Cybersecurity has become an operational priority as businesses depend increasingly on connected systems, cloud applications, digital platforms, and online transactions. This growing digital footprint has also created more opportunities for attackers to exploit vulnerabilities, disrupt operations, and demand ransom payments.
For organizations, the challenge is no longer simply deploying security tools. They must continuously monitor their IT environments, identify genuine threats among large volumes of security events, and respond before an incident affects business operations. Security operations centers (SOCs) have become an important part of this effort by bringing monitoring, detection, and response into a coordinated process.
Artificial intelligence is adding another dimension to this approach. By helping security teams analyze large volumes of data, filter false positives, and automate selected responses, AI can improve the speed and efficiency of security operations. However, effective cybersecurity still depends on human judgment, sound processes, and an understanding of how attackers exploit weaknesses.
In this episode of the Analytics Insight Podcast, Priya Dayalani speaks with Subir Sangal, CEO and co-founder of Eagle Information Systems, about the changing role of SOCs, the growing use of AI in cybersecurity, and the importance of making security accessible to small and medium-sized enterprises (SMEs).
The conversation also examines how organizations can measure SOC performance, prepare for AI-driven attacks, and balance automation with human oversight.
Here are the excerpts from the interview:
Eagle Information Systems has operated for more than three decades, providing IT services to customers across India. According to Sangal, the company offers managed services covering several aspects of IT operations, including staff augmentation, project management, third-party maintenance, application management, and infrastructure support.
Cybersecurity has become an increasingly important part of this work as businesses have moved more activities to digital platforms. Email, websites, cloud applications, networks, and connected devices create opportunities for attackers to gain unauthorized access and disrupt operations.
Sangal explained that Eagle is particularly focused on helping SMEs understand and address these risks. While large enterprises often have dedicated security teams and substantial budgets, smaller businesses may underestimate their exposure or assume that attackers will primarily target larger organizations.
This assumption can leave smaller companies with limited protection. An attack could disrupt operations, expose sensitive information, or threaten years of business investment.
Sangal said Eagle wants to help SMEs understand that cybersecurity does not necessarily require a massive budget. He cited monthly spending of approximately Rs. 20,000 to Rs. 50,000 as an illustrative starting point for some smaller businesses, depending on their requirements.
As a co-founder, Sangal describes his role as helping customers solve problems and keep their IT environments running smoothly. This reflects the company's stated motto, 'Keep Going,' which connects reliable IT operations with business continuity.
Digital operations no longer follow conventional office hours. Websites, email systems, cloud applications, and customer-facing platforms remain accessible outside normal working hours, leaving organizations exposed to potential attacks at any time.
According to Sangal, this continuous availability makes round-the-clock monitoring increasingly important. Organizations cannot assume that their systems are safe simply because employees have left the office.
A SOC addresses this challenge by collecting security events from connected IT assets, including desktops, laptops, firewalls, cloud environments, email systems, and business applications. Security teams then analyze these events to distinguish potentially malicious activity from routine operations.
The purpose is not simply to collect more information. It is to identify suspicious behavior and determine which events require investigation or intervention.
Without continuous monitoring, organizations may miss threats that emerge outside working hours. A coordinated SOC helps bring security signals together and supports a more consistent approach to detection and response.
For businesses that depend on uninterrupted digital services, this capability is closely linked to operational continuity. The objective is to identify and address threats before they cause significant disruption.
One of the major challenges facing SOC teams is the volume of security events generated by modern IT environments. A single computer can produce tens of thousands of events in a day, according to Sangal. The volume grows considerably when organizations operate hundreds or thousands of devices.
Manually reviewing every event is impractical. Security teams must instead determine which signals indicate genuine threats and which reflect normal activity.
Sangal identified automation and AI as important tools for managing this workload. Rules and automated analysis can help filter routine events, identify false positives, and reduce the number of alerts that require human attention.
He illustrated the challenge with an example in which millions of daily events need to be reduced to a much smaller number of meaningful alerts. Security analysts can then investigate the remaining cases and identify the events that represent actual malicious activity.
The objective is to narrow the gap between raw security data and actionable findings. A large number of events does not necessarily indicate a large number of threats, and a high alert count does not automatically mean that a SOC is performing effectively.
AI can help security teams prioritize their attention, but the quality of detection remains important. Organizations need to ensure that the filtering process does not discard genuine threats along with false positives.
For SOC leaders, the operational priority is therefore to improve the quality of alerts while preserving the ability to detect and respond to attacks.
AI is creating new capabilities for defenders, but attackers can also use it to increase the speed and scale of their activities. Sangal acknowledged that keeping pace with evolving attacks remains a continuing challenge for security operations.
