Data Security Decoded – Episode Summary

Episode Title: AI-Driven Cyber Defense in Action: How AI Agents Are Saving SOC Analysts From Burnout
Date: June 4, 2025
Host: Caleb Tolan (Rubrik)
Guest: Grant Oviat (Head of Security Operations, Profit Security)

Episode Overview

This episode delves into the real-world impact of AI agents in security operations centers (SOCs). Host Caleb Tolan interviews Grant Oviat, an industry veteran, about the transformative shift AI is bringing to cyber defense—relieving SOC analysts from burnout, enhancing efficacy, and tackling sophisticated and mundane security challenges. The discussion covers trust in AI, the evolving role of security analysts, real examples of AI in action, challenges like hallucinations, and practical guidance for organizations looking to adopt AI-driven security solutions.

Key Discussion Points & Insights

The Promise of AI Agents in Security Operations

• AI Agent “ChatGPT Moment”:
  Grant recounts the breakthrough when it became evident that AI agents could reliably perform security tasks, not only catching previously missed threats but also eliminating tedious, repetitive work.

  “Our ChatGPT moment was effectively seeing that AI agents can successfully perform security tasks, and we've been starting to see the results of both identifying threats that people have been missing and removing all that tedious work that analysts hate to do and didn't get into Security 4 in the first place.” – Grant Oviat [00:00, 01:57]

• 95% Reduction in False Positives:
  Profit Security’s AI solutions have drastically reduced alert fatigue by cutting false positives by 95%, helping analysts focus on real threats.

  “The net impact so far has been a dramatic around 95% reduction in false positive activity that folks have seen.” – Grant Oviat [03:05]

Impact Stories: AI in the “Security Battlefield”

• Business Email Compromise (BEC) Examples:
  AI identifies BEC incidents—where initial login events may seem innocuous but actually signal risk—at a speed and accuracy impossible for humans. Tasks that took hours or days are now done in 5 to 10 minutes.

  “We've been able to take investigations that historically have taken people hours or days and compress that to five, 10 minutes.” – Grant Oviat [04:16]

• Ransomware False Alarm Case:
  During a proof-of-value (POV) trial, a customer spent an entire day on what turned out to be a non-incident. Only after recalling their AI onboarding did they let the system investigate. In eight minutes, the AI provided a better outcome, demonstrating its efficiency and accuracy.

  “In eight minutes, they said we did a better investigation than they did and would have saved them the rest of their day not running something down that wasn't actually ransomware.” – Grant Oviat [04:16]

Addressing Concerns: Will AI Replace SOC Analysts?

• AI as Augmentation, Not Replacement:
  Grant empathizes with those fearing job loss to AI but clarifies that AI offloads tedious work, allowing human analysts to focus on impactful, fulfilling tasks—the 5-10% of their roles that require creativity and critical thinking.

  “Our goal is to take all the boring, ugly, but important responsibilities away from security operations so they can effectively level up and do the things they got into the industry for.” – Grant Oviat [06:57]

Changing the Cybersecurity Career Pipeline

• Lowering Barriers for New Entrants:
  Contrary to fears, AI may make it easier for career switchers and newcomers to enter the field by removing heavy technical barriers. Curiosity and investigative thinking become more important than mastering every tool.

  “My hypothesis is it's actually going to reduce the barrier for folks that are inclined to move into these types of roles to actually be successful faster.” – Grant Oviat [08:57]

• Success Story: College Grads Utilizing AI:
  New interns, paired with AI tools, achieved outcomes comparable to senior analysts in a short period.

  “They're operating more like a senior analyst today than someone that's entry level ... because they understand the investigative thought process better and are able to ask questions without getting bogged down.” – Grant Oviat [08:57]

Lighthearted Moment: The Fictional Agent Hot Take

• Fun Segment – Which Fictional Agent Would You Pick as an AI?
  • Caleb chooses Juni Cortez from Spy Kids for his gadget prowess. [10:57]
  • Grant draws a parallel to Tom Cruise’s character in Mission Impossible, likening the relentless, tireless agent to the ideal role of AI in SOC operations.

    “The AI agent path is sort of never tires, never sleeps, deals with the work that you don't want to do ... new Mission Impossible probably resonates most.” – Grant Oviat [12:03]

AI Strengths and Human Necessity

• AI Excels At:

  • Reasoning in ambiguous scenarios and piecing together evidence,
  • Automating routine investigations and response actions,
  • Accelerating detection and remediation.

• Human Superiority In:

  • Supplying deep organizational and situational context (“everyone is a snowflake”),
  • Final decision-making where policy or unique business nuances matter,
  • Providing emotional intelligence during critical incidents.

  “The thing that requires the human touch is still around context today. ... We're really big personally ... of raising our hand and saying we don't know the answer ... but prodding the user for some additional bits of context ... has been an element that's of customization.” – Grant Oviat [13:20]

Tackling Hallucinations and Building Trust

• Combating AI Hallucination:
  Grant underscores transparency: all conclusions are rooted in raw evidence, and AI agents must “show their work”—no fabricating answers.

  “It's kind of like math class. Like showing your work and your answers to how you got the answers to the problem is more important than the answer itself.” – Grant Oviat [16:20]

• Trust Mechanisms:

  • Transparency in investigation steps,
  • Rigorous customer testing in live environments,
  • Over-sharing data transformation and evidence chains,
  • Encouraging direct comparison between traditional and AI-driven results.

  “We're pretty pushy around, like, hey, go try this in your environment. Like don't take my word for it, like, go see this in action ... sort of asking people to take it through the paces.” – Grant Oviat [18:13]

Practical Guidance: How to Adopt AI in the SOC

• Start Small, Test Rigorously:
  Adopting AI for summarization and investigation formatting is a safe on-ramp. Selecting a specialized, transparent product is essential for mission-critical tasks.

• Ask the Tough Questions:

  • How are accuracy and false negatives measured?
  • What evidence is provided for decisions?
  • Can you compare results to traditional workflows?
  • Are there clear audit trails?

  “Just be aware of kind of your testing criteria of what you're looking for. I think most folks bar for AI is higher than humans. It needs to be better than what that output is in order for it to be worthwhile or take the risk.” – Grant Oviat [20:15]

Memorable Quotes

• “AI agents never tire, never sleep, and can perform these actions.” – Grant Oviat [00:00]
• “The net impact so far has been a dramatic around 95% reduction in false positive activity that folks have seen.” – Grant Oviat [03:05]
• “Our goal is to take all the boring, ugly, but important responsibilities away from security operations so they can effectively level up and do the things they got into the industry for.” – Grant Oviat [06:57]
• “It's kind of like math class ... showing your work is more important than the answer itself.” – Grant Oviat [16:20]

Timestamps for Key Segments

• 00:00 – Grant’s “ChatGPT Moment” and vision for AI agents in SOCs
• 03:05 – Impact: 95% reduction in false positives
• 04:16 – Real-world examples: AI catching BEC and handling ransomware alerts
• 06:57 – The future role of the SOC analyst alongside AI
• 08:57 – AI’s influence on cybersecurity career paths and education
• 10:57 – Fun: “Which fictional agent would you trust as your AI?”
• 13:20 – What AI agents do best, and where humans still shine
• 16:20 – Combating hallucinations, ensuring evidence-based outputs
• 18:13 – Building trust and transparency in AI-driven security
• 20:15 – Advice for organizations seeking to deploy AI in their SOCs

Conclusion

This episode offers an optimistic yet practical look at how AI is transforming SOC operations—elevating analysts rather than eliminating them, accelerating response and reducing burnout, and gradually lowering the barriers to entry into cybersecurity. Grant Oviat’s perspective is reassuring for both current professionals and aspiring entrants, emphasizing trust, transparency, and the necessity of human expertise within AI-augmented defense teams.