The SOCs isn't just a function in the age of AI Era by Dr. Yusuf Hashmi

Time of India

04-07-2025

HighlightsWhy SOC fatigue is a systemic risk, not an analyst issue The role of AI, agentic models, and automation in optimizing MTTR How to design SOCs that scale with relevance, not just volume The intersection of DPDP, data lineage, and SOC accountability The irreplaceable role of human context in an AI-augmented security world
In this DeepTalks session, Dr. Yusuf Hashmi, Group, CISO at Jubilant Bhartia Group, reimagines the SOC, tackling AI-assisted triage, alert fatigue, data governance, DPDP liability, and the rising cost of log inflation, to present a bold, practical vision for future-ready security operations.In the dimly lit war rooms of cybersecurity, the Security Operations Centers (SOCs), thousands of alerts blink on screens every minute. Analysts scan dashboards, eyes darting, trying to distinguish between noise and the one anomaly that could bring an enterprise to its knees. But in today's AI-fueled world, even these battle-tested security models are showing signs of exhaustion.
'It's time we stop seeing the SOC as just a dashboard of alerts,' says Dr.
Yusuf Hashmi
, Group CISO at Jubilant Bhartia Group, in a gripping and wide-ranging conversation with ETCIO DeepTalks. 'We must reimagine it as a cockpit, one that is predictive, autonomous, and human-aware.'
Dr. Hashmi isn't just describing a shift in tools. He's championing a cultural and architectural transformation, one that demands leadership rethink how security operations are structured, automated, and governed.
The breakdown begins
The conversation opens with a blunt diagnosis: the traditional SOC is broken.
'There used to be a handful of firewall logs coming in. Today, we're ingesting data from 60-70 different log sources,' Dr. Hashmi explains. 'From endpoints to proxies, from cloud to identity - the ecosystem is sprawling. And each of these sources needs contextual use cases. But most organizations aren't ready for that.'
This, Dr. Hashmi says, creates the perfect storm for alert fatigue, a silent killer in cybersecurity. Analysts are overwhelmed, incidents are missed, and trust in the SOC dwindles.
AI's promise and pitfalls
Dr. Hashmi sees AI not as a silver bullet, but as a powerful enabler, if implemented wisely.
'AI can triage, correlate, enrich. It can suppress false positives and help prioritize what matters. But AI must be trained. It doesn't mature out of the box. You need 5 to 6 months, sometimes longer, to adapt a model to your data,' Dr. Hashmi warns.
Dr. Hashmi emphasizes the agentic model, using AI-powered agents to take over repetitive, mundane triage tasks so human analysts can focus on critical decision-making. But the contextual layer, he insists, must remain human.
Dr. Hashmi also says 'AI can automate. But it cannot replace the analyst's gut instinct, their ability to think outside the box. That's irreplaceable.'
Integration nightmares & log inflation
At the heart of SOC dysfunction lies a quietly growing monster: log overload.
'Many organizations don't understand what they're ingesting,' Dr. Hashmi says. 'EPS (Endpoint security) peaks go through the roof. And half those logs? They're noisy. They're being stored, processed, and paid for, but they add no value.'
Dr. Hashmi's advice: optimize for relevance, 'You don't need everything. You need what helps you correlate, detect, and
respond
. Everything else is an expensive distraction.'
From alert fatigue to MTTR anxiety
Metrics like
Mean Time
to Detect (MTTD) and Mean Time to Respond (MTTR) have become the new holy grails of SOC performance. But as Dr. Hashmi points out, they're only as good as the underlying architecture and logic.
'If you don't fine-tune your rules, if your alerts aren't contextualized, your MTTA and MTTR suffer. Analysts waste time chasing irrelevant noise, and that one critical alert gets buried.'
The fix? Smarter alerting. Better enrichment. Fewer false positives. And yes, more AI-powered correlation engines that understand behavioral baselines.
The compliance curveball: DPDP's impact on SOCs
With India's Digital Personal Data Protection (DPDP) Act coming into force, Dr. Hashmi sees new pressure on SOC teams especially around personal data ingestion.
'If your SOC is processing DLP logs, you may be dealing with personal data. That means you're accountable under the DPDP. You need governance, visibility, and traceability.'
He calls for greater attention to data lineage, understanding where data comes from, how it's stored, who accesses it, and how long it remains within systems.
'Security without governance is a ticking bomb. You need to know your data trail end to end.'notes Dr. Hashmi.
SOC design: It's not about tools. It's about context.
When asked what makes a modern SOC truly effective, Dr. Hashmi offers a precise and measured answer:
Scalability: The platform must handle peak volumes.Prebuilt Use Cases: MITRE ATT&CK-aligned rules save time.Usability: Analysts need intuitive, investigation-friendly interfaces.Cost Awareness: Know your licensing model EPS vs storage.Reporting Clarity: MTTR, MTTD, FP rates these are your compass.
But Dr. Hashmi's quick to emphasize that no model fits all. 'You must understand your environment. Your threat landscape. Your business impact. No Gartner quadrant can define your context better than you.'
The ROI dilemma and the AI hype trap
Every CISO today is asked the same thing: What's the ROI on security? Dr. Hashmi believes it starts with asset valuation.
'If you don't know the value of what you're protecting, how will you measure loss? Understand your assets. Quantify their downtime impact. Then map your SOC outcomes against that.'
He also cautions against AI - FOMO
'Many CISOs buy AI tools just because they're trending. But if your MTTA isn't improving, your response time hasn't dropped. What did you really gain?' says Dr. Hashmi.
On MDRs, cloud SOCs, and cost-efficient architectures
For organizations lacking in-house expertise or infrastructure, Dr. Hashmi recommends SOC-as-a-Service or Managed Detection & Response (MDR) models.
'Not everyone needs an on-prem SOC. If you're a smaller firm, MDR can be a life-saver, no licensing, no infra management, no staffing nightmares.'
Dr. Hashmi also advocates for cloud-based SOCs with high availability and easy scalability, especially when uptime and redundancy are mission-critical.
In perhaps the most poignant part of the conversation, Dr. Hashmi speaks of the unsung heroes of the SOC, the analysts.
'They run 24x7. They're the stars of the security function. But we overload them with Excel reporting, compliance checklists, and fatigue. That has to stop.' pointed Dr. Hashmi.
Dr. Hashmi also urges CISOs to sit with their SOC teams, understand their world, and build empathy into governance. 'The SOC isn't just a function. It's your shield. If you love it, you'll nurture it.'
In a world increasingly driven by automation, Dr. Hashmi reminds us that passion still powers the best defenses. 'SOCs are like goalkeepers. They don't get applause until something goes wrong. But they're your last line of defense, and your first line of attack.'
To modernize a SOC, organizations must combine the power of AI with the wisdom of human intelligence, supported by architecture that scales, data that's governed, and leadership that listens.
Because in cybersecurity, it's not just about fighting threats, it's about earning trust, concludes Dr. Hashmi.