This is a question we hear quite often when performing SOC-CMM assessments for organisations, or when using parts of the model in broader national capability assessments: how can SOC maturity be improved by integrating more AI?
I think the first distinction is that AI adoption and AI maturity are not the same thing. A SOC is not more mature simply because it uses AI-enabled tools. The maturity question is whether AI is improving the SOC’s actual capabilities: better detection, faster or more consistent triage, stronger response, better decision support, or more effective automation. Just as importantly, those AI-enabled capabilities need to be tested, governed, monitored, and measured.
This matters especially because senior leadership often sees AI as a way to reduce SOC resourcing needs. That may be possible in some areas, but it is a risky assumption if it comes before evidence. If AI is used mainly to justify cutting people, process, or engineering effort without measuring effectiveness, the organisation may be lowering cost while also lowering detection quality, response reliability, and accountability.
For that reason, I do not think AI should sit only in the Technology and Services domain. It clearly affects tooling, analytics, automation, triage, and response. But it also has implications for the Business domain, because organisations need to understand why they are using AI, what value they expect, what risks they are accepting, and how AI aligns with the SOC’s operating model. It also connects directly to process automation, because AI-supported workflows need clear ownership, validation, escalation paths, and continuous improvement.
This is why I would lean toward a hybrid approach. AI could have its own dedicated assessment area to make sure it is assessed comprehensively, but it should also be reflected across the existing domains where it changes SOC operations. Otherwise, there is a risk of either treating AI as a narrow tooling issue, or assessing it in isolation from the outcomes it is supposed to improve.
In short, SOC-CMM should not reward the presence of AI. It should assess whether AI is being used deliberately, safely, and measurably to improve SOC capability — not simply to reduce headcount or cut corners.