# SOC Automation Maturity Model **URL:** \ **Category:** AI & Automation\ **Created:** [August 31, 2026, 9:58am UTC](https://soc-cmm.discourse.group/t/soc-automation-maturity-model/32 "2026-08-31T09:58:46Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![robvanos](https://yyz2.discourse-cdn.com/flex050/user_avatar/soc-cmm.discourse.group/robvanos/32/58_2.png) [@robvanos](https://soc-cmm.discourse.group/u/robvanos)\ **Post date:** [August 31, 2026, 9:58am UTC](https://soc-cmm.discourse.group/t/soc-automation-maturity-model/32/1 "2026-08-31T09:58:47Z")
**SOC automation maturity model** With the entire SOC vendor landscape focusing on AI in the SOC, I thought it would be good to look at different stages in the evolution of SOC automation. I choose to say SOC automation here specifically, because AI is a tool in the automation toolbox. It is not the only tool, nor is it a goal in itself. AI becomes increasingly important as the complexity and need for adaptability of automation increases. Through automation, we try to optimize SOC efficiency and focus on the things that truly matter. Note that this is not merely a matter of cost-effectiveness. With AI-assisted/AI-enabled attacks on the rise, automating and accelerating are necessities for effective cyber defense. Recent reports, such as that from Crowdstrike show an increase of AI usage in cyberattacks, and a reduction of breakout time (time between compromise and impact). [JADEPUFFER](https://labs.cloudsecurityalliance.org/research/csa-research-note-jadepuffer-agentic-ransomware-langflow-202/) ransomware shows that autonomous and adaptive attacks are current reality (although still rare). **The SOC Automation Maturity Model** SOC automation is not a lineair evolution. The introduction of AI does not make everything easier by default. I created a SOC automation maturity model to show the different stages a SOC can through when moving towards a higher level of automation and autonomous operation. This evolution covers both traditional automation and AI automation. The model is shown below: ![SAMM](https://canada1.discourse-cdn.com/flex050/uploads/soc_cmm/original/1X/63c69181d9e203a942baae58a5811fc3fdfc6b81.jpeg) The maturity model presents stages in the growth of a SOC towards a higher level of automation. There are 6 levels in total: 1. **None**. This level is pretty self-explanatory. All actions are done manually, with no automation in place. Remaining in this phase presents a significant and increasingly unacceptable risk to the organisation. 2. **Automated**. This is your traditional SOAR approach, with playbook automation and response orchestration. While SOCs that have a high level of automation maturity can achieve a high level of effective security operations, it is presented here as low on the scale. This is because the degree of autonomy and automation is limited compared to SOCs that effectively leverage AI across all SOC processes and services. Additionally, traditional/playbook-based SOAR automation relies on predefined conditions and is therefore static rather than adaptive. 3. **AI-assisted**. On top of the SOAR automation layer, we are adding AI, mostly through embedded capabilities in existing tooling. This stage represents a logical next step for SOCs that are heavily invested in SOAR automation. The focus of AI is mainly supporting the analyst in monitoring and event analysis, while SOAR automation adds context, enrichment, playbooks automation, and limited response automation. This level of automation is typically implemented using co-pilot type capabilities. 4. **AI-augmented**. A collaboration between humans and AI to enhance a set of SOC processes and services. The AI-augmented approach requires a more complete AI ecosystem that may include agentic AI for specific purposes, combined with embedded AI capabilities in existing tooling. AI governance starts to play a role to manage consistency and guardrails of agents. 5. **AI-driven**. The AI-driven stage is a role-reversal from AI-assisted. Where stage 2 had humans in the lead, with AI supporting, this stage represents a stage where AI is in the lead and humans supporting validation and decision-making. This is also the phase where trust-building can take place. Humans will increasingly trust AI in its decision making, as accuracy rates slowly go up through human feedback. This stage of automation maturity makes heavy use of agentic AI and orchestration between these agents. AI governance becomes central to SOC success. 6. **Autonomous**. SOCs operate autonomously, with humans governing and overseeing important decisions only (exception management). This is the highest degree of autonomy and automation that is achievable in this maturity model. Humans will continue to do engineering, building and designing the acceptable parameters for the SOC, tuning the models, etc. The focus will shift from security engineering to engineering the autonomous system. The time gap presented between AI-driven and autonomous exists for several reasons: 1. **Technical feasibility.