Shorter alert triage for your SOC, timed ticket by ticket
Over 30 days, we time every alert in one SOC workflow before and after AI, inside your own cloud. Your analysts make every triage decision. Before you sign, we state the analyst hours that would repay our fee within 18 weeks. If the test saves fewer, we advise you to stop.
IBM's 2026 study of 602 breached organisations found the average breach took 247 days to identify and contain [1]. Organisations using security AI and automation extensively resolved breaches 65 days faster than others [2]. Against organisations using none, they saved $1.93 million per breach on average [3]. IBM sells security AI, so these are vendor-reported associations.
Breaches are too rare to price in 30 days, and a benign alert has no containment step. So we time every alert in one workflow from first flag to triage decision, before and after AI. This elapsed time is a proxy with no money value. We agree the minimum alert count with you before day 1. The stop rule uses priced analyst hours.
Sources
- Alexander F. Koskey, 'Ten Takeaways from IBM's 2026 Cost of a Data Breach Report', Baker Donelson, 30 July 2026 <https://www.bakerdonelson.com/ten-takeaways-from-ibms-2026-cost-of-a-data-breach-report> [accessed 31 October 2026]
- Matthew Kosinski, 'What Is a Data Breach?', IBM Think, n.d. <https://www.ibm.com/think/topics/data-breach> [accessed 31 October 2026]
- IBM, 'Cost of a Data Breach Report 2026', IBM, n.d. <https://www.ibm.com/reports/data-breach> [accessed 31 October 2026]
In a 2026 NDSS workshop paper, two researchers who built an AI agent triaged eight university SOC tickets with and without it [1]. The authors report about 40% less time; their Table I gives 36%. Tickets worked by hand first were 56% faster on the AI pass. Those worked with AI first were 4% faster, so familiarity inflates the gain [1].
A 2025 study randomly assigned 148 participants with varying SOC experience [2]. AI-assisted investigations were 45% and 61% faster in two scenarios. The Cloud Security Alliance ran it with support from Dropzone AI, whose product was tested, so these are vendor-reported. We have not found a 2026 trial of that size. Before you sign, we state our fee and the analyst hours that would repay it within 18 weeks.
Sources
- Kritan Banstola, Faayed Al Faisal and Xinming Ou, 'Experiences of Using Agentic AI to Fill Tooling Gaps in a Security Operations Center', in Workshop on Security Operation Center Operations and Construction (WOSOC) 2026 (San Diego, CA: NDSS Symposium, 2026), pp. 1–7 (pp. 4–6), doi:10.14722/wosoc.2026.23016 <https://www.ndss-symposium.org/wp-content/uploads/wosoc26-02.pdf> [accessed 31 October 2026]
- Cloud Security Alliance, 'New Study from Cloud Security Alliance Finds AI Improves Analyst Accuracy, Speed, and Consistency in Security Investigations', Cloud Security Alliance, 7 October 2025 <https://cloudsecurityalliance.org/press-releases/2025/10/07/new-csa-study-finds-ai-improves-analyst-accuracy-speed-and-consistency-in-security-investigations> [accessed 31 October 2026]
Incidents involving shadow AI, meaning staff use of unapproved AI tools, cost $5.39 million on average in IBM's 2026 breach study [1]. Baker Donelson's summary sets this against $4.63 million for a group it does not name. More than one in five organisations involved also reported paying a regulatory fine [1]. All are vendor-reported.
These averages come from breached firms only, so we cannot turn them into a cost or a saving for yours. Our governance work lists the AI tools your proxy and identity logs show in use. Each tool gets a named owner and an access rule your auditors can test. Your board then decides which tools to approve and which to block. Buy this only if your auditors or regulator expect you to show that list.
Sources
- Alexander F. Koskey, 'Ten Takeaways from IBM's 2026 Cost of a Data Breach Report', Baker Donelson, 30 July 2026 <https://www.bakerdonelson.com/ten-takeaways-from-ibms-2026-cost-of-a-data-breach-report> [accessed 31 October 2026]
In IBM's 2026 breach study, roughly one in five organisations reported an attack on AI models or applications [1]. Of those, 92% lacked proper AI access controls. Only 40% of the sample controlled access to AI models and data [1]. All are vendor-reported. We list each of your models with who can query it, and flag those trained on personal data.
The EDPB found in December 2024 that models trained on personal data are not always anonymous, so the GDPR can apply to them [2]. Its July 2026 draft guidelines add that prompting a model into a meaningful inference about a person fails one anonymity test [3]. The 2016 GDPR caps fines for breaching its processing principles at €20 million or 4% of worldwide annual turnover, whichever is higher [4].
