AI Delivers Value Only When It’s Built Into the Security Workflow

– Christophe Briguet, Sr. Director of Product Management – AI & Security Analytics, Stellar Cyber

San Jose, Calif. – Jul. 21, 2026

Every security leader has heard the promise by now: AI will transform security operations.

It will reduce alert fatigue. It will accelerate investigations. It will make analysts more productive. It will help teams do more with less.

The promise is real, but there is a catch. AI does not improve security outcomes simply because a model is available. AI improves outcomes when it has the right context, operates inside the right workflow, follows the right controls, and earns the trust of the people who have to act on its output.

That is where many AI security conversations fall short. Most SecOps teams are not short on tools. They are short on time, context, consistency, and confidence. Alerts arrive from dozens of sources. Analysts move between consoles. Cases are built manually. Response actions often happen in separate systems. MSSPs have to manage all of this across many customers, each with different tools, data formats, escalation paths, and operating models.

In that environment, adding a generic AI assistant does not solve the core problem. It may summarize an alert or answer a question, but if it sits outside the actual detection, triage, investigation, and response workflow, it becomes another tool to manage.

The next phase of AI in security operations is not about adding more AI. It is about making security workflows ready for AI.

AI Needs More Than a Prompt

For AI to be useful in SecOps, it needs operational context. It needs to understand the case. It needs access to alert details, affected users, assets, tenants, timelines, telemetry, risk scores, historical activity, and available response options. It also needs to work within clear permissions and boundaries.

This is especially important for MSSPs and MDR providers. In a multi-tenant environment, AI cannot blur customer boundaries. It cannot act without tenant awareness. It cannot treat all data as equally accessible. It has to respect access control, data separation, customer-specific policies, and operational guardrails.

That is why Stellar Cyber 6.5 introduces Early Access support for the Stellar Cyber MCP Server, enabling approved AI clients to connect to the Stellar Cyber Platform through the Model Context Protocol.
The significance is not simply that another AI integration exists. The bigger point is that MCP creates a governed path for AI to interact with structured SecOps context. Instead of treating AI as a disconnected assistant, Stellar Cyber is creating a way for approved AI clients to work with relevant case and alert data, controlled access, and tenant-aware context.

That is the kind of foundation AI needs if it is going to become part of real security operations.

The Case Is Where AI Becomes Useful

Security operations should not revolve around isolated alerts. They should revolve around cases. An alert tells you something happened. A case helps you understand whether it matters.

Cases bring together related evidence: alerts, observables, users, hosts, network activity, cloud events, identity signals, timelines, MITRE ATT&CK context, risk scores, and response recommendations. That is the right unit of work for AI because it provides the context needed to support triage and investigation.

Stellar Cyber 6.5 improves the analyst experience inside Cases with real-time triage status updates. Analysts can see when analysis is in progress, when the AI-generated summary is ready, and when the case is prepared for review.

That may sound like a small workflow enhancement, but it reflects a larger principle: teams need visibility into what AI is doing.

AI cannot feel like a black box. Analysts need to know when analysis is still running, when the output is ready, and when human review is required. Managers need visibility into progress. MSSPs need repeatable workflows that can scale across tenants and analysts.

Real-time triage status makes AI-assisted investigation feel less like an external tool and more like part of the operational flow.

Human-Augmented Autonomy Requires Clear Handoffs

The future of SecOps will not be fully manual. It also should not be fully autonomous without oversight.

The practical model is human-augmented autonomy: AI handles repetitive work, accelerates investigation, summarizes evidence, recommends next steps, and supports response, while people remain accountable for high-impact decisions.

That model only works when the handoff between AI and humans is visible and understandable.
Analysts need to see what AI reviewed, what it concluded, how confident it is, what evidence supports the conclusion, and what action is recommended. They also need the ability to override, escalate, reopen, or tune the process.

AI-ready workflows require structured case context, controlled access to security data, tenant-aware governance, evidence-backed summaries, auditability, and clear escalation paths. Without those elements, AI can create more confusion than clarity.

A Better Starting Point for Analysts

For MSSPs, this is a scale issue. Every minute spent manually gathering context is a minute that does not scale. Every inconsistent triage decision creates operational risk. Every manual handoff slows response. When AI operates inside a governed case workflow, MSSPs can standardize triage, improve analyst consistency, reduce repetitive work, and support more customers without requiring proportional headcount growth.