** Technical advances in AI are required to achieve truly autonomous decision-making. A fully autonomous SOC would require AI to understand complex and changing context, reason across multiple domains, assess risks, and make decisions in situations it has not explicitly been trained or instructed for. These capabilities increasingly approach the characteristics associated with Artificial General Intelligence (AGI). While significant progress is being made, this level of AI capability is still not available today and the timeline for achieving it remains uncertain (see Gartner hype cycle below). 2. **Context.** Organisations need to be able to provide the right context for the AI SOC to operate on. Threat context, business context, asset context, vulnerability context, crown jewels, etc. This requires a high level of organisational maturity. This connection between organisational (process) maturity and SOC autonomy may keep SOCs from ever reaching this level, even if it is technically feasible. Without context, automation decision making and response actions can have disastrous results. 3. **Accountability**. Organisations may not want to move to autonomous SOC decision-making due to accountability issues. If the AI decides a response action is required immediately (for example: active ransomware attack) and overrides validation protocols because of the business impact of the attack, but causing business impact in the process while the alert turned out to be false-positive, who is accountable for the damages? So, the gap is both an industry technology gap, and an organisational gap. **Evolving your SOC to a higher level of automation** Evolving your SOC to a higher level of automation requires focus and a clear adoption strategy. That strategy should involve decisions like: - What are the timelines for adoption? - What level are we aiming for? - What data and context do we need? - What tasks need to be replaced / augmented first? - What technologies will we be employing? - What are the acceptable limits / risks (guardrails)? These questions will help to shape the way in which the SOC will embed AI capabilities. If you are already in a good SOAR automation state, moving to higher levels of automation can be done with less effort. If your SOC is in an immature state, without repeatable processes, the evolution will take much longer to complete. While AI can also support acceleration of SOC transformation, we must keep in mind that building any kind of automation (including AI) on top of incomplete and inconsistent data will not result in the desired optimizations. Automation remains a top priority as well as a top challenge for the years to come. The [complexity of the vendor landscape](https://secops-unpacked.ai/research/ai-soc-vendors) only adds to the challenge. Well defined requirements, and an objective way of evaluating if AI capabilities match your needs is an important condition in moving forwards. Don’t buy AI because the vendor says it is AI. Define the automation outcome you need and objectively assess whether the technology gets you there. ![Gartner_HC_genAI](https://canada1.discourse-cdn.com/flex050/uploads/soc_cmm/original/1X/ee6a4b91e767e743759391a30df137857f410458.jpeg) ---
**Author:** ![venkatr61](https://avatars.discourse-cdn.com/v4/letter/v/a9a28c/32.png) [@venkatr61](https://soc-cmm.discourse.group/u/venkatr61)\ **Post date:** [September 8, 2026, 6:20am UTC](https://soc-cmm.discourse.group/t/soc-automation-maturity-model/32/2 "2026-09-08T06:20:37Z")
Thanks Rob. What about drawing a map on automation based on humans being in SOC assisted/augmented/driven or fully replaced by AI. Will it traditionally start with L1 and move on to L2 and then L3 or hierarchy will have no impact on automation? This will be interesting for SOC employees ---
**Author:** ![robvanos](https://yyz2.discourse-cdn.com/flex050/user_avatar/soc-cmm.discourse.group/robvanos/32/58_2.png) [@robvanos](https://soc-cmm.discourse.group/u/robvanos)\ **Post date:** [September 8, 2026, 8:42am UTC](https://soc-cmm.discourse.group/t/soc-automation-maturity-model/32/3 "2026-09-08T08:42:40Z")
> [@venkatr61](#): > > What about drawing a map on automation based on humans being in SOC assisted/augmented/driven or fully replaced by AI. Will it traditionally start with L1 and move on to L2 and then L3 or hierar That is an interesting question. I will start a new discussion on this somewhere in the next weeks. Replacing humans with AI is not the goal, but it is an inevitable result.