Malik Haidar is a seasoned cybersecurity veteran who has navigated the high-stakes environments of multinational corporations, where the bridge between technical defense and business strategy is most critical. His approach isn’t just about deploying the latest tools; it is about understanding the operational DNA of a security operations center to ensure that intelligence leads to meaningful action. With deep roots in analytics and threat intelligence, he has spent years refining how teams can move faster than the adversaries who are now using automation to scale their attacks. In this discussion, we dive into the nuanced roles of autonomous AI versus conversational assistants, the economic realities of processing massive alert volumes, and why the traditional way of prioritizing threats might be leaving the back door wide open.
This conversation explores the three-layer architecture of modern security, the financial impact of AI “tokenomics” in high-volume environments, and the strategic shift required to manage the millions of alerts that bombard today’s defenders. We also look at how organizations can reclaim ownership of their security data from managed providers and why the future of the SOC depends on a partnership between machines that “do” and humans who “decide.”
Modern security architectures often separate autonomous investigation systems from conversational AI platforms. How do you see these two layers interacting without creating redundant workflows or tool sprawl?
The most effective way to visualize this is through a three-layer stack that keeps the roles of each system distinct yet collaborative. At the foundation, you have your standard security tools like EDR, SIEM, and cloud identity platforms, which are essentially the “sensors” firing off raw data. The middle layer is where the autonomous AI SOC lives, acting as a tireless engine that investigates every single alert, correlating findings and applying organizational context before a human ever sees a notification. Finally, at the top, you have conversational platforms like Claude or Cursor, which serve as the workspace where senior analysts and incident responders actually solve the complex problems the middle layer has highlighted. This isn’t about adding more tools to a cluttered dashboard; it’s about creating a pipeline where the autonomous layer handles the heavy lifting of the “grind,” and the conversational AI acts as a sophisticated partner for human decision-making. If you try to force one tool to do both, you end up with a system that is either too slow to react or too expensive to maintain at scale.
You’ve mentioned “tokenomics” as a major barrier to using platforms like Claude for every single alert. Could you walk us through the actual cost of context and why a different approach is necessary for scale?
When we talk about “tokenomics,” we are really talking about the hidden price tag of feeding a Large Language Model (LLM) the massive amount of data it needs to be useful. For an AI to make a smart decision on even a single alert, it needs to “ingest” endpoint telemetry, process trees, authentication logs, and threat intelligence, all of which consume tokens. If a large enterprise is receiving thousands of alerts every day, asking a conversational LLM to start a fresh investigation for each one is like hiring a brilliant, high-priced consultant to answer every single phone call in a busy call center. The costs explode because you are paying for the same context over and over again, often just to find out that an alert was benign. This is why an autonomous AI SOC is essential; it uses deterministic workflows and cached context to handle the bulk of the work, only calling on the power of an LLM when it truly adds value, keeping the budget predictable while maintaining high-speed logistics.
Looking at recent alert data, nearly 1% of confirmed incidents originated from “low-severity” or “informational” alerts. How does an autonomous layer change the way we handle these signals compared to traditional human-led SOCs?
In a traditional setup, humans are forced to play a game of “alert Tetris,” where they naturally prioritize the high-severity alerts because they simply don’t have the hours in the day to look at anything else. However, analysis of over 25 million security alerts processed in 2025 showed us that meaningful threats are hiding in the “quiet” signals that most teams ignore. An autonomous AI SOC changes the math by having the capacity to investigate 100% of alerts, regardless of the severity level assigned by the sensor. It doesn’t get tired, it doesn’t have “alert fatigue,” and it doesn’t skip over a low-severity PowerShell execution just because it has a long queue of high-severity logins to check. By investigating everything, the AI ensures that the 1% of incidents that start as informational alerts are caught before they can escalate into a full-scale breach, giving the human analysts the breathing room to focus on strategy rather than just survival.
Many organizations rely on Managed Detection and Response (MDR) providers to monitor their environments. What are the specific friction points when trying to integrate advanced AI platforms into an outsourced security model?
The biggest hurdle with an MDR model is that the provider typically owns the entire investigation workflow, including the case management system and the enriched telemetry. When an organization tries to use an AI platform like Claude independently, the AI is essentially “flying blind” because it doesn’t have access to the raw alerts or the historical artifacts that stay locked inside the MDR’s proprietary platform. It’s impossible for an AI to reason over data it cannot see, which creates a massive gap between the alerts the customer receives and the context needed to understand them. This is where an autonomous AI SOC layer becomes a strategic asset for the customer; it can sit directly alongside their internal security tools to capture and retain that institutional knowledge. Instead of being completely dependent on an external partner’s black-box process, the organization starts to own its investigations and can provide its own AI platforms with the high-quality data they need to be effective.
If an autonomous AI SOC handles the repetitive “grind” of triaging alerts, how does the day-to-day life of a senior analyst change when they start using a platform like Claude for the escalated incidents?
The shift is profound because the analyst moves from being a data collector to a high-level strategist and decision-maker. Instead of spending their first three hours of the day clicking through multiple consoles to gather evidence for a handful of alerts, they open their conversational AI platform and find a fully summarized investigation waiting for them. They can ask Claude to draft a custom Sigma rule based on the findings, translate a complex detection into a different query language, or even hypothesize about emerging threats based on the patterns the autonomous system identified. It turns the SOC into a creative environment where the analyst can use the AI to hunt for threats and refine defense rules in minutes rather than days. Essentially, the autonomous AI SOC handles the “what” and the “where,” while the conversational AI and the human analyst focus on the “why” and “what’s next.”
What is your forecast for the evolution of the AI-driven SOC?
I believe we are heading toward a future where the “uninvestigated alert” becomes a relic of the past, and the SOC transforms into a fully automated factory for threat intelligence. Within the next few years, the distinction between “low” and “high” severity will matter less because the autonomous layer will be so efficient that every signal is treated with the same forensic rigor. We will see AI platforms becoming even more integrated into the creative side of security, where an analyst can “talk” to their entire infrastructure to simulate attacks and harden defenses in real-time. The organizations that thrive won’t be the ones with the biggest teams, but the ones that have successfully bridged the gap between their autonomous “workers” and their human “thinkers,” using each to amplify the strengths of the other. The goal isn’t to replace the human; it’s to finally give the human the high-fidelity information and the advanced tools they need to actually win the war against automated adversaries.
