Why AI is failing in the security operations center

Enterprise SOC AI tools are often underperforming because security data is fragmented, outdated, or siloed across complex environments.

Elastic’s Darren LaCasse says organizations must first unify security data and define clear processes before AI agents can be trusted in production.

The piece argues that AI success in cybersecurity depends less on the model and more on the quality, structure, and accessibility of operational data.

For SOCs, data unification and workflow discipline are the foundation for reliable automation and analysis.