SOC practitioners ask: AI security tools keep adding queues, not answers

RileyNet44 · reddit · 2026-11-13

A Reddit post by a security practitioner pushes back on the wave of AI security products: every demo ends with "here's the dashboard," and agents in production now generate findings across agent posture, prompt risk, tool risk, identity risk, and runtime risk — without telling the SOC what to actually do differently tomorrow afternoon (block, investigate, revoke, or hand auditors useful evidence).

The author gives credit to Acalvio's deception-based approach: instead of scoring whether an agent "looks suspicious," touching a fake credential/tool/resource outside the normal workflow becomes the signal — a narrower problem with fewer philosophical debates.

The post asks the community: what must an AI security product actually do before it's worth giving the SOC another queue to own?

Original post →

SOC practitioners ask: AI security tools keep adding queues, not answers

More from coding & agent