AI in the SOC: European Practitioner Survey 2026

Summary

Based on a survey of European security professionals working in and around SOC environments, this report examines the current state of AI adoption, automation maturity, and operational challenges across enterprise SOCs and MSSPs. It covers AI use-case priorities, regulatory pressures from NIS2, DORA, and the AI Act, and the gap between AI capability and operational readiness.

Key Findings

• → 82% of European SOC teams expect AI usage to increase over the next 12 months, with one third anticipating a significant increase
• → Reducing false positives and automating Tier-1 tasks are the top priorities for SOCs in the next 12 months
• → 64% say automated alert triage and prioritization would deliver the most value, followed by investigation assistance (54%)
• → 24% of alerts are ignored or closed without investigation, driven more by process inefficiencies and tool fragmentation than volume alone
• → Context switching and tool fragmentation surpass alert fatigue as the #1 operational challenge
• → Only about one third of organizations have dedicated threat hunters — 65% lack them entirely
• → Trust and accountability concerns are the top barrier to operationalizing AI, cited by half of respondents