AI Adoption in Security Operations Brings New Visibility and Access Risks
A Corelight executive describes how large language models can assist security operations with vulnerability analysis, detection engineering, SIEM rule creation, and packet or Zeek metadata analysis. Agentic triage can speed work and reduce false positives, but human review is still needed before automated blocking or response actions. The discussion also covers attackers using AI for coordinated operations, zero-day development, and social engineering, and recommends controls for shadow AI, least privilege, change auditing, and network monitoring.
Vince Stoffer, a field CTO at Corelight, describes large language models as helpers for security teams analyzing vulnerabilities, building detections, drafting SIEM rules, and creating small tools to inspect packet or Zeek metadata. Agentic triage reportedly lets analysts work faster, cuts false positives, and helps less experienced staff explore network evidence more thoroughly.
Stoffer still places a person in the approval path before agents block traffic or take response steps. He also notes that adversaries use AI for coordinated agentic campaigns, zero-day work, and persuasive social engineering, while AI models uncover many vulnerabilities. His safeguards include oversight of unsanctioned AI, least-privilege access, change auditing, and network monitoring to see AI usage.
As AI enters security operations, organizations may gain faster triage and richer network visibility, potentially reducing analyst burnout and improving incident response. But looser permissions and unsanctioned tools could expose sensitive systems, while attackers’ use of AI may make social engineering and zero-day exploitation harder to detect. The public could feel effects through data breaches or service disruptions; security teams, junior analysts, and compliance staff may see changing workflows and oversight demands.