Security, AI and SOCs: What’s Relevant for Healthcare Organizations

The Role of AI in Modern Security Operations Centers (SOCs)

In industries such as healthcare, where safeguarding patient data is critical, AI-powered SOCs offer a decisive advantage against increasingly sophisticated cyberattacks.

Adam Khan, vice president of global security operations at Barracuda, explains that AI is already having an immense impact on security operations by accelerating investigations and reducing workloads on security teams.

“It enables faster, more accurate threat detection and automated responses by analyzing large volumes of alerts across various security tools and environments,” he says.

For example, AI can detect suspicious activity such as a compromised Microsoft 365 account and automatically disable access within seconds, preventing further damage.

“This machine-speed response lowers breach risk and frees analysts to focus on complex threats,” Khan says.

RELATED: Customized SOC training elevates cyber skills to enable growth.

Generative and Agentic AI for Healthcare SOCs

Generative AI turns raw telemetry into action, summarizing incidents in plain language, creating containment scripts and converting technical findings into board-ready updates that include regulatory impact.

Agentic AI goes further by taking constrained, preapproved actions, executing playbooks in a least-privilege sandbox, opening tickets, isolating endpoints or retrieving identity risk signals — always keeping a human in the loop for high-impact decisions.

It also eliminates handoff friction by auto-escalating incidents to the right owners using integrated asset inventories, on-call schedules and incident response playbooks.

For example, it can route anomalous protected health information access to the identity team or a clinical virtual LAN incident to the network team.

“Combined with retrieval-augmented generation over runbooks and historical cases, new analysts gain an ‘on-call copilot’ that boosts speed, consistency and decision quality while maintaining compliance,” says Tom Gorup, vice president of SOC operations for Sophos.

He explains that AI agents are not “set it and forget it” tools; as AI models update, you’ll want to update along with them.

As a healthcare IT environment changes, whether in terms of the cloud, applications or endpoints, security leadership must ensure that agents understand those changes. As attacks evolve, they must have playbooks ready to respond.

“This means healthcare SOCs will need a different kind of focus and investment in their AI solutions than they’ve traditionally made,” Gorup says.

EXPLORE: How should healthcare organizations navigate AI evaluation and implementation?

Addressing Cybersecurity Workforce Shortages With AI

Michael Stempf, vice president of product experience for Commvault, says automating high-volume, low-complexity tasks and upskilling existing staff is critical given healthcare’s severe talent gaps.

“AI handles first-pass alert triage, log parsing, enrichment, evidence gathering and correlation of ‘normal-looking’ events to flag real attacks,” he explains.

It auto-generates draft investigations and routes or escalates them to the right owner, so analysts don’t lose time figuring out who to engage. It also accelerates onboarding by turning institutional knowledge into searchable, context-aware guidance, helping new hires navigate complex healthcare IT faster.

“This lets SOCs operate effectively with fewer Level 1 analysts and frees senior talent for threat hunting and complex incident response, provided data access is governed, and escalation boundaries are clear,” Stempf explains.

By automating routine tasks such as alert filtering, log analysis and false positive reduction, AI significantly boosts analyst productivity, allowing security professionals to dedicate more time to complex investigations.

“Automated response capabilities enable faster containment of attacks, reducing manual workload and analyst burnout,” Khan says.

On the detection front, AI leverages extensive threat intelligence data and cyber trained models to identify sophisticated attack patterns in real time.

“This improves detection accuracy, minimizes false positives and provides deeper insights into attacker behavior, empowering security teams to respond more decisively and proactively,” Khan explains.

Preparing SOCs for AI-Generated Threats

Gorup says SOCs must be ready to handle an expanding spectrum of AI-enabled attacks, including social engineering threats, especially deepfakes (including deepfake audio calls) and phishing emails.

“To prepare for AI-generated threats, SOCs should regularly conduct adversarial simulations using AI tools,” he says.

These exercises can uncover blind spots in both automated and manual processes, helping teams stay ahead of evolving attack tactics and ensuring both human analysts and AI-driven systems are resilient.

He adds that SOCs must not only protect their organizational networks but also defend their own people, processes and tools.

“Attackers are aware that defenders now rely on AI and will begin to design attacks specifically to exploit these new dependencies,” Gorup says.

WATCH NOW: Do you need security with AI, for AI or from AI? Yes.

The Future of AI-Enabled Cybersecurity in Healthcare

As attackers increasingly leverage AI and automation to launch faster, more complex attacks, healthcare organizations must accelerate the adoption of AI-driven security solutions to keep pace.

Stempf says he expects to see a shift from “AI-assisted” to “AI-orchestrated” SOC operations, with autonomous agents coordinating tools and workflows end-to-end under policy guardrails aligned with emerging frameworks, while humans retain decision authority for systems critical to patient safety.

“Detection will become more behavior-based and context-aware, modeling patient care pathways and device norms to prioritize threats to safety and continuity of care,” he explains.

Khan says that given ongoing workforce shortages and the expanding attack surface, scalable AI defenses will be indispensable in maintaining robust security postures.

“Ultimately, AI will empower healthcare organizations to stay ahead of emerging threats, protect sensitive patient data, and enable security teams to work more efficiently and effectively,” he says.