Most SOCs say they’re “not ready for AI.” Others rush in, hoping AI will magically fix years of neglected fundamentals.Both approaches aren’t ideal.In this episode, Ahmed Achchak (CEO & Co-founder, Qevlar AI) sits down with Rafal Kitab, Director of SecOps & Incident Response at ConnectWise, to talk about when exactly AI should be added in the SOC.Rafal argues that AI doesn’t fix broken SOCs. It amplifies whatever you already are. If your processes are solid, AI can extend your capacity. If they’re broken, AI just helps you fail faster with greener dashboards.You’ll learn:→ Which AI promises for SecOps in 2025 actually held up in production and which ones collapsed on contact with reality→ Why adding AI too early can hide inefficiency instead of fixing it→ The non-negotiable SOC fundamentals that must exist before AI delivers real value→ How to measure “AI success” without vanity metrics→ Rafal’s bold prediction for how AI will change day-to-day SOC work in 2026 (and who it benefits most)Agenda00:00 – Introduction: Are SOCs really “not ready” for AI?01:27 – The big AI promises of 2025: what worked and what didn’t02:44 – Why “AI SOC” testing often fails before it starts04:41 – How AI can accelerate inefficiency instead of reducing it05:58 – Why green SLAs don’t mean better detection and response08:07 – The non-negotiable SOC fundamentals before AI adds value09:34 – Measuring workload, quality, and real capacity in a SOC10:26 – Why SOCs fix tools before processes — and pay for it later13:45 – Rafał’s bold predictions for AI in the SOC in 2026Follow Rafal Kitab on LinkedIn: https://www.linkedin.com/in/rafal-kitab/Follow Ahmed Achchak on LinkedIn: https://www.linkedin.com/in/ahmed-achchak-872554109/Stay tuned for updates from Qevlar AI: https://www.linkedin.com/company/qevlarCurious how Qevlar AI helps SOCs connect weak signals and surface real intrusions earlier? Head to: qevlar.com

Ask this episode

“What did the council decide on item 42?” — answered with the speaker and the moment.

Transcript

Related