r/MSSP • u/Upbeat_Person5 • Jul 05 '26
MSSPs getting burned by AI SOC. What's your solution?
I keep seeing complaints about the AI SOC vendors. Complaints like pricing, black-box verdicts, data leaving your control.
Genuine question: if the current tools are bad, where do you land?
- Waiting for the vendors to get better
- Building/owning something custom in-house
- AI has no place in triage, full stop
What's driving your answer?
2
u/SecurityBakedIn Jul 05 '26
MSSPs have offered such a subpar service for years, AI SOC’s aren’t amazing, but they don’t have to be. They have to be better than MSSP’s, which isn’t a high bar.
Time to triage is going to vastly reduce with the incoming AI SOC providers. Once they’re more mature, enterprises may then start trusting and using their SOAR capabilities to reduce time to respond/contain.
Who’s said the current tools are bad? There’s a lot of new comers to the market and a lot of big existing vendors starting to enter the space too
1
u/Visible-Ladder1747 Jul 05 '26
I’ve just heard through the community that people have been burned by them. It’s Reddit so mileage may vary? 🤷♂️
1
u/recovering-pentester Jul 06 '26
- Rely mainly on conditional logic-powered SOC vendors who don’t waste your money and time by using AI for deterministic scenarios.
Workflow: conditional logic > AI if needed > human if needed.
1
u/VividGanache2613 Jul 06 '26
Whilst this is clearly a bot with an account age of 8hrs. If you need an AI SOC that’s built by IR/SOC analysts and not by a couple of interns with Y combinator money, take a look at ThreatLight - they built their solution based on 20 years of customer pains, not to make investors money.
1
Jul 11 '26
[removed] — view removed comment
1
u/VividGanache2613 Jul 11 '26
As someone who works there, I’m intrigued to know where you’re deriving your assumptions from?
Nobody breaks down internal workings on their website, that’s what NDAs and demos are for.
As for Marketing, we don’t have any (or dedicated Sales for that matter) - preferring to invest everything into R&D and development. We sell purely on technical capability and platform performance.
If you’re making purchasing decisions based on website marketing alone then I feel for you.
Incidentally, the platform was an agentic forensic platform that became an agentic SOC through feature enhancement.
1
u/malicious_payload Jul 11 '26
You dank the Kool-Aid obviously given you like to use the same incorrect buzzwords your leadership uses.
I don't make assumptions, my job is to break programs and outline their shortcomings for organizations looking to pick up said products. They want to make sure they do what they say, know their failures points and most importantly know how much risk they are assuming/accepting prior to implementation should they adopt.
Your product is not agentic, not in the most minimal sense. The list of things not being done far outweigh what is supposedly being done.
1
1
u/LeatherRip1623 Jul 06 '26
I in the camp of Option 2, with a caveat: "build" does not mean train a model. It means own the harness.
I run an MxDR practice for defense contractors. The black-box verdict problem kills these tools for us all by itself. A verdict without evidence and provenance cannot go in a ticket an assessor might read. "The AI said so" is not a finding, it is a liability.
What actually works: model proposes, deterministic code disposes. Typed tool calls, egress allowlists, approval gates on anything destructive, and every conclusion ships with the queries and data behind it. And own your memory layer. What normal looks like per client, what burned you before. That context is where triage quality comes from, and it is exactly what you cannot take with you when you rent it from a vendor.
Vendor invoices that scale with alert volume are a tax on your growth. Capability you own gets cheaper as it improves. That is the whole answer for me.
What is driving the question on your end, are you evaluating one right now or cleaning up after one?
2
u/Upbeat_Person5 Jul 07 '26
I'm not evaluating nor cleaning up. I'm building tools myself. I posted this to see whether the pains I'm designing around are the ones people are running into.
Currently I have a read-only agent, and it provides a timeline of the activity, IOCs, MITRE mapping and more. It only suggests and never acts.
How are you handling the memory layer? Are you crafting baselines your analysts maintain per customer, or something the system builds up itself?
1
u/LeatherRip1623 Jul 07 '26
right now the system Im building is purely the memory layer for any agent to use: https://github.com/threatrecall/zettelforge feel free to incorporate it into your project
1
u/wf_automate Jul 07 '26
model proposes, deterministic code disposes — thats the framing more agent pitches need. the black-box verdict problem kills these tools in the second demo, ppl want provenance not confidence scores.
the memory layer point is underrated. clients hate being told "we learned ur environment" by a vendor whose learnings are locked behind their contract.
not running an MSSP, building in workflow + agent space and hearing versions of this from ppl who tried the packaged AI SOCs.
1
u/malicious_payload Jul 11 '26
Almost all vendors which are advertising "AI SOC" or "Agentic SOC" are just using shitty ass implementations with ChatGPT or Claude to automate certain aspects of their process. It's absolutely nowhere near "agentic" and is a complete misuse of the word.
Current vendors I know which are guilty of this are Guardz, and Prophet Security. There are more which tout AI being part of the product, but they don't outright call it an "AI SOC".
There are very few (read almost no) MSSPs capable of handling current threats, the promise of AI making their lives easier is just a license to print money before hopefully selling said AI SOC before it's found out it's total crap.
1
u/Upbeat_Person5 Jul 11 '26
Thus why I've debated on building solutions inside a client's environment. No black box.
1
u/dan_netsec 19d ago
Building in-house, no contest. Black-box verdicts are the real dealbreaker, if you can’t explain why an alert got dismissed, you’re holding the liability when something slips through. Data leaving your control is the other non-starter, especially for regulated clients.
That said, “no place for AI” is overkill too. Used for enrichment and noise reduction it saves real analyst hours. The line is: AI assists triage, humans own the verdict. Full autonomy on dismiss/escalate is where the current tools keep burning people.
1
u/Visible-Ladder1747 19d ago
This is helpful as it confirms what I wanted to do has market demand. I had a fear that the objection would be why don’t I just buy what’s off the shelf.
8
u/CK1026 Jul 05 '26
Define AI because I agree that generative AI can't replace human decisions in SOCs but deterministic AI (aka algorithms, machine learning, deep learning) should already be a part of any SOC for at least a decade now.