Three-Layer SOC: Where AI Platforms Like Claude Belong
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Intezer's CEO Itai Tevet and CMO Lital Asher-Dotan are hosting a webinar arguing AI platforms like Claude, Cursor, and Codex belong at the top of a three-layer SOC architecture, as analyst-collaboration tools rather than 24/7 alert investigators
- The article frames modern SOCs as three layers: existing security tools (SIEM, EDR, cloud, identity) at the bottom, an autonomous AI SOC in the middle that investigates every alert, and AI platforms like Claude at the top for analyst work
- AI platforms like Claude are built to help analysts write detections, summarize investigations, hunt for threats, and draft reports — not to autonomously investigate thousands of alerts daily, a task the piece compares to using a Formula 1 car for package delivery
- The "tokenomics" argument: every alert investigation requires endpoint telemetry, process trees, authentication logs, threat intelligence, and organizational context, and each piece consumes tokens — making LLM-based triage economically unviable at high alert volume
- Organizations relying on MDR providers cannot have AI platforms independently investigate alerts because the raw alerts, telemetry, and investigation artifacts remain locked inside the MDR's platform, inaccessible to the customer's AI tools
- Analysis of more than 25 million security alerts processed during 2025 found nearly 1% of confirmed incidents originated from low-severity or informational alerts, supporting the case for investigating every alert rather than prioritizing by severity alone
Why it matters: Security leaders under pressure to adopt AI get a specific framework for where Claude-class tools actually fit — arguing that token economics and MDR-controlled telemetry make autonomous LLM alert investigation impractical, while positioning a dedicated autonomous AI SOC layer as the prerequisite that makes AI assistants useful for analysts at all.
