The job description of security analysts has expanded massively in recent years. Between complex attack patterns, inconsistent IT infrastructures and an acute shortage of skilled labour, many companies are reaching their limits when it comes to cyber security. One key problem is that incidents need to be recognised, assessed and processed more quickly. However, many security operations centres (SOCs) lack the capacity to do this. Against this backdrop, more and more companies are turning to AI-based support to not only speed up their incident response, but also improve it structurally.
Challenges in the SOC: more complexity, fewer staff
In hybrid IT environments in which local systems (on-premise) and cloud solutions are operated in parallel, the number of potential gateways for attacks is growing rapidly. At the same time, qualified IT security specialists are currently hard to find. What is often lacking, in addition to sufficient personnel, is not only the technology, but also the time to utilise the existing systems effectively.
Where AI comes in: structured support instead of tool overload
How AI relieves security teams in complex cloud environments and provides structured support for decisions.
They help to triage incidents, especially in cloud environments, where data volumes and complexity are often higher.
Guided by structured response paths that are also specifically tailored to cloud security threats.
Provide contextualised recommendations (can also be individually trained using machine learning) that take into account the specific security requirements of cloud services.
Automate routine analysis and documentation tasks, which is particularly beneficial in dynamic cloud environments.
The effect: analysts can concentrate on what requires human expertise and thus gain time in critical moments. One example of this is Microsoft's Security Copilot, which is embedded as an assistance system in Microsoft Defender XDR and Sentinel, among others. It provides so-called "guided response" maps that cover the core steps of triage, containment, investigation and remediation. In addition, the tool automatically creates incident summaries and suggests suitable measures for handling the core steps. In triage, the co-pilot filters incoming reports, prioritises genuine threats and reduces false positives. In containment, it proposes immediate measures, such as isolating affected systems to prevent them from spreading. In the investigation phase, it provides context-related analyses, identifies correlations between incidents and provides support in determining the cause. Finally, in the remediation phase, it recommends and documents suitable measures for sustainable remediation, for example through patches or configuration changes.
Implementation with a sense of proportion: technology alone is not enough
However, it is also clear that the introduction of AI-supported systems does not automatically solve structural problems. What companies need is:
- Centralised access to relevant data sources, especially from the cloud, to enable comprehensive security analyses.
- The actual implementation of incident prioritisation.
- Sensible embedding in the existing security strategy, which includes both local systems (on-premise) and cloud environments.
Integration into existing workflows in particular requires a balance between automation and human control.
Conclusion
Today's security teams need more than just tools. Systemic relief, procedural clarity and intelligent support in real time are key. AI can be a key component in meeting these requirements. It is not a panacea, but it is an effective instrument for providing structural support in an increasingly overburdened security architecture that encompasses both on-premise and cloud environments.
However, it is crucial that systems such as Security Copilot do not replace analysts, but rather structure and accelerate their work - the technical control always remains with the human being. This allows analysts to focus even more on their work and ensure that companies are protected more efficiently.
More KPMG insights for you
Your contact
Alexander Geschonneck
Partner, Forensic, Global Head of Forensic
KPMG AG Wirtschaftsprüfungsgesellschaft