The EM360Tech Quarterly Impact Index recognises companies, experts and content making a meaningful contribution to the world of enterprise technology.
The Vanguard Award in particular celebrates the most innovative and forward-thinking podcast, judged on the quality of its ideas rather than merely performance metrics.
Expel’s episode of The Security Strategist podcast, titled Is Your SOC Below the AI Poverty Line?, explores a timely question: as AI helps attackers move faster, does that inherently mean organisations should trust that very AI to handle security-related decisions?
Host Brad LaPorte, Gartner veteran and advisor at Lionfish Tech Advisors, discusses this question with Greg Notch, Chief Technology Officer (CTO) at Expel. Their conversation stands out for looking beyond AI adoption to the harder dilemma of where automation can help, where human judgement is needed, and whether organisations have the expertise to use AI effectively.
The Conversation Behind the Win
The conversation centres on the AI poverty line: the potential divide between organisations that can effectively apply AI in security operations and those that may lack the resources, skills or operational capacity to do so.
LaPorte and Notch examine how AI is changing the speed of cyber attacks, where automation fits into the security operations centre (SOC), and how teams should decide which tasks can be handled independently by technology.
They also discuss the different levels of judgement required across SOC workflows. Some tasks, such as blocking a known malicious indicator or containing a compromised device, may be suitable for automation.
Others require more context, especially when an action could affect a business-critical system. The discussion considers how teams can decide where AI should assist, where it can act, and where a person needs to remain involved.
Why the Topic Mattered
Security teams are under increasing pressure to investigate alerts and respond to cyber security threats, often with limited time, staffing and resources. Notch explains that AI can accelerate parts of an attack, including lateral movement, increasing the pressure on defenders to respond at the right speed.
AI has the ability to help security teams investigate activity and automate routine tasks, but access to tools is only part of the challenge. Organisations also need the skills and operational processes to use them effectively and decide which actions are safe to automate.
This could widen the gap between teams that can make effective use of AI and those that cannot. Poorly judged automation can also create problems of its own, from acting on incomplete information to disrupting business-critical systems. The challenge is to respond quickly without losing sight of the consequences.
For enterprise leaders, the question is not simply how much to automate, but how to balance the risk of acting with the risk of waiting.
When AI Owns Cyber Offense
How Mythos shifts cyber offense from human-limited tradecraft to automated exploration, forcing boards to rethink security strategy and governance.
Where the Conversation Moved Beyond the Expected
The episode is distinctive because it questions the idea that putting AI everywhere in the SOC will automatically improve security. Notch’s examples focus on how AI should be applied, not just where it can be added.
For example, sending every raw security alert directly to a large language model (LLM) can be expensive, slow and prone to error. AI is not a substitute for making sure alerts have the right context before they are analysed. At the other extreme, filtering out too much noise can remove weak signals that might help analysts recognise an emerging attack. The challenge is to reduce unnecessary work without discarding information that matters.
That makes the choice of tool and approach important. Different stages of the SOC workflow need different levels of automation, analysis and human judgement; one AI model or method will not suit every task.
The same practical thinking shapes Notch’s approach to automated response. Security teams need to compare the possible impact of an incorrect action with the risk of delaying a response while an attack continues. Automatically containing a compromised device may prevent further harm, but taking the same action on a business-critical device could have serious operational consequences.
The right decision therefore depends on context, impact and urgency—not a blanket rule that AI should either act independently or wait for human approval every time.
Notch also draws on Expel’s experience with auto-remediation, which the company introduced around seven or eight years ago using heuristics rather than AI. Customers had to trust a third-party provider to take actions such as isolating infected laptops or containing compromised systems without waiting for approval.
Designing Effort-Light Platforms
Treat human effort as an architectural constraint and build platforms, automation and guardrails that absorb complexity instead of exporting it.
That experience illustrates that trust in automation is built over time. Organisations need to understand what a system can do, test how it behaves and set clear limits before giving it more authority. The episode’s value lies in this practical reasoning: it rejects both blanket autonomy and blanket caution in favour of decisions based on risk and the task at hand.
This is what makes the discussion worthy of Vanguard recognition: it moves beyond AI hype and offers a more precise way to think about how automation should work in real security operations.
The Enterprise Takeaway
Expel’s conversation highlights the importance of applying AI where it can make a real difference to security operations. Rather than deploying AI at every stage of the SOC process, security leaders should focus on where it can enhance investigations and response times, and make sure systems have the right context to make meaningful decisions.
They also need to think about which actions are safe to automate and which actions could have serious business consequences. A compromised device can be automatically quarantined to prevent further damage, but potentially disruptive actions on critical systems may require additional checks or human approval. As AI takes on more responsibility, clear boundaries and appropriate oversight become more critical.
The AI poverty line is also a problem for smaller organisations that don’t have the resources to staff a SOC 24/7. Notch’s perspective highlights the value of making better use of existing security platforms and considering external operational support when internal teams lack the capacity or expertise to manage everything themselves. Organisations don’t necessarily need to build every capability in-house to benefit from AI.
Ultimately, the goal is not to automate as much as possible, but to use AI in ways that strengthen security operations while keeping business risks, human judgement and accountability in view.
Automation or Breach in 3 Days
CISA’s three-day SLAs, AI-accelerated exploits and human bottlenecks are converging into an automation mandate for security leaders.
The Role of the Vanguard Award in the Impact Index
The Vanguard Award recognises podcasts that bring original, forward-thinking ideas to enterprise technology. Within the wider Impact Index, it focuses on the quality of a conversation and the assumptions it challenges, rather than on performance metrics alone.
Expel’s Is Your SOC Below the AI Poverty Line? podcast episode challenges the idea that faster attacks automatically require fully autonomous defence. It shows why security leaders need to consider the quality of the information AI receives, the consequences of automated actions and the skills available to manage them.
As AI changes both attack methods and defensive capabilities, the next challenge for security operations will be deciding how to allocate authority: which tasks machines can handle, which decisions need human judgement, and how organisations with fewer resources can still respond effectively.
Comments ( 0 )