The Iron Man Suit for Your SOC: What AI-Ready Really Means

Insights from Crogl CEO Monzy Merza's appearance on the Google Cloud Security Podcast

The promise of AI in the SOC has never been more tangible, yet the path from aspiration to reality remains unclear. In a recent conversation on the Google Cloud Security Podcast, Crogl CEO Monzy Merza explored what it truly means to build an "AI-ready" SOC—and why the answer is far more complex than most vendors would admit.

Iron Man Suit vs. Terminator: Choosing Your Future

The security industry has long dreamed of the "Iron Man suit" for SOC analysts—technology that amplifies human expertise rather than replacing it. This stands in stark contrast to the "Terminator" vision: fully autonomous systems that eliminate the need for human judgment.

LLMs and agentic frameworks have demonstrated real capabilities driving genuine excitement. But this optimism quickly turns dangerous when organizations skip the foundational work required to make AI genuinely effective in production security environments or when they forget that real world SOCs are messy.

The Jekyll and Hyde of AI in Security Operations

AI in the SOC embodies both tremendous potential and significant risk.

The Jekyll: AI offers speed, consistency across investigations, and analytical depth impossible for human teams alone—addressing real operational pain points.

The Hyde: The transformation from helpful tool to dangerous liability happens when organizations ignore three critical challenges: Data, Process, and Governance. Of these, data stands as the most fundamental obstacle.

Artificial intelligence in a real world SOC embodies tremendous potential, but also carries significant risk.

The Data Problem: Why AI Can't Fix Your Mess

Many organizations assume AI can fix messy, fragmented security data. This belief leads to predictable failure.

The reality: AI systems are only as robust as the data they're trained on and query at runtime. In dynamic security environments where threats evolve constantly, this creates a counterintuitive requirement: your AI must be wrong some of the time.

An AI system that never makes mistakes isn't robust—it's overfitted. Like overly strict security controls that block legitimate activity to achieve zero false positives, an AI system optimized for perfect accuracy will miss real threats. Systems that never experience stress become brittle and fail catastrophically when faced with novel situations.

This reframes what "AI-ready" means. It's not about having perfect, normalized data. It's about data infrastructure that allows AI systems to learn from errors, adapt to new patterns, and maintain effectiveness across the full spectrum of security scenarios—including those that don't fit historical patterns.

The Foundational Work: What AI-Ready Actually Requires

Data Accessibility Over Data PerfectionThe goal isn't to normalize all security data into a single schema—a process that loses context and creates vendor lock-in. Organizations need the ability to query across disparate data sources without forcing everything into a common format. This preserves the fidelity and context that AI systems need.

Process Documentation and StandardizationAI can't improve undocumented processes. Security teams must understand and standardize investigation workflows before augmenting them with AI. This means establishing consistent foundations that AI can reliably build upon.

Governance Frameworks That Account for UncertaintyTraditional security governance assumes deterministic outcomes. AI introduces probabilistic decision-making, requiring new frameworks. Define acceptable error rates, establish feedback loops for continuous improvement, and create clear escalation paths when AI uncertainty exceeds thresholds.

Can AI Help Build AI-Ready Foundations?

AI can assist with specific foundational tasks—identifying data quality issues, suggesting schema mappings, and highlighting gaps in process documentation. However, AI cannot replace the strategic decisions about data architecture, process design, and governance frameworks. Those decisions require deep understanding of both the security environment and business context—exactly the kind of judgment that makes human analysts irreplaceable.

Measuring Progress: The Triad of Value

Three metrics form the foundation for measuring progress:

Speed – AI should demonstrably reduce time from alert to resolution. Not faster clicks through workflows, but reducing time analysts spend gathering context, correlating data across tools, and documenting findings.

Consistency – AI should reduce investigation variation without eliminating the creativity that separates great analysts from good ones. Consistent application of organizational knowledge frees analysts to focus on novel aspects of each investigation.

Depth – AI should enable analysts to explore hypotheses they wouldn't have time to pursue manually. This is the true "Iron Man suit" promise: not replacing human insight, but multiplying what each analyst can investigate, understand, and pour back into future investigations.

What Gets Worse?

Some things may get worse before they get better:

• Over-reliance on AI recommendations can atrophy analyst skills if not carefully managed

• False confidence in AI capabilities can lead to reduced human oversight at critical decision points

• Technical debt accumulates when AI systems are built on fragile data foundations

These risks argue for thoughtful, foundational approaches rather than rushed deployments driven by vendor hype.

The Path Forward

The vision of an Iron Man suit for SOC analysts is achievable—but requires security leaders to resist the siren call of easy answers and quick deployments.

Start with data. Not by normalizing everything into a single schema, but by ensuring analysts and AI systems can access and query the data they need without losing critical context. Document and standardize processes while preserving analyst autonomy. Build governance frameworks that account for probabilistic decision-making and continuous learning.

Most importantly, remember that AI in the SOC should augment human expertise, not replace it. The analysts who understand your environment, your business context, and your risk tolerance remain your most valuable asset. The right AI simply gives them superpowers.

Listen to the full conversation: Google Cloud Security Podcast EP249

Additional Resources:

• Patent for Analyzing Non-Normalized Data for Security

• "Simple to Ask: Is Your SOC AI Ready? Not Simple to Answer!" blog

• Nassim Taleb “Antifragile” book

• “AI Superpowers” book

• “Attention Is All You Need” paper