AI Agent Automation of Security Operations Center Analysis

doppel · Tech · 2025 · source Agentic: yes · promotional bias: high · source-backed · extracted with prompt 0.5.2 (schema v2)

Generated from extraction.json — do not edit by hand. Every claim cites verbatim source evidence; stated means the quote directly asserts the claim, implied means it supports it indirectly.

Problem

Domain: Cybersecurity SOC analysis

Doppel needed to automate nuanced security decisions across millions of daily phishing and abuse signals without increasing false positives.

Constraints:

• high-impact takedowns
• unstructured evidence
• customer-specific policies
• feedback loop

Architecture

Doppel automated part of its SOC decision workload by placing an OpenAI o1-based analyst agent after high-volume data ingestion and traditional ML filtering. The agent was trained like a human analyst on phishing, malware, and brand-abuse policy, then improved with thousands of curated historical analyst decisions. New examples feed a continuous learning loop, while human analysts shift toward complex threat patterns as the agent handles routine classification and response decisions at scale.

Diagram confidence: reconstructed (reconstructed from prose).

flowchart LR
  threat-data-ingestion[Threat data ingestion] --> traditional-ml-filter[Traditional ML filter]
  traditional-ml-filter --> soc-decision-agent[SOC decision agent]
  analyst-training-curriculum[Analyst training curriculum] --> soc-decision-agent
  historical-decision-corpus[Historical decision corpus] --> soc-decision-agent
  continuous-feedback-loop[Continuous feedback loop] --> soc-decision-agent
  soc-decision-agent --> human-analyst-queue[Human analyst queue]

Components

Data flow

Doppel ingests web, social, and mobile-app signals at phishing-defense scale. Traditional machine learning filters obvious false positives, leaving judgment-heavy cases for the o1-based SOC agent. The agent evaluates screenshots, time-series activity, and customer policies using analyst training and historical decisions, classifies whether action is needed, and learns from new examples so analysts can concentrate on complex threat patterns.

Why this architecture

Doppel did not rely on generic classification alone because SOC actions require policy judgment, explanation, and high-stakes accuracy. The architecture combines an existing ML filter for easy cases with an agent trained on analyst curriculum and historical decisions for edge cases, leaving humans focused on complex patterns.

Models used: OpenAI o1

Scale

• The input scale is more than 10 million daily websites, social accounts, and mobile apps.
  “Every day, Doppel ingests more than 10 million websites, social media accounts, and mobile apps to identify phishing attacks worldwide.”article, stated
• The deployed agent automated 30% of SOC workload within 30 days.
  “At Doppel, we automated 30% of our security operations workload in less than 30 days with our new AI agent.”article, stated
• Doppel claims the agent lowered false positives, found more genuine threats, and delivered faster responses.
  “Compared to our human analysts, the agent had a lower false-positive rate and uncovered more genuine threats. For Doppel, this shift allowed our analysts to focus on complex threat patterns while the AI handled routine decisions at scale.”article, stated

Alternatives considered (roads not taken)

Traditional ML filtering alone

Rejected because: It handled obvious false positives but left nuanced decisions too time-consuming for manual analysts.

Knowledge-transfer training without curated historical decisions

Rejected because: The initial curriculum improved performance but still missed non-obvious scenarios until historical analyst decisions were added.

Keep all nuanced decisions in the human SOC queue

Rejected because: The agent took routine decisions at scale so analysts could spend attention on complex threat patterns.

Patterns

fine-tuning-adaptation (model-operations)

The agent internalized analyst expertise through knowledge transfer and curated historical decisions.

data-quality-loop (model-operations)

Doppel emphasizes continuous learning from new examples as threats evolve.

Tradeoffs

What work should be automated in SOC operations.

Chose routine high-volume decisions by the agent over manual handling of every nuanced decision.

Rationale: The agent handles routine scale so analysts can focus on complex threat patterns.

SOC workload split.

Chose agent automation for routine decisions with analysts focused on complex patterns over manual analyst handling for every nuanced decision.

Rationale: The agent absorbed high-volume routine decisions while preserving human attention for difficult threat patterns.

Agent training signal.

Chose curated historical analyst decisions in addition to analyst curriculum over knowledge-transfer training alone.

Rationale: Historical decisions supplied the edge-case judgment that the initial analyst-style curriculum did not fully provide.

Gotchas (what bit them)

SOC decisions could not be reduced to simple pattern matching.

Root cause: Analysts must interpret screenshots, time-series activity, and customer policies while explaining rationale.

Resolution: Train the agent as a cybersecurity expert and distill historical analyst decisions into it.

Evaluation

Doppel compared agent performance against analyst benchmarks and operational workload reduction.

Metrics: 30% SOC workload automated · lower false-positive rate · more genuine threats

Outcomes

• Doppel reports automating 30% of SOC workload in less than 30 days.

Promotional company blog; claims should be treated as vendor-reported.