The world changed faster than the security operations center.
Frontier AI models can find vulnerabilities, develop exploits, combine weaknesses into attack paths, use tools, and pursue objectives across long sequences of action. Open-weight models are making those capabilities more accessible, and the OpenAI incident involving Hugging Face showed that a capable agent can cause serious harm without malicious intent. Attack discovery and execution are moving toward machine speed.
The SOC operating model wasn’t designed for this environment. Threat intelligence is consumed as reports and feeds. Hunting is episodic and constrained by human availability. Detection engineering works through backlogs while threat and environment changes weaken coverage. Investigations are limited by the activity analysts can reach and the context they can assemble. Remediation depends on manual coordination and predefined playbooks that are hard to maintain and break when tools, APIs, environments, or incidents change.
These weaknesses aren’t new. What’s new is that the time available to work around them is disappearing.
The threat model changed
Security operations were built around a few assumptions. Advanced exploitation required specialized expertise. Attackers needed time to research an environment, combine weaknesses, build tools, and move through an attack path. Defenders could use that time to detect the activity, investigate it, coordinate a response, and contain the damage. Those assumptions are weakening.
Advanced capability is becoming accessible. Frontier models are materially improving at vulnerability research, exploitation, and long-horizon cyber tasks. Closed frontier models carry provider safeguards. Open-weight models create a different risk, because they can be downloaded, run privately, modified, and stripped of those safeguards. The UK AI Security Institute found leading open-weight cyber models performing on par with closed models released only four to seven months earlier, and a joint UK and U.S. evaluation found that Kimi K3 could autonomously complete an attack against a small, vulnerable enterprise environment in testing. Advanced cyber capability won’t stay confined to a small number of guarded systems.
Attack paths can be created dynamically. An AI agent can reason across multiple weaknesses and use what it finds in the environment to select its next action. The resulting attack path may combine a minor misconfiguration, an exposed credential, an identity weakness, an accessible service, and a control gap that were never evaluated together, and it may not correspond to any single known exploit or detection.
And harm no longer requires malicious intent. An autonomous system can cause damage while pursuing an authorized or apparently harmless objective, using methods its operator never anticipated. It may not behave like a conventional adversary, and the person using it may not understand or intend the consequences. Cyber defense has to be prepared for capable action, not only malicious intent.
Why the current operating model falls behind
The problem isn’t that every SOC function is failing. The functions were designed, staffed, measured, and tooled for a slower environment.
Threat intelligence has to become operational. Its value depends on determining what an external development means for the organization, which means connecting that development to the technologies, identities, vulnerabilities, controls, telemetry, detections, active investigations, and business priorities it touches. When those relationships get evaluated manually across separate teams, attackers may operationalize the development before the defense adapts. Intelligence can’t stop at awareness. It has to immediately inform exposure assessment, hunting, detection engineering, investigation priorities, and remediation.
Threat hunting has to become continuous. It can’t stay a periodic project or a queue that moves only when analysts have time. It should test what the defense may be missing whenever intelligence changes, a detection gap appears, an investigation exposes uncertainty, a control or technology changes, new telemetry arrives, or unexplained behavior emerges, and it should return its findings to detections, investigations, telemetry, and remediation.
Detection engineering has to adapt to both the threat and the environment. The backlog-driven model assumes deployed detections stay effective until someone changes them. In reality, environment changes break detections constantly. Platforms and APIs update, log schemas and fields change, cloud services appear, identities and assets move. A detection that cannot see the required data is not coverage. A detection that once worked but hasn’t been validated against the current threat and environment is an assumption.
Investigations have to operate at greater depth and scale. The evidence that matters is scattered across SIEM, EDR, identity, cloud, email, network, and more. An endpoint event, an unusual identity action, a cloud configuration change, and a blocked connection can each look unimportant alone while together describing an attack path. If they stay in separate tools, that relationship may never become visible. The requirement isn’t faster triage. Investigations have to establish what happened, what else is affected, how the activity fits together, and what confidence the evidence supports, and that depth can’t depend entirely on how much people can manually reach.
Remediation has to adapt when playbooks fail. Predefined playbooks work when the trigger, tools, data, permissions, APIs, and sequence match the conditions anticipated when the workflow was written. Those conditions rarely hold. At enterprise scale, maintaining enough playbooks to cover a changing environment becomes impractical. Remediation has to use current investigation evidence, business impact, available controls, and authority to determine the right action, confirm it worked, find residual and similar exposure, and adapt when the first action doesn’t work. This doesn’t mean uncontrolled automation. Actions stay within explicit authority, deterministic guardrails, approval requirements, and rollback boundaries, and teams move bounded, reversible, well-validated actions to human-on-the-loop operation only after trust has been established.
