UNIVERSITY · LAST CHECKED SEPTEMBER 2026
AI SOC University: glossary and short lessons
Cyber AI Comparison team · Last checked September 2026 · Editorial assessment
What to know
Start with the glossary if a vendor term is unfamiliar. Then work through 9 short lessons in three tracks: Basics (how playbooks and AI SOC investigations work, and the standards behind them), Running it (autonomy, verdicts and guardrails) and Buying (integrations, deployment and reading vendor claims). Each lesson takes a few minutes and links to the next.
Glossary
43 terms
Basics
Lesson 1
How a SOAR playbook works, and where it breaks
A short lesson on SOAR playbooks: triggers, steps and branches, why SOC teams rely on them, and the three places they break down that AI SOC platforms target.
3 min read · Published 29 September 2026
Lesson 2
How an AI SOC investigates an alert, step by step
A short lesson on what an AI SOC platform does with a single alert: intake, triage, evidence gathering, verdict and proposed response, compared with a SOAR playbook.
3 min read · Published 14 July 2026
Lesson 3
MITRE ATT&CK, D3FEND and NIST: the standards behind SOC work
A short lesson on the frameworks AI SOC vendors map to: MITRE ATT&CK, MITRE D3FEND, NIST CSF 2.0 and NIST SP 800-61 Rev. 3, and how to use them when reading vendor claims.
3 min read · Published 26 August 2026
Running it
Lesson 4
AI SOC autonomy levels explained: from recommend only to auto-run
A short lesson on AI SOC autonomy levels: recommend only, supervised and auto-run, human in and on the loop, and how vendors let you raise and lower autonomy.
2 min read · Published 22 July 2026
Lesson 5
How to read an AI SOC verdict
A short lesson on reading an AI SOC verdict: what evidence to expect, how to check the steps taken, and how to challenge or correct a verdict.
2 min read · Published 3 August 2026
Lesson 6
Guardrails, approvals and audit trails in an AI SOC
A short lesson on the controls that decide whether you can trust an AI agent with response: guardrails, approval gates, audit trails and fallback when behaviour drifts.
3 min read · Published 5 September 2026
Buying
Lesson 7
Alert sources and integrations: what an AI SOC needs to connect to
A short lesson on checking AI SOC integration coverage: alert sources versus investigation sources, what each vendor publishes, and why a bigger integration count is not the whole answer.
3 min read · Published 12 September 2026
Lesson 8
AI SOC deployment models and data residency
A short lesson on AI SOC deployment options: multi-tenant SaaS, single-tenant, customer cloud tenant and on-premises, what each vendor publishes, and the data questions to ask.
3 min read · Published 18 September 2026
Lesson 9
How to read AI SOC vendor claims
A short lesson on reading AI SOC vendor pages: performance figures as claims, SOAR stances as positioning, 'Not published' as a question, and dates checked against the source.
3 min read · Published 23 September 2026