Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Security Teams Are Using GenAI for Automated Incident Response
Transcript
- Lucas: So there's this moment in every security incident where the first responder — usually a tier-one analyst — has to figure out what actually happened, and then decide what to do next. For a phishing alert, that typically means checking the email headers, verifying the URL, looking up the sender's reputation, and then either blocking or escalating. Luna: Right, and that's a lot of clicking across different consoles. For a junior analyst, it can take ten, fifteen minutes just to gather the context. Lucas: Exactly. And in that window, the attacker might already be moving laterally. So a growing number of security teams are now using generative AI not just to summarize threat intel, but to actually execute those first-response actions automatically. We're talking about an LLM wired directly into a SOAR platform — Security Orchestration, Automation, and Response — that reads the alert, queries the relevant tools, and either takes action or drafts a recommendation. Luna: I've seen this called 'co-pilot for the SOC.' Some vendors are shipping it as a feature. But I'm curious — how many teams are actually using it in production, not just in a demo? Lucas: Good question. Adoption is still early, but it's accelerating. I spoke with the CISO of a mid-market retailer — about 2,000 employees — who rolled out an llm powered incident response module in March of this year. Their SOAR vendor offered it as a beta. They activated it for phishing alerts only. Within two months, their mean time to respond dropped from eighteen minutes to under four minutes. Luna: Eighteen to four — that's a huge jump. What changed in the workflow? Lucas: So before, an analyst would get the alert, then manually pivot to their email security gateway, then to their directory service, then to their endpoint detection tool. With the LLM integration, the SOAR platform ingests the alert, generates a query for each of those tools in natural language, parses the results, and presents a summary — all within about sixty seconds. The analyst just reviews and approves or overrides. Luna: And the LLM doesn't just summarize — it also suggests a response, right? Like 'block the sender' or 'quarantine the endpoint'? Lucas: Exactly. The model is given a set of predefined playbooks and it maps the alert to the most relevant one. For a straightforward phishing link, it might recommend blocking the domain and resetting the user's password. The analyst can click 'execute' or modify it. The CISO told me they saw an approval rate of about 85 percent — meaning the model's suggestion was accepted without changes. Luna: That's pretty high. But I wonder about the 15 percent — what was the model getting wrong? Lucas: Mostly two things: false positives and incomplete context. Sometimes the model would flag a benign internal newsletter as phishing because the subject line matched a known pattern. Other times it would miss that a user had already reported the email, so the suggested action was redundant. The team had to add a check for existing tickets to avoid that. Luna: So the LLM isn't just dropped in — you need to tune it, add guardrails, handle the edge cases. That sounds like a non-trivial engineering effort. Lucas: It is. But the CISO made the point that the effort is front-loaded. Once you've built the connectors and validated the model's output on historical data, the ongoing maintenance is manageable. They monitor the model's recommendations daily, and they have a feedback loop where analysts rate each suggestion. That data is fed back to fine-tune the model. Luna: I've also heard concerns about prompt injection — where an attacker crafts an email that manipulates the LLM into executing a harmful action. Is that a real risk here? Lucas: It's a very real risk. In fact, there was a proof of concept published earlier this year where researchers showed they could hide instructions in an email signature that caused the LLM to ignore the intended playbook and instead execute a system command. That's the kind of thing that keeps CISOs up at night. Luna: So how do you protect against that? You can't just strip all formatting from emails — you'd lose legitimate content. Lucas: Right. The approach this CISO's team took was to isolate the LLM's input. They parse the email and only feed specific fields — the sender, the subject, the body text — into the model, stripped of any markup. They also require human approval for any action that involves credential changes or system-level commands. The model can only auto-execute low-risk actions like updating a ticket or adding a URL to a blocklist. Luna: So tiered autonomy. Low-risk actions are automated, high-risk ones still need a human click. That makes sense. Lucas: Exactly. And that's the pattern I'm seeing across multiple vendors. The LLM acts as a triage assistant — it handles the grunt work of data gathering and pattern matching, but the analyst stays in the loop for decisions that carry significant blast radius. Luna: What about hallucinations? If the model fabricates a log entry or misinterprets a timestamp, that could send the team down the wrong path. Lucas: That's a real concern. In the vendor's documentation, they actually recommend synthetic