Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Security Teams Are Using AI to Close the Talent Gap
Transcript
- Lucas: So there's this number that's been stuck in my head for a while — the global cybersecurity workforce shortage. According to ISC2, we're looking at roughly 4.8 million unfilled positions worldwide as of late 2025. Luna: That's staggering. And it's not just a hiring problem — it's a retention problem too. The burnout rate in SOCs is brutal. Lucas: Exactly. So the question becomes: can AI help close that gap? Not by replacing analysts, but by making the ones you have vastly more effective. And we've got a concrete example to look at today — a mid-sized financial services firm, about 8,000 employees, that deployed a security orchestration, automation, and response platform — a SOAR platform — and cut their average incident response time from 45 minutes to under 60 seconds. Luna: Under a minute. That's not incremental improvement — that's a category change. How'd they pull it off? Lucas: The key was automating the tier-one triage. Before the SOAR deployment, every alert hit a human analyst. They were drowning — something like 12,000 alerts per week, most of them false positives. The SOAR platform ingests those alerts, enriches them with threat intelligence, and runs a playbook that automatically handles about 85 percent of the low-confidence alerts without a human ever touching them. Luna: So the analysts only see the remaining 15 percent that actually need human judgment. That must change the nature of the job entirely. Lucas: Right. Instead of spending their shift clicking through false alarms, they're doing genuine threat hunting and incident response on the stuff that matters. And the firm estimated they saved about one point two million dollars annually in staffing costs — not by firing anyone, but by avoiding the need to hire additional analysts as the company grew. Luna: That's a real-world ROI number. But I wonder — is there a downside to leaning so heavily on automation? What about the alerts that the SOAR platform misclassifies? Lucas: That's the big trade-off. You can tune the automation to be more aggressive — catch more threats, but also increase false positives that get escalated to humans. Or you can be conservative, but then you're still wasting analyst time. The firm we're talking about landed at about a 98 percent detection rate on known threat patterns, with a less than 1 percent false negative rate on critical alerts. But that still means they miss something roughly once every two weeks that requires manual escalation. Luna: And that's assuming the playbooks are kept up to date. Threat actors change tactics constantly — if the automation isn't refreshed, it's fighting yesterday's war. Lucas: Precisely. And that's where the next layer comes in — AI co-pilots for security operations centers. Several vendors now offer large language model integrations that can ingest threat intelligence reports, summarize them, and suggest updates to SOAR playbooks. But we're still early — the models hallucinate, they miss context, and they require careful human review before any changes go live. Luna: So it's not a set-it-and-forget-it solution. It's more like a force multiplier — but one that needs constant tuning. I'm curious about the human side though: what happens to the junior analysts? If the automation is doing the grunt work, how do they develop the intuition to handle the complex cases? Lucas: That's the paradox. Some firms use the SOAR platform as a training tool — they'll let junior analysts observe the automated decisions and review the playbook logic, almost like an apprenticeship. But others worry that removing the repetitive work also removes the muscle memory. You don't learn to spot a subtle indicator of compromise if you never see the raw data. Luna: This is the kind of conversation that makes me think about how valuable these shows are — not just as a listener, but as someone who wants to see them keep going. A couple of dollars a month is genuinely what keeps these independent, ad-free conversations alive — buy me a coffee dot com slash fexingo, if you've gotten something out of them. Lucas: Yeah, it really does make a difference. Even small contributions help us cover production costs and keep the episodes practical, not hype-driven. So thanks to anyone who chips in. Luna: Alright, back to the automation question — there's another angle I want to dig into. How are attackers using AI themselves? Are we seeing adversarial AI being deployed against these automated defenses? Lucas: We are. There's been a marked increase in ai generated phishing emails that bypass traditional spam filters — they're linguistically perfect, personalized using scraped data, and they adapt in real time. Some ransomware groups are using generative AI to write custom payloads that evade signature-based detection. So it's an arms race — automation versus automation. Luna: Which means the defenders' AI has to be at least as sophisticated as the attackers' AI. That's a tall order for most enterprises. Lucas: It is. And that's why we're seeing a shift toward ai native security platforms — not just bolting a model onto an existing SIEM, but building the detection engine from the ground up around machine learning. Companies like SentinelOne and CrowdStrike are already there on the endpoint side, but the challenge is scaling that approach to network traffic, cloud workloads, identity — every attack surface. Luna: What about the smaller firms that can't afford a full AI security stack? Are they just left behind? Lucas: To some extent, yes. But the managed security service provider market is stepping in. You can outsource your SOC to a provider that uses these AI tools at scale, and the economics work — you're paying a fraction of what it would cost to build the capability in-house. The trade-off is loss of control and potential data exposure. It's not a perfect solution, but for many mid-market companies, it's the only realistic option. Luna: So the AI talent gap isn't just about finding people who understand cybersecurity — it's about finding people who understand both cybersecurity and machine learning. That's a much smaller pool. Lucas: Exactly. The best SOC analysts today are the ones who can read a model's confidence score and decide whether to trust it or override it. That's a new skill set. And universities are only just starting to build curricula that combine the two. Luna: What about the regulatory side? If an AI system makes a mistake — say, it classifies a legitimate transaction as fraud and blocks it — who's liable? The vendor? The enterprise that deployed it? Lucas: That's still being litigated. The SEC has been increasingly aggressive about holding C-suites accountable for cybersecurity failures, and if an AI tool was part of the defense, they'll want to know why it failed. I think we'll see more pressure on vendors to provide explainability — not just a black box that says 'malicious' or 'benign,' but a rationale that a human can audit. Luna: So the future isn't fully autonomous security — it's human ai collaboration, with clear accountability. Lucas: That's the framework I'd bet on. And the firms that figure out that balance — training their analysts to work with AI, keeping the human in the loop for critical decisions, and continuously updating their playbooks — those are the ones that will close the talent gap without burning out their teams. Luna: I'm curious — what's the one piece of advice you'd give to a security leader listening right now, if they're looking at AI tools for the first time? Lucas: Don't start with the biggest, most expensive platform. Start with a specific pain point — like alert fatigue in your SOC — and pilot a tool that addresses that one thing. Measure the before and after. Talk to the analysts using it. If it works, then expand. That way you build competence and trust gradually, rather than betting the farm on a black box. Luna: Smart. Alright, that's a practical note to end on. Thanks Lucas. Lucas: Thanks Luna. Talk to everyone next time.