Every security operations centre knows the arithmetic: more alerts every month, and not enough analysts to look at each of them properly. Together with DataExpert B.V. and Safesqr, Active Audit Agency is testing a way to change it: an AI analyst that investigates alerts from start to finish and leaves the final decision to a person.

Where AI in the SOC usually gets stuck

AI can already investigate alerts. The hard part is making it work in a real environment. Each organisation runs its own combination of SIEM, EDR, directory and ticketing tools, so connecting an AI analyst turns into a separate engineering project. For most organisations, that is where the business case ends.

What the pilots test

We are running three AI-SOC pilots with Ukrainian organisations that provide services of national importance. In each of them, a Digital SOC Employee:

• investigates SIEM and EDR alerts end to end;

• prepares a confidence-scored package with its findings;

• hands it to a human analyst, who makes the call.

Why the decision stays with a person

Judgement and accountability stay with people. The AI takes on the routine part of the investigation, and analysts spend their time where experience matters most. We follow the same principle in our own Digital Employee work.

Backed by the Netherlands-Ukraine Cybersecurity Fund

The pilots are supported by a grant from the Netherlands Enterprise Agency (RVO) under the Netherlands-Ukraine Cybersecurity Fund 2026. We are grateful to RVO for supporting Ukrainian cyber resilience, and to our Dutch partners for building this together with us.

About our partners

DataExpert B.V. is a Dutch company working in digital forensics, analytics, OSINT and cybersecurity. It provides software, training, investigations, consultancy and 24/7 incident response.

Safesqr is a European cybersecurity company. It advises on, designs and implements solutions for detection and response, governance, risk and compliance, and identity management.

Learn more

DataExpert and Safesqr share the details in their article Real life insights from putting an AI employee into a SOC, where you can also download the whitepaper.

Want to discuss how an AI analyst could work in your SOC? Get in touch.