A connected, adaptive cyber-defense fabric
Cyber defense doesn’t run from threat intelligence to hunting to detection to investigation to remediation in sequence. These functions operate simultaneously, informing and influencing one another as new evidence changes what the organization knows, what it can detect, and how it responds. The required shift is from a reactive, slow-moving SOC to a connected, adaptive cyber-defense fabric that makes that relationship operational across the security tools already in place.
That takes three things working together.
Shared institutional intelligence, so every function draws on the same continuously improving understanding of the infrastructure, identities, telemetry, detection logic, prior investigations, remediation history, and analyst corrections. A development flagged by intelligence immediately informs the relevant hunts, detection reviews, and remediation priorities. A hunt that finds no activity but exposes missing telemetry changes the confidence placed in dependent detections. A broken detection triggers a hunt for what may have been missed. The functions stay specialized, but their evidence moves in every direction.
Centrally managed, adaptive telemetry, because telemetry can’t be managed separately by individual tools and owners. Coverage, quality, freshness, cost, and health need one common view that adapts as threats, technologies, identities, and business processes change. A failed hunt, a silent detection, an incomplete investigation, and an unvalidated remediation may all point to the same telemetry problem, and the fabric has to recognize the common cause and fix it for every affected function.
AI with common control, governing the context, tools, and data each capability may use, the actions it may recommend or execute, the evidence and confidence it needs, the deterministic guardrails, the approval rules, the reasoning traces, and the validation and rollback. Human oversight stays essential for ambiguity, significant business impact, limited reversibility, and anything outside the approved operating envelope.
The measure that matters now
Faster operations and adaptation solve different but connected problems. Faster operations reduce the time to detect threats, investigate activity, contain incidents, and remediate exposure. Adaptation keeps those defenses effective as the threat landscape, environment, and observed behavior change. Traditional measures like investigation time and containment time stay useful, and they don’t reveal whether the defense recognized a change, understood its relevance, and adapted.
Time to adapt measures that missing interval. It’s the elapsed time between meaningful evidence of change reaching the defense and validated changes to the telemetry, coverage, analysis, or action affected by that change. The evidence may be new intelligence, an environmental change, abnormal behavior, a failed hunt, a broken detection, an incomplete investigation, a remediation failure, or an incident. Adaptation is complete once the affected defenses have been updated and validated, and if an incident exposed a preventable weakness, the learning has to reach prevention and remediation so the same gap isn’t left open. For a SOC or Cyber Defense Leader, that reframes the central question. How quickly can the defense act, learn, and adapt?
What changes for the SOC or Cyber Defense Leader
The SOC or Cyber Defense Leader stays accountable for people, coverage, investigations, response, tooling, quality, and cost. The new requirement is to manage those as one defense rather than separate production lines, and to focus the leadership view on evidence that the defense is effective and adapting. Time to adapt. Coverage confidence for the behaviors and attack paths that matter. Known blind spots and how long they stay open. Detection and telemetry health. Whether analyst corrections and incident findings improve future work across the defense.
The point is visibility into where the defense loses time, context, confidence, scale, or control. And this model should run across the SIEM, EDR, identity, cloud, and case-management investments already in place. Those systems stay valuable. Their boundaries just shouldn’t define the defense anymore.
The strongest SOC acts at machine speed while continuously learning and adapting as threats and the environment change.
Get the full picture
This is the short version of the argument. If you want the full picture, we’ve written a whitepaper that goes deeper: how each of the five functions changes, how shared intelligence, adaptive telemetry, and a common control plane fit together, the leadership measures that show whether the defense is adapting, and the questions to ask your own SOC.
Get access to the whitepaper, The Cyber Defense Adaptation Gap. Add your details below and we’ll email the PDF to you.
Frequently asked questions
What is the cyber defense adaptation gap?
It’s the widening distance between how fast threats now change and how fast a SOC can adapt its telemetry, detections, investigations, and response to match. The five functions still work. They were built, staffed, and tooled for a slower environment, and the time available to work around their limits is disappearing.
What is time to adapt in a SOC?
Time to adapt is the elapsed time between meaningful evidence of change reaching the defense and validated changes to the telemetry, coverage, analysis, or action affected by that change. Traditional measures like investigation time and containment time don’t show whether the defense recognized a change and adapted. Time to adapt does.
How is an adaptive SOC different from SOAR and playbook automation?
Predefined playbooks work when the trigger, tools, data, permissions, and sequence match the conditions they were written for, and they break when those conditions change or an incident departs from the scenario. Adaptive remediation uses current investigation evidence, business impact, available controls, and authority to decide the action, confirms it worked, and adapts when the first action doesn’t. Playbooks stay useful for narrow, repeatable, deterministic actions, inside explicit guardrails and human oversight.
How do you modernize a SOC for machine-speed threats?
Connect the five functions into one adaptive defense rather than running them as separate production lines. That takes shared institutional intelligence, so every function works from the same understanding of the environment, centrally managed telemetry that adapts as conditions change, and AI under a common control plane with explicit authority, guardrails, and human oversight.