly 50% more critical vulnerabilities to patch than a year earlier.
The gap between attacker speed and remediation time is difficult to ignore.
AI is accelerating the offensive side
Both Verizon and Mandiant describe AI primarily as a force multiplier. Threat actors are using generative AI for targeting, social engineering, vulnerability research, malware development and other stages of the attack lifecycle.
IBM goes further and quantifies the impact. Its 2026 Cost of a Data Breach Report found that AI-driven attacks increased by 56% year over year and added an average of USD 1 million to the cost of a malicious breach. The global average cost of a data breach reached USD 4.99 million, up 12%.
This does not mean every successful attack is suddenly “AI-native.” Mandiant explicitly notes that most successful intrusions still originate in familiar weaknesses:
- exploitable systems,
- stolen credentials,
- social engineering,
- third-party access
- and failures in basic controls.
What AI changes is the tempo. The same techniques can now be researched, adapted, launched and scaled faster.
The defensive side cannot simply hire its way out
Here, the IANS and Artico Search benchmark is particularly relevant. Security budget growth slowed to an average of just 4% in 2025, the lowest level in five years. Only 45% of CISOs were able to add headcount, while 47% kept team size flat.
Only 11% of CISOs said their security organizations were adequately staffed.
This creates a structural problem for SOCs. Alert volumes, attack paths and available telemetry continue to expand, while analyst capacity does not. Adding more dashboards or generating more alerts does not solve that imbalance.
The question is shifting from “How do we automate more tasks?” to “How do we reduce the amount of human investigation required before a good decision can be made?”
Automation is useful. Investigation intelligence is the next step.
Traditional automation is highly effective when a process is predictable: collect an indicator, enrich an IP address, open a ticket, isolate a host. But modern incidents often require something harder—connecting weak signals across users, hosts, identities, network activity, threat intelligence and historical events.
IBM’s data supports the value of moving in this direction. Organizations making extensive use of AI and automation in security shortened breach lifecycles by 65 days and reduced average breach costs by USD 1.93 million. Yet only 36% reported extensive use across prevention, detection, investigation and response.
The next phase of SOC development is not automation for automation’s sake. It is machine-speed context building with human-controlled decisions.
Where PULZARIS Analyst AI fits?
This is also the problem we are addressing with PULZARIS Analyst AI. Rather than replacing the human analysts, it is designed to take over repetitive, evidence-heavy parts of incident investigation.
PULZARIS can:
- triage and analyze incoming security alerts;
- map relevant users, hosts and systems;
- enrich investigations with internal and external threat intelligence;
- evaluate risk and business impact;
- produce analyst-ready findings and recommended next actions.
The objective is not to remove human judgement. PULZARIS is built around a human-in-the-loop model: the AI performs the heavy investigative work, while analysts validate, escalate and make the final call.
If attackers increasingly operate at machine speed while SOC teams remain constrained by human capacity, the answer cannot be to generate even more information for analysts to process manually.
The advantage will come from turning alerts into decision-ready intelligence fast enough for humans to stay in control.
