A SOC analyst starts her shift with 2,400 alerts in the queue. A model that has learned each user's normal behavior has already ranked them, and the top item is an accounts payable clerk whose account read 14 GB from a finance share at 3 a.m., something it has never done. An assistant has summarized the related events in four sentences, and an agent is waiting for her approval to isolate the clerk's laptop.
Each of those is a different AI capability with a different job and a different way to fail. On the CompTIA Security+ SY0-801 exam they sit under objective 4.6, which expects you to apply automation, orchestration and AI to secure operations in a given scenario. This lesson covers the four capabilities the objective names, AI-augmented baselines, predictive analysis, chatbots and agentic AI, along with the outcomes organizations expect and the limits that decide where a person stays in charge. How attackers target AI systems themselves is covered in the AI threats section.
AI in security operations learns from data instead of following fixed rules
The automation in the previous lessons follows rules a person wrote: if the URL is on the block list, quarantine the message. Rules are predictable and easy to explain, but they only catch what their author anticipated, and someone has to update them as the environment changes.
AI systems learn patterns from data instead. Machine learning models are trained on large sets of past events to classify new ones as malicious or benign, group similar items, or score how unusual something is. Large language models (LLMs) work with text: they summarize, turn questions into queries, draft reports and, when given tools, carry out multi-step tasks. Both produce probabilities and plausible output, not certainties. A model can say an event is 94 percent likely to be malicious; it can't promise it.
In practice AI sits on top of the automation stack rather than replacing it. The SIEM still collects, the SOAR platform still executes actions through its connectors and guardrails, and AI adds ranking, summarizing, suggesting and, within limits, deciding. On the exam, answers that treat AI output as evidence to verify are usually better than answers that treat it as fact.
AI-augmented baselines learn what normal looks like for each user and system
A static threshold such as "alert when anyone downloads more than 1 GB in a day" is wrong for almost everyone. It fires daily for the data engineer who moves 20 GB as part of her job and never fires for the receptionist whose normal is 5 MB. An AI-augmented baseline learns normal separately for each user, host and service account, and for peer groups of similar entities, including time-of-day and seasonal patterns such as month-end spikes in finance. This is the approach behind user and entity behavior analytics (UEBA). The alert from the opening looks like this:
2026-10-21T03:07:44Z UEBA risk=87 user=CORP\tlee host=FIN-LT-0219
anomaly: 14.2 GB read from \\fs02\finance in 38 minutes
baseline: median 61 MB/day, active 08:00-17:30, max 410 MB (90-day window)
peer group: AP clerks (n=12), none above 1 GB in 90 days
also: first activity on this device after 22:00
The alert carries its reasoning: how far the activity sits from this user's own history and from the peer group's. That context is what lets an analyst decide in one minute instead of twenty.
Baselines have known weaknesses. They need a learning period, often several weeks, and a new employee has no history at all. Legitimate change, such as a reorganization or a new project, looks anomalous until the model adjusts. Most important, a baseline learns whatever it is shown. An attacker who is already present during the learning period, or who increases activity slowly, can become part of normal. Analysts' verdicts on alerts, fed back to the model, improve it over time; a baseline nobody tunes produces more false positives every month.