Claude’s Role in a Layered Security Operations Centre

AI platforms including Claude, Codex and Cursor are increasingly used by security teams to explain suspicious activity, write detections, summarise incidents and automate repetitive work. However, the article argues that they should not serve as the continuous investigator for every SOC alert.

The scale problem is material. An analysis of more than 25 million security alerts processed during 2025 found that nearly 1% of confirmed incidents originated from low-severity or informational alerts. Investigating only the loudest signals can therefore leave meaningful threats unexplored.

Three layers with distinct responsibilities

The proposed architecture starts with existing security products: SIEM, EDR, cloud security, identity platforms and email security. These systems generate alerts and telemetry.

An autonomous AI SOC occupies the middle layer. It investigates incoming alerts, correlates findings across tools, applies organisational context and identifies cases that require human attention. Claude, Cursor and Codex sit above it as collaborative environments for analysts, detection engineers and incident responders.

This separation matters because general AI platforms are designed to assist people. They can interpret suspicious PowerShell activity, draft a Sigma rule, translate detections into another query language or summarise an investigation. Continuous, high-volume triage instead requires persistent integrations, organisational memory and round-the-clock operation without a fresh human prompt.

The distinction also complements the operational risks surrounding Claude Code and AI-agent phishing by showing why both AI capability and controlled operational context matter when security teams adopt agent-based tools.

Why context changes the economics

Every useful investigation needs evidence. Endpoint telemetry, process trees, authentication logs, email history, threat intelligence, prior investigations, detection rules and organisational knowledge all consume tokens when supplied to a large language model.

That cost can be reasonable for a handful of analyst-led cases. It changes when thousands of alerts arrive each day and each one starts a new AI conversation, especially when most investigations conclude that the activity is benign.

The autonomous approach described in the article combines deterministic workflows, forensic analysis, cached context, organisational memory and selective AI reasoning. Large language models are applied where they add value rather than at every step, allowing continuous investigation with more predictable costs.

The MDR data-access constraint

Managed detection and response arrangements introduce another limitation. The MDR provider may control the analysts, case-management system, investigation history and enriched telemetry. Customers often receive escalated incidents and reports rather than all evidence collected during an investigation.

Claude cannot independently reason over raw alerts or investigation artefacts it cannot access. A system placed alongside an organisation’s security tools can retain that context and make it available to analysts and AI platforms, while giving the organisation a path towards owning its investigation history and institutional knowledge.

A practical division of labour

After automated investigation, analysts can use AI platforms to question completed cases, refine detection rules, hunt emerging threats, prepare stakeholder summaries, generate incident reports and test hypotheses. Human judgment remains focused on complex decisions.

For security leaders, the practical implication is to assess AI by workload rather than label: use continuous infrastructure for comprehensive alert investigation, preserve access to the necessary telemetry and history, and reserve collaborative AI platforms for work where analysts’ reasoning, creativity and final judgment add the most value.