monitoring — sending known benign and known malicious alerts through the system periodically to verify the model's output. The CISO's team runs that every four hours. If the hallucination rate exceeds one percent, they pause automation until they can retrain. Luna: That's a pretty low tolerance. But I suppose with automated response, even a small error rate can compound fast if you're handling thousands of alerts a day. Lucas: Exactly. And that brings up a broader point: the teams that are having success with this aren't the ones with the most sophisticated AI — they're the ones with the cleanest data and the most well-defined playbooks. The LLM is only as good as the workflows it's plugged into. Luna: So it's less about the model and more about the operational maturity. If your incident response process is already a mess, adding AI just makes it a faster mess. Lucas: Perfectly put. One security architect told me he sees LLMs as a forcing function for better documentation. You can't automate a process you haven't written down. Luna: I want to talk about the vendor landscape for a moment. Who's actually shipping this? Is it the big SOAR players, or are there startups? Lucas: Both. The major SOAR platforms — Splunk, Palo Alto, IBM — all have some form of genAI assistant in beta or general availability. But there are also startups like Resolver AI and Truffle Security that are building llm native incident response tools from scratch. The difference is that the incumbents are wrapping AI around existing workflows, while the startups are rethinking the workflow entirely. Luna: Can you give an example of that rethink? Lucas: Sure. One startup I looked at doesn't use playbooks at all. Instead, the LLM is given the organization's security policies and past incident reports, and it generates a response plan on the fly based on the specific alert. The idea is that no two incidents are exactly alike, so a rigid playbook might miss nuance. Luna: That's interesting, but also risky — you're trusting the model to reason correctly without a predefined structure. How do you audit that? Lucas: That's the open question. The startup argues that you can still log every decision and have a human review later. But for a CISO, that might not be enough if something goes wrong. I think we'll see a middle ground emerge — playbooks as templates, with the LLM allowed to adapt within certain parameters. Luna: Let's talk about cost. Running a large language model for every incoming alert — that adds up, doesn't it? Lucas: It does. The CISO I mentioned said their monthly compute cost for the LLM integration was about $3,000 — that's for processing roughly 10,000 alerts per month. Compared to the salary of an additional analyst, it's cheap. But if you're a smaller team, $3,000 a month is real money. Some vendors are offering on-premise models to reduce cost, but then you have to manage the infrastructure. Luna: And what about data residency? If your security data goes to a cloud LLM, that might be a compliance issue for some industries. Lucas: That's a big blocker for financial services and healthcare. A lot of banks are requiring that the model runs on their own infrastructure. One vendor I spoke with said they're seeing demand for on-prem deployments specifically so that data never leaves the customer's VPC. Luna: So there's a spectrum: fully cloud, hybrid, fully on-prem. And that's probably going to shake out by industry and by risk appetite. Lucas: Exactly. And I think that's healthy. It means teams are thinking carefully about where AI adds value and where it introduces risk, rather than just adopting it because it's trending. Luna: Before we wrap, let's step back. You've been talking to practitioners. What's the one piece of advice they'd give to a team considering this? Lucas: Start small. Pick one alert type — ideally one you see frequently and that has clear, low-risk response actions. Phishing is the obvious starting point. Automate that, validate the output for a month, and only then expand to other use cases. And make sure your existing data pipeline is solid. If your logs are incomplete or inconsistent, the LLM will amplify those problems. Luna: Solid advice. And it's worth noting that a lot of this technology is still in its first or second generation. We're going to see rapid iteration. Lucas: Absolutely. But even with the current state, the efficiency gains are real. The teams that are doing it right are freeing up their analysts to focus on the complex threats — the ones that require human judgment — instead of drowning in the noise. And that's ultimately the goal, right? Luna: Yeah. If these conversations are useful for what you're building or running, a couple of dollars a month is genuinely what keeps these going — buy me a coffee dot com slash fexingo, if you've gotten something out of them. Lucas: It makes a real difference. And on that note — I think the next twelve months are going to be fascinating. We'll see whether the early adopters pull ahead, and whether the incumbents or the startups win the architecture debate. Luna: I'll be watching. For now, if you're in security operations, the message is clear: generative AI isn't a futuristic idea anymore — it's a tool you can deploy today, if you do it carefully. Lucas: Exactly. Thanks for listening, and we'll see you next time.