He emphasized the role of human expertise in anticipating possible attack scenarios and developing response playbooks. These playbooks can guide how security systems respond to threats such as denial-of-service attacks, brute-force attempts, and phishing campaigns.
AI agents can then be trained or configured to support responses to specific scenarios. When an attack occurs, security teams can examine how it developed, how the organization responded, and what changes might improve future protection.
This creates an opportunity for continuous improvement. Lessons from previous incidents can inform detection rules, response procedures, and the training of AI systems.
However, this approach requires more than deploying automated tools. Organizations must anticipate plausible threats, test their response processes, and update their systems as attack methods change.
Sangal's perspective highlights the need to combine AI-driven speed with human understanding. Automation can handle repetitive analysis and defined response tasks, while people remain responsible for interpreting complex situations and improving the overall security strategy.
The challenge for SOCs is to keep adapting as both defensive and offensive capabilities evolve.
Operating a SOC around the clock does not automatically mean an organization is becoming more secure. Business leaders need to understand whether their security investment is improving detection, response, and resilience.
Sangal identified business continuity as the ultimate objective: preventing a cyberattack from bringing an organization's operations to a halt. However, he also acknowledged that no security approach can guarantee that every attack will be prevented.
Organizations should therefore examine how effectively their SOC processes large volumes of events and identifies meaningful threats. The proportion of events that become actionable alerts can provide one indication of how effectively the system filters routine activity.
Another consideration is how many genuine attacks security teams can address through automation. Sangal referred to security information and event management (SIEM) and security orchestration, automation, and response (SOAR) tools as part of this process.
These tools can help organizations collect and analyze security information, coordinate response workflows, and automate selected actions.
The broader lesson is that organizations should assess outcomes rather than activity alone. Counting investigated alerts provides information about workload, but it does not fully explain whether threats were detected, contained, or prevented from disrupting operations.
Security leaders must consider how detection and response affect business continuity, organizational risk, and the ability to maintain reliable services.
Cybersecurity is not limited to large enterprises. Sangal argued that small businesses face similar exposure because attackers often search for exploitable weaknesses without distinguishing between large and small organizations.
Automated scanning tools can identify vulnerable systems across the internet. As a result, a smaller company with limited security resources can become a target even if it does not hold the same volume of data as a large enterprise.
The consequences can also be severe. A ransomware demand or prolonged service disruption could threaten a small business that has spent years building its customer base and operations.
Sangal emphasized that SMEs should treat cybersecurity as a necessary business investment rather than a capability reserved for organizations with large IT departments.
He suggested that monthly spending of Rs. 20,000 to Rs. 50,000 may be sufficient to begin addressing security needs for some smaller businesses, although actual costs will depend on the organization's size, infrastructure, exposure, and protection requirements. This figure should be understood as an example from the discussion, not a universal budget recommendation.
To explain the principle, Sangal compared cybersecurity with locking the front door of a house. More advanced protections may be useful, but basic safeguards should come first.
For businesses, this means addressing fundamental vulnerabilities before investing in more complex security arrangements. The specific measures will vary, but the underlying priority is to establish essential protections and build from there.
For SMEs, a practical security strategy should focus on reducing avoidable vulnerabilities, understanding potential risks, and identifying the level of monitoring and response support the business requires.
The future of SOCs is likely to involve deeper integration of AI, automation, and advanced analytics. Sangal expects the amount of human effort required for routine security operations to decrease as automated systems become more capable.
He suggested that human involvement could fall to 10% or even 5% in some aspects of SOC operations over the next five years, with further automation remaining an ambition. These figures represent his outlook rather than an established industry forecast.
The broader direction is toward systems that can handle more routine scenarios with less manual intervention. AI agents could support monitoring, alert analysis, and responses to predefined attack patterns, allowing security teams to concentrate on cases requiring investigation and judgment.
Achieving this level of automation will depend on how effectively organizations prepare for different attack scenarios, train their systems, and learn from incidents. Automated responses also need appropriate controls to reduce the risk of incorrect actions or missed threats.
Human expertise will therefore remain relevant, particularly when an incident falls outside established playbooks or requires decisions involving business risk.
The future SOC may be more automated, but its effectiveness will still depend on the quality of its data, the strength of its response processes, and the ability of security professionals to guide and evaluate the technology.
For organizations, the objective is not automation for its own sake. It is to improve threat detection, reduce response delays, and protect business operations as the threat landscape continues to change.
Listen to the full discussion on the Analytics Insight Podcast to hear Subir Sangal's perspective on the evolution of security operations centers and AI-driven cybersecurity.