Sources
- Limor Kessem, 'AI-Powered Adversaries and the Enterprise Risk Challenge: Preparing for the New Reality', IBM Think (X-Force), 29 July 2026 <https://www.ibm.com/think/x-force/2026-cost-of-a-data-breach-ai-adversaries-enterprise-risk> [accessed 31 October 2026]
- European Data Protection Board, Opinion 28/2024 on Certain Data Protection Aspects Related to the Processing of Personal Data in the Context of AI Models (Brussels: EDPB, 2024), pp. 13–14, paras 27, 29, 34 <https://www.edpb.europa.eu/system/files/2024-12/edpb_opinion_202428_ai-models_en.pdf> [accessed 31 October 2026]
- European Data Protection Board, Guidelines 02/2026 on Anonymisation, version 1.0 (Brussels: EDPB, 2026), p. 25, para. 82 <https://www.edpb.europa.eu/system/files/2026-09/edpb_guidelines_202602_anonymisation_v1_en_0.pdf> [accessed 31 October 2026]
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), OJ L 119, 4 May 2016, pp. 1–88, art. 83(5) <https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng> [accessed 31 October 2026]
EU financial firms reported 3,383 major ICT incidents in 2025, DORA's first reporting year [1]. That averages 0.18 per firm, or one every five to six years. An initial notice is due four hours after an incident is classed as major, and within 24 hours of the firm learning of it. An intermediate report follows within 72 hours, then a final report within a month of that [1].
Almost one third began with a third-party failure, so some evidence sits in suppliers' logs [1]. We map each deadline to the logs and tickets holding its evidence. AI may draft from those records with citations, and your named officer signs. No source we found measures drafting time saved. Unless you file several major reports a year, we advise against this work.
Sources
- European Supervisory Authorities (EBA, EIOPA and ESMA), 2025 Report on Major ICT-related Incidents: Joint-ESA Report under Article 22 of DORA, JC 2026 16 (Paris: European Banking Authority, 2026), pp. 4, 6–7, 15 <https://eba.europa.eu/sites/default/files/2026-06/29b60c21-4ff3-4e1e-9308-7c8225d5cc01/ESAs%202025%20report%20on%20major%20ICT-related%20incidents.pdf> [accessed 31 October 2026]
Shorter alert triage for your SOC, timed ticket by ticket
Over 30 days, we time every alert in one SOC workflow before and after AI, inside your own cloud. Your analysts make every triage decision. Before you sign, we state the analyst hours that would repay our fee within 18 weeks. If the test saves fewer, we advise you to stop.
Ghayda Nassar
Principal AI Consultant, Cybersecurity & AI SafetyIBM's 2026 study of 602 breached organisations found the average breach took 247 days to identify and contain [1]. Organisations using security AI and automation extensively resolved breaches 65 days faster than others [2]. Against organisations using none, they saved $1.93 million per breach on average [3]. IBM sells security AI, so these are vendor-reported associations.
Breaches are too rare to price in 30 days, and a benign alert has no containment step. So we time every alert in one workflow from first flag to triage decision, before and after AI. This elapsed time is a proxy with no money value. We agree the minimum alert count with you before day 1. The stop rule uses priced analyst hours.
Sources
- Alexander F. Koskey, 'Ten Takeaways from IBM's 2026 Cost of a Data Breach Report', Baker Donelson, 30 July 2026 <https://www.bakerdonelson.com/ten-takeaways-from-ibms-2026-cost-of-a-data-breach-report> [accessed 31 October 2026]
- Matthew Kosinski, 'What Is a Data Breach?', IBM Think, n.d. <https://www.ibm.com/think/topics/data-breach> [accessed 31 October 2026]
- IBM, 'Cost of a Data Breach Report 2026', IBM, n.d. <https://www.ibm.com/reports/data-breach> [accessed 31 October 2026]
In a 2026 NDSS workshop paper, two researchers who built an AI agent triaged eight university SOC tickets with and without it [1]. The authors report about 40% less time; their Table I gives 36%. Tickets worked by hand first were 56% faster on the AI pass. Those worked with AI first were 4% faster, so familiarity inflates the gain [1].
A 2025 study randomly assigned 148 participants with varying SOC experience [2]. AI-assisted investigations were 45% and 61% faster in two scenarios. The Cloud Security Alliance ran it with support from Dropzone AI, whose product was tested, so these are vendor-reported. We have not found a 2026 trial of that size. Before you sign, we state our fee and the analyst hours that would repay it within 18 weeks.
