The Future of SOC: Expert-Led AI Hyperautomation
On February 23, 2026, CrowdStrike lost 11.3% of its value in a single trading session. Its worst day in years. Zscaler and Tenable each dropped around 11-12%. The Global X Cybersecurity ETF fell to its lowest level since November 2023.
The trigger? Anthropic launched a new AI security tool capable of scanning code for vulnerabilities and suggesting fixes. A single product announcement wiped billions off the market capitalisation of the industry's biggest names.
The market is sending an unmistakable signal: the security industry's business model is being repriced in real time
This isn't a correction. It's a structural shift.
Analysts are describing the sell-off as a "fundamental shift in how the industry views the relationship between AI and security." The concern isn't that AI will augment traditional security tools. It's that AI might replace the high-margin detection-and-response services that define the sector's economics.
The numbers support the anxiety. Torq closed a $140 million Series D at a $1.2 billion valuation in January. Swimlane launched a fully agentic AI SOC platform last week. Cogent Security raised $42 million for autonomous vulnerability remediation. More than 50 agentic SOC startups are now competing for enterprise budgets.
Meanwhile, the incumbents are scrambling. Palo Alto Networks dropped 9% last week after lowering profit guidance, despite beating revenue expectations. The company's "platformisation" strategy, designed to consolidate security spending, is proving more expensive than investors anticipated. The market is questioning whether traditional vendors can transition to AI-native models without destroying their existing margins.
What the panic misses
CrowdStrike's CEO George Kurtz responded to the sell-off on LinkedIn: "AI innovation is inspiring. But let's stay grounded in reality: an AI capability that scans code does not replace the Falcon platform, or your security program."
He's right, but only partially.
AI tools don't replace security platforms. What they replace is the operating model. The value of a security vendor is no longer measured by how many analysts watch dashboards. It's measured by how effectively AI and human expertise combine to stop threats.
This is where the market's binary thinking fails. Investors see AI as either irrelevant to incumbents (the old bull case) or an existential replacement (the current panic). Neither is accurate.
The reality: AI excels at speed and volume. It can triage 100% of alerts in minutes, achieve 98% accuracy on routine classifications, and execute containment playbooks faster than any human team. But AI still cannot understand organisational context. The finance team working late during month-end. The executive travelling internationally. The legacy system with unusual but legitimate traffic patterns. AI cannot navigate truly novel threats that fall outside its training data. And AI cannot bear accountability for decisions that trigger legal, regulatory, or reputational consequences.
The future isn't AI replacing humans. It's AI handling volume while humans handle judgment.
The playbook-governed model
Expert-led hyperautomation operates through pre-approved playbooks. Rather than granting AI unlimited authority, organisations define the precise conditions and actions for automated response. AI investigates alerts, determines which playbook applies, and executes containment. All within minutes.
Effective playbooks are pre-agreed before activation, scoped to specific triggers, auditable with evidence trails, reversible where possible, and aligned with organisational risk tolerance.
When credential theft triggers account containment, response executes in seconds. Disabling the account, revoking sessions, forcing password reset. No waiting for an analyst to log in. But ransomware indicators demanding mass isolation trigger immediate human notification, because business impact at that scale requires oversight.
This is the model that actually works. Not full autonomy. Not bodies watching dashboards. Expert-led hyperautomation.
Why this matters for APAC
Asia-Pacific faces the sharpest version of this challenge: 34% of global cyberattacks (the highest concentration worldwide), 2,510 weekly attacks per organisation on average, and a 2.7 million worker shortage. The largest talent gap globally.
Traditional 24x7 SOC coverage requires six to eight analysts, costing $480,000 to $720,000 annually before technology. Mid-market organisations cannot afford this. They cannot recruit staff who don't exist. And they cannot accept inadequate coverage while operating in the most targeted region on earth.
AI changes this equation. Expert-led hyperautomation requires two to three senior analysts rather than six to eight junior ones. Analysts transition from executors to supervisors. Coverage becomes continuous. Response times compress from hours to minutes.
The economics are proven: organisations using AI extensively experience $3.84 million average breach costs versus $5.72 million without. A $2 million differential per incident.
The path forward
The cybersecurity market's worst day in years isn't a signal to avoid AI. It's confirmation that AI is now unavoidable. The vendors being punished aren't being punished for adopting AI. They're being punished for the uncertainty of transition.
The organisations that will thrive are those that implement AI-powered security operations thoughtfully: with governance, expert oversight, and playbook discipline. Not waiting for perfect solutions. Not chasing full autonomy. Building expert-led hyperautomation that combines machine speed with human judgment.
The fully autonomous SOC remains a fantasy. Expert-led hyperautomation is available today.
Datadog Partnership
We built Blue Island Group on a simple promise, enterprise-grade capabilities for Asia-Pacific organisations without the complexity. Today, that promise just got stronger.
Welcome to Blue Island
Introducing Blue Island Group. For the first time in Asia-Pacific, one partner unifies Security, Infrastructure & Talent
Get in touch
Do you have questions, suggestions, or want to discuss how we can help protect your business?
We’re always ready to talk. Please fill out the form below and our team will get back to you shortly.