For lean security teams, the same challenge shows up as capacity pressure. A small team may be responsible for monitoring, investigation, response, reporting, and tool administration. They may not have separate Tier 1, Tier 2, threat hunting, detection engineering, and incident response teams.

For these teams, the value of AI is not replacing people. It is helping people start from a better place.

Instead of asking, “What is this alert?” the team can begin with, “Here is the case, here is the evidence, here is the likely story, and here are the recommended next steps.”
That is a different operating model.

The Bottom Line

Security teams do not need another AI sidecar. They need AI embedded into the way SecOps actually works.

Stellar Cyber 6.5 moves in that direction by introducing governed AI connectivity through the MCP Server and improving case workflows with real-time triage status. These enhancements help bring AI deeper into detection, triage, investigation, and response while preserving the visibility and control teams need.

AI will not transform security operations unless the workflow is ready for AI.
Stellar Cyber 6.5 helps make that workflow real.

Christophe Briguet, Sr. Director of Product Management – AI & Security Analytics, Stellar Cyber

About Stellar Cyber

Stellar Cyber’s Open XDR Platform delivers comprehensive, unified security without complexity, empowering lean security teams of any skill level to secure their environments successfully. With Stellar Cyber, organizations reduce risk with early and precise identification and remediation of threats while slashing costs, retaining investments in existing tools, and improving analyst productivity, delivering an 8X improvement in MTTD and a 20X improvement in MTTR. The company is based in Silicon Valley. For more information, visit https://stellarcyber.ai.

The post Security Teams Do Not Need More AI Hype. They Need AI-Ready Workflows. appeared first on Cybercrime Magazine.

This week in cybersecurity from the editors at Cybercrime Magazine

Sausalito, Calif. – Jul. 21, 2026

– Read the full story in StationX

Nathan House, founder and CEO at StationX, one of the UK’s first cybersecurity companies founded in 1999 and trusted by more than 500,000 customers, aggregated over 100 ransomware and malware statistics from 30+ authoritative sources and cross-referenced them to produce 8 original derived insights that he says you won’t find in any single report.

The daily cost of ransomware, according to House’s analysis, based on predicted figures from Cybersecurity Ventures, is approximately $156.2 million per day. That’s $6.5 million per hour, $108,000 per minute, and $1,800 per second. When you factor in Cybersecurity Ventures’ $275 billion annual ransomware cost prediction by 2031, the daily damage rate is on track to exceed $726 million per day within six years.

What would a ransomware attack cost your organization? A calculator from StationX enables you to enter company size (based on number of employees), industry, data backup status, and type (if any) of cyberinsurance, and then it instantly provides an estimated cost and median recover time based on Sophos, IBM and Verizon data.

For an example, Cybercrime Magazine used the calculator and entered: Organization size is medium (251-1,000 employees); Industry is manufacturing; Backup status is basic (not air-gapped); Cyberinsurance is a basic policy. The total estimated cost is $1.46 million, and the estimated recovery time is around 100 days.

If you’re a CISO or security leader, then you might find the StationX calculator a handy tool to help your boardroom and C-suite executives understand what’s at stake when it comes to ransomware.

Read the Full Story

Cybercrime Magazine is Page ONE for Cybersecurity. Go to any of our sections to read the latest:

• SCAM. The latest schemes, frauds, and social engineering attacks being launched on consumers globally.

• NEWS. Breaking coverage on cyberattacks and data breaches, and the most recent privacy and security stories.

• HACK. Another organization gets hacked every day. We tell you who, what, where, when, and why.

• VC. Cybersecurity venture capital deal flow with the latest investment activity from various sources around the world.

• M&A. Cybersecurity mergers and acquisitions including big tech, pure cyber, product vendors and professional services.

• BLOG. What’s happening at Cybercrime Magazine. Plus the stories that don’t make headlines (but maybe they should).

• PRESS. Cybersecurity industry news and press releases in real time from the editors at Business Wire.

• PODCAST. New episodes daily on the Cybercrime Magazine Podcast feature victims, law enforcement, vendors, and cybersecurity experts.

• RADIO. Tune into WCYB Digital Radio at Cybercrime.Radio, the first and only round-the-clock internet radio station devoted to cybersecurity.

Contact us to send story tips, feedback and suggestions, and for sponsorship opportunities and custom media productions.

The post What Would A Ransomware Attack Cost Your Organization? appeared first on Cybercrime Magazine.