This model is based on two assumptions that were already false before AI and are now beingused to oversimplify the SOC operating cost structure — selling an ROI story that collapses before it's even implemented.

First, it prices runtime inference when the return is in compiled judgment — rules that fire once,suppressions that eliminate whole alert classes, playbooks that execute without a model.Second, it imports a human-in-the-loop operating model into an environment where attacks move at machine speed. You cannot supervise your way to parity with an adversary that doesn't sleep, doesn't tire, and doesn't wait for your approval queue to drain.

A SOC is not one workload with a cheaper worker. It is a portfolio — detection engineering,threat hunting, intel enrichment, incident reconstruction, response orchestration, reporting —and each workload has different economics, different model requirements, different maturity curves, and different time scales.

These workloads differ by orders of magnitude in volume, ambiguity, and blast radius. Running them all through one frontier model is economically and operationally wrong. The cost architecture of AI in the SOC is the model-to-workload mapping.

Match the model to the task — and to the maturity of the workflow

Model pricing spans roughly three orders of magnitude, from embeddings to frontier reasoning models:

• Tier 0 — No model. Deterministic rules, cached verdicts, lookup tables for anything seenbefore. A recurring alert pattern should hit a hash table, not a transformer.
• Tier 1 — Embeddings and small classifiers. Dedup, clustering, similarity search againstpast incidents.
• Tier 2 — Small, fast LLMs. Enrichment, entity extraction, routine classification, ticketsummaries.
• Tier 3 — Mid-tier models. Multi-alert correlation, investigation support, playbook drafting.
• Tier 4 — Frontier reasoning models. Novel investigations, hunting hypotheses,detection rule synthesis. Expensive and worth it — because this tier's output, done right,is a reusable artifact, not a transient verdict.

But the task type is only half the mapping. The other dimension is workflow maturity. A new workflow starts on a frontier model because the problem is still ambiguous — you're using themodel's reasoning to discover what good looks like. As the workflow matures, the ambiguity gets squeezed out and captured in a well-constructed prompt: explicit criteria, worked examples, defined edge cases, structured output. At that point a much cheaper model, guidedby that hardened prompt, matches frontier performance on the narrowed task at a fraction of the cost.

The discipline that makes this migration safe is sampled monitoring. You don't need to reviewevery output of a downgraded workflow — you need a statistically honest sample, weighted toward the cases humans have flagged. Human-flagged results are the highest-signal data inthe system: they mark exactly where the cheap model's judgment diverges from expert judgment. If the sample holds, keep the savings. If it drifts, the flags tell you whether to fix theprompt or bump the tier back up.

So the diagnostic becomes: plot inference spend by tier over time. Healthy deployments showworkflows migrating down — frontier discoveries becoming cheap-model procedures becomingTier 0 rules. A static distribution means you're renting judgment instead of accumulating it.

Human on the loop, not in the loop

Per-decision approval — classic human-in-the-loop — puts a variable supervision cost on every transaction and turns analysts into full-time reviewers. Worse, it fails at its own job: a human rubber-stamping their 400th AI verdict of the day is a formality with a salary, not a control.The feasible model is human-on-the-loop: supervise the system, not the transaction.

• Policy, not approvals. Define what the AI may do autonomously, bounded by blastradius: read-only analysis everywhere, autonomous action on reversible operations,approval gates only for consequential irreversible ones (isolating a production host,disabling an account).
• Calibration review, not verdict review. Audit the sampled results described above;monitor false-negative rates, confidence calibration, and drift in aggregate.
• Escalation by exception. Genuinely ambiguous cases route up; senior judgment goeswhere it was always needed.

The economics follow: on-the-loop supervision is roughly a fixed governance cost, whilein-the-loop cost scales with volume. Every measured expansion of the autonomous envelope converts a variable cost into a fixed one.

The maturation loop: AI as compiler, not runtime

The architectural mistake in most deployments is leaving the AI in the transaction path forever.Treat it instead as a discovery mechanism whose findings graduate into deterministic code:

1. Explore with frontier models — which rules are noisy, which correlations indicatecompromise, what the right response to a recurring pattern looks like.
2. Compile the judgment into artifacts: tuned detection rules pushed back into the SIEM,suppression logic at the source, codified playbooks. Deterministic, auditable, zeromarginal token cost.
3. Reserve AI for novelty and drift — detecting environmental change and proposing thenext compilation cycle, not re-deriving the same verdicts daily.

One tuning decision that stops a noisy rule from firing eliminates thousands of future inferencecalls and reviews. The payoff never appears on a per-alert cost slide, because it consists ofalerts that never existed.

Building your own agents: the hidden costs, and how to carry them

Your team should build agents — nobody knows your environment, your priorities, or your weird legacy log sources better. A capable engineer can stand up a triage agent in a weekend, and itwill work. The trap isn't building; it's what building doesn't include, because the threat landscape is adversarial and agents must evolve:

• Input streams. An agent wired only to your telemetry learns about a novel attack patternwhen it hits you.
• Feedback loops. Verdict calibration, drift detection, regression testing against an evalcorpus. Without this, agents silently degrade — and in security, silent degradation ends upin an incident report.
• Churn absorption. Model deprecations, SIEM/EDR/SOAR API changes, prompt andtool-schema maintenance. Individually small; together a standing engineering tax.

Carried alone, these costs land on your team at full weight and compete with the security workyou actually built the agents to enable. When provided by your SOC platform, they're amortizedacross that vendor's entire customer base — and the input-stream problem inverts: an emergent threat surfaced in one customer's environment hardens detections for every other customerbefore it arrives.

The right architecture is both: your team builds the agents that encode your environment'sjudgment, on a platform that supplies the eval infrastructure, drift monitoring, cross-customer threat signal, and integration maintenance underneath them. The honest comparison isn't"platform vs. free DIY" — it's "platform subscription vs. a permanent internal platform team,minus the cross-customer signal." That delta is positive, and it's the line item the weekend demohides.

The buyer's checklist

1. What's the model-tier distribution, and does it shift over time?
   Static distribution means nothing is graduating to cheaper tiers or code.
2. What happens to the token bill at 2x alert volume?
   Linear scaling is renting judgment, not accumulating it.
3. What artifacts persist if the AI is turned off?
   "Nothing" means the learning lives in inference calls, not your environment.
4. How are downgraded workflows monitored?
   Sampled, human-flag-weighted review is the right answer; "we don't downgrade" meansoverpaying, "we don't monitor" means drifting.
5. Do novel attacks update your IOC lists or evolve your agents?
   Threat intel is necessary but insufficient — it ships indicators, not contextualizedintelligence.

The right mental model

AI in the SOC is not a cheaper analyst, and it is not one workload. It's a portfolio of tasks servedby a tiered model architecture, where workflows migrate to cheaper tiers as they mature,supervision happens at the system level, and the AI is constantly compiling its own discoveriesinto durable procedures that no longer need it.

Priced as a faster analyst, AI hits hard ceilings. Priced as a judgment compiler with a governance plane, the ceilings dissolve. Buy the compiler, not the runtime — and build youragents on something that carries the costs you shouldn't carry alone.