Sources
- Kritan Banstola, Faayed Al Faisal and Xinming Ou, 'Experiences of Using Agentic AI to Fill Tooling Gaps in a Security Operations Center', in Workshop on Security Operation Center Operations and Construction (WOSOC) 2026 (San Diego, CA: NDSS Symposium, 2026), pp. 1–7 (pp. 4–6), doi:10.14722/wosoc.2026.23016 <https://www.ndss-symposium.org/wp-content/uploads/wosoc26-02.pdf> [accessed 31 October 2026]
- Cloud Security Alliance, 'New Study from Cloud Security Alliance Finds AI Improves Analyst Accuracy, Speed, and Consistency in Security Investigations', Cloud Security Alliance, 7 October 2025 <https://cloudsecurityalliance.org/press-releases/2025/10/07/new-csa-study-finds-ai-improves-analyst-accuracy-speed-and-consistency-in-security-investigations> [accessed 31 October 2026]
Incidents involving shadow AI, meaning staff use of unapproved AI tools, cost $5.39 million on average in IBM's 2026 breach study [1]. Baker Donelson's summary sets this against $4.63 million for a group it does not name. More than one in five organisations involved also reported paying a regulatory fine [1]. All are vendor-reported.
These averages come from breached firms only, so we cannot turn them into a cost or a saving for yours. Our governance work lists the AI tools your proxy and identity logs show in use. Each tool gets a named owner and an access rule your auditors can test. Your board then decides which tools to approve and which to block. Buy this only if your auditors or regulator expect you to show that list.
Sources
- Alexander F. Koskey, 'Ten Takeaways from IBM's 2026 Cost of a Data Breach Report', Baker Donelson, 30 July 2026 <https://www.bakerdonelson.com/ten-takeaways-from-ibms-2026-cost-of-a-data-breach-report> [accessed 31 October 2026]
In IBM's 2026 breach study, roughly one in five organisations reported an attack on AI models or applications [1]. Of those, 92% lacked proper AI access controls. Only 40% of the sample controlled access to AI models and data [1]. All are vendor-reported. We list each of your models with who can query it, and flag those trained on personal data.
The EDPB found in December 2024 that models trained on personal data are not always anonymous, so the GDPR can apply to them [2]. Its July 2026 draft guidelines add that prompting a model into a meaningful inference about a person fails one anonymity test [3]. The 2016 GDPR caps fines for breaching its processing principles at €20 million or 4% of worldwide annual turnover, whichever is higher [4].
Sources
- Limor Kessem, 'AI-Powered Adversaries and the Enterprise Risk Challenge: Preparing for the New Reality', IBM Think (X-Force), 29 July 2026 <https://www.ibm.com/think/x-force/2026-cost-of-a-data-breach-ai-adversaries-enterprise-risk> [accessed 31 October 2026]
- European Data Protection Board, Opinion 28/2024 on Certain Data Protection Aspects Related to the Processing of Personal Data in the Context of AI Models (Brussels: EDPB, 2024), pp. 13–14, paras 27, 29, 34 <https://www.edpb.europa.eu/system/files/2024-12/edpb_opinion_202428_ai-models_en.pdf> [accessed 31 October 2026]
- European Data Protection Board, Guidelines 02/2026 on Anonymisation, version 1.0 (Brussels: EDPB, 2026), p. 25, para. 82 <https://www.edpb.europa.eu/system/files/2026-09/edpb_guidelines_202602_anonymisation_v1_en_0.pdf> [accessed 31 October 2026]
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), OJ L 119, 4 May 2016, pp. 1–88, art. 83(5) <https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng> [accessed 31 October 2026]
EU financial firms reported 3,383 major ICT incidents in 2025, DORA's first reporting year [1]. That averages 0.18 per firm, or one every five to six years. An initial notice is due four hours after an incident is classed as major, and within 24 hours of the firm learning of it. An intermediate report follows within 72 hours, then a final report within a month of that [1].
Almost one third began with a third-party failure, so some evidence sits in suppliers' logs [1]. We map each deadline to the logs and tickets holding its evidence. AI may draft from those records with citations, and your named officer signs. No source we found measures drafting time saved. Unless you file several major reports a year, we advise against this work.
Sources
- European Supervisory Authorities (EBA, EIOPA and ESMA), 2025 Report on Major ICT-related Incidents: Joint-ESA Report under Article 22 of DORA, JC 2026 16 (Paris: European Banking Authority, 2026), pp. 4, 6–7, 15 <https://eba.europa.eu/sites/default/files/2026-06/29b60c21-4ff3-4e1e-9308-7c8225d5cc01/ESAs%202025%20report%20on%20major%20ICT-related%20incidents.pdf> [accessed 31 October 2026]