Business & Technology
Lessons from deploying AI in a live SOC
When SOC teams need to cut through the noise, AI can be crucial. However, it’s true value can only be felt if it’s implemented with operational context and discipline. Through the real experience of running a live SOC, we’ve learned lessons on putting AI into production, rather than just discussing it.
The challenge facing today’s SOC isn’t hard to describe. Too many alerts, too many tools, too little time. To make matters more complicated, there aren’t enough people to keep pace with attackers who are becoming quieter, more patient, and increasingly automated.
Most security leaders already know this. The noise problem is well understood, and the skills shortage is well documented. The pressure being put on analysts is visible every day.
What’s less often shared, however, is what happens when you try to fix it. Talking about AI in SOC is easy. Implementing it inside a live, multi-customer SOC, where mistakes have consequences, is something different.
AI as a change to how the SOC operates
AI shouldn’t be approached as a feature to be added. As a managed security service provider, Gamma Communications runs a live SOC that supports multiple customer environments. Each one comes with different tools, playbooks, and governance requirements.
When we first started integrating AI into our investigative workflows, the goal was to make the SOC sustainable at scale, without endangering trust. We never set out to replace analysts or chase the next big innovation headline.
That distinction matters. Simply adding AI on top of existing processes doesn’t solve the problem. In many cases, it makes it worse.
Automation alone follows rules. It doesn’t reason, adapt or explain itself when something goes wrong. In an environment that depends on judgement and accountability, that limitation shows up very quickly.
AI only creates value when it understands the process
One lesson we learned early on was that single agent AI approaches struggle in real investigations. They can look impressive in isolation, but incidents are messy.
A single phishing case can involve headers, domains, attachments, QR codes, URLs, enrichment from threat intelligence. Not to mention the structured decision making around severity and response.
Human analysts navigate that complexity instinctively, because they have context and experience. AI, on the other hand, needs structure.
That’s why we moved towards a multi-agent approach. Different agents handle distinct parts of the investigation, and deterministic automation handles tasks that must be executed with certainty.
AI reasoning is applied where it genuinely adds value, interpreting patterns, prioritising signals, and supporting decision making. Control over judgement, escalation, and accountability is retained by humans.
An AI-powered, human-led future for SOC
Trust was the hardest thing to earn, both internally and operationally. In a live SOC, you cannot afford confident but incorrect outputs. Hallucinations must be avoided, and you shouldn’t be left with decisions that can’t be audited or explained.
Guardrails were foundational, not optional.
We constrained what the AI could see, how it could reason, and what it was allowed to produce. Strict workflows were defined, outputs were validated continuously, and human oversight over escalations and high severity incidents was maintained. Performance was also monitored over time – not just in testing, but in production, across real cases.
Consistency builds trust
The benefits didn’t show up everywhere, which is important to say. AI didn’t magically eliminate the need for skilled analysts. Instead, it changed how their time was spent.
The most measurable impact came through early investigation and triage. By accelerating data gathering, enrichment, and structuring, we saw five to ten times improvements in Mean Time to Investigate at that initial stage. Work that previously took twenty minutes could often be reduced to a few minutes, without cutting corners.
That matters, but not because speed is everything. Analysts were given the space to focus on judgement, rather than noise.
Analysts now have time to think
There’s a growing temptation in the market to treat AI adoption as a buying decision. You pick a tool, switch it on, and move on. Our experience suggests that approach rarely survives in a real-world situation
Some commercial solutions are valuable, while others lack the flexibility required in multi-customer environments. Internal development brings control, but also responsibility.
In practice, a multi-model, multi-solution approach proved necessary as it reflected how real SOCs operate. Elegance was never a driving factor.
This is where many organisations will struggle. The AI works, but implementation is often treated as a technological project, rather than an operating model change.
GenAI: Designed in, not bolted on
The uncomfortable truth is that doing nothing is no longer an option. The scale of threats, the pace of change, and the pressure on people mean the traditional SOC model will continue to fracture under load.
AI can help restore balance, but only when it’s introduced safely and deliberately. The role humans still play in security decision-making must continue to be respected.
The mistake many organisations will make is treating AI in the SOC as a technology upgrade. In fact, it’s an operating model decision, and it will expose every weakness in process, governance, and accountability that already exists.
The real question is whether your SOC is ready to absorb AI without increasing risk. That means knowing where AI should reason, where automation must remain deterministic, and where human judgement can never be removed. It means recognising that illumination comes from discipline and experience, not from adding more tools.
How do we know this? Because we’ve been there. AI was implemented inside a live, multi-customer SOC, where mistakes are visible and trust is earned the hard way.
The takeaway is simple. Illumination stems from an understanding on how people, process, and AI work together at scale.
Want to know how AI fits into your SOC? Join our live webinar on Tuesday 21st April to see how organisations can move forward with clarity rather than guesswork.
Ski Yodl Ltd, founded in March 2018, offered ski holiday packages to destinations including the French Alps.
The company’s LinkedIn profile described it as “a collective of ski industry professionals driven to create a customer-centric booking experience with skiing at its core”.
All holiday packages cancelled as Ski Yodl enters liquidation
After eight years, Ski Yodl, based in Norwich, is now set to close, having voluntarily entered liquidation.
A voluntary winding-up order was agreed on July 22, according to The Gazette, with Richard Cacho from RCM Advisory Limited appointed liquidator.
As a result, all package holidays booked through Ski Yodl have been cancelled.
ABTA, one of the UK’s largest travel trade associations, said: “We do not believe that there were any current customer bookings for package holidays at the time of liquidation.
“However, any customers who believe they may be affected should contact ABTA by emailing claimsrequest@abta.co.uk with details of their booking.”
The company also arranged accommodation-only bookings, which were not covered by ABTA protection.
ABTA advised: “Customers that paid by credit or debit card and had accommodation-only bookings will need to contact their card issuer for assistance with obtaining a refund.
“Any customers that paid by other means such as bank transfer will need to register their claim with the liquidator, RCM Advisory Limited, on 01603 331960 or info@rcmadvisory.co.uk.”
Other UK travel companies that have closed in 2026
Several UK travel companies have also ceased trading or entered administration in 2026:
Meanwhile, four UK airlines have fallen into administration or liquidation this year:
- Ascend Airways (liquidation)
- EcoJet Airlines (liquidation)
- Zenith Aviation Limited (administration)
- European Cargo (administration)
Have you booked a holiday with Ski Yodl? Let us know in the poll above or in the comments below.
SOFIAH NICHOLE SALIVIO
News Editor
Hoxton Mix has published an analysis of more than 29,000 virtual office and registered address sign-ups, showing that UK industries tend to establish new business presences at different times of year. The data identifies March as the busiest month overall.
The London-based provider examined 29,070 subscriptions recorded between 2017 and May 2026 and grouped businesses across 21 industry sectors by their primary UK Standard Industrial Classification code. The figures suggest there is no single national startup season, with sector patterns differing sharply across the economy.
March produced 2,951 sign-ups and was the peak month for six sectors: Information & Communication, with 892 sign-ups; Professional, Scientific & Technical Activities, with 833; Wholesale & Retail Trade, with 719; Real Estate, with 275; Healthcare, with 125; and Finance, with 107.
That concentration suggests the spring surge was driven mainly by service-led and knowledge-focused parts of the economy. Those sectors account for more than half of the startup activity covered in the analysis.
Different rhythms
Outside March, the pattern becomes more fragmented. May was the annual peak for six further sectors, including Manufacturing, with 127 sign-ups; Transport & Storage, with 101; Agriculture, with 13; Mining & Quarrying, with six; Household Activities, with 24; and Other Service Activities, with 176.
Several industries peaked at other points in the year. Administrative & Support Services reached its highest level in January with 429 sign-ups, while Accommodation & Food Services also peaked that month with 107.
Education and Arts & Recreation followed a different timetable, with both reaching