The Context Challenge
Unless you have dedicated analysts assigned to a single customer, your SOC team is switching between environments constantly. Each customer has different asset criticalities, different user populations, different risk tolerances, and different operational patterns. An analyst investigating an alert needs to recall or look up this customer context before they can make an informed decision.
Humans are fallible at this kind of recall. Under time pressure, with multiple investigations running in parallel, it is easy to miss context that would change a decision. A user flagged as suspicious might be a known contractor with legitimate access patterns. A system generating alerts might be undergoing planned maintenance. Without customer context, analysts either waste time on false positives or, worse, miss genuine threats because they lacked the information to recognise them.
This is where AI can deliver transformative value. Not by replacing analyst judgment, but by ensuring that judgment is always informed by complete customer context.
Building the Semantic Layer
Effective customer context AI requires a semantic model that captures not just data but meaning. This goes beyond a simple asset inventory. It includes relationships between entities, criticality classifications, business functions, and operational patterns.
Knowledge graphs are particularly well suited to this challenge. They represent entities and their relationships in a way that supports complex queries. Who are the peers of this user? What systems does this asset connect to? What business processes depend on this service? These questions, which would require an analyst to navigate multiple systems and documentation, become instant queries against a structured customer context model.
The semantic layer also captures temporal patterns. What does normal look like for this user on this day of the week? What is the typical volume of authentication events for this system? Customer context AI can baseline these patterns and flag deviations, adding another dimension to investigation triage.
AI as the Memory Layer
With a semantic model in place, generative AI becomes the interface that makes customer context accessible during investigations. When an analyst picks up an alert, the AI can instantly retrieve relevant context: the user's role and typical behaviour, the asset's criticality and dependencies, historical incidents involving similar patterns, and any customer-specific handling procedures.
This is not about the AI making decisions. It is about ensuring the analyst has everything they need to make a good decision, without spending minutes gathering information that should be at their fingertips. Customer context AI turns the semantic model into actionable intelligence at the point of investigation.
The impact on investigation quality is significant. Analysts working with complete customer context make better prioritisation decisions. They escalate genuine threats faster because they understand the business impact. They close false positives with confidence because they can verify that observed behaviour matches known patterns. The consistency that was previously only achievable with dedicated resources becomes available across a leveraged model.
Automated Entity Enrichment
Customer context AI also enables automated enrichment during triage. As alerts arrive, the system can automatically attach relevant context: the user's department, manager, and risk classification; the asset's business function, data classification, and compliance requirements; related alerts from the same entity over recent periods.
This enrichment happens before an analyst even looks at the alert. When they do, they see not just raw event data but a contextualised view that supports rapid decision-making. The time saved on each investigation compounds across hundreds or thousands of alerts, freeing analyst capacity for work that genuinely requires human expertise.
The Operational Impact
Organisations that have implemented customer context AI report consistent improvements across key metrics. Triage times decrease because analysts spend less time gathering information. False positive rates improve because context enables more accurate assessment. Escalation quality increases because decisions are based on complete information rather than partial data.
For SOC managers, this translates to better service delivery with existing resources. Customer context AI does not replace your team; it ensures they can perform at their best regardless of how many customers they support. The knowledge that previously resided only in the heads of your most experienced analysts becomes systematised and accessible to everyone.
Context is the differentiator between alert processing and intelligent investigation. Customer context AI makes that intelligence available consistently, at scale, across your entire operation.
Martin Riley
Chief Technology Officer
