SOAR in the AI era: how SAP uses intelligent workflows to build an AI SOC

SOAR (Security Orchestration, Automation, and Response) has traditionally helped security teams automate and streamline core operations, but the current AI era is driving a significant evolution. As cloud environments expand, manual processes struggle to meet demands, necessitating intelligent systems that adapt to their context using AI. SAP is pioneering this shift, creating what they term the AI SOC, which integrates AI-driven insights with human oversight to accelerate and enhance security operations. This approach helps handle massive data volumes, with SAP processing nearly 100 terabytes daily, and addresses the complexity and opportunity presented by advanced detection engineering. SAP's strategy focuses on improving speed, consistency, and governance without sacrificing control or trust by automating repetitive tasks, enhancing detection accuracy, and creating intelligent workflows that marry AI's analytical capabilities with human judgment. This transformation aims not to replace humans but to empower them, enabling faster, more efficient security responses and laying the foundation for a resilient, proactive AI-driven security framework that emphasizes auditability, compliance, and collaboration between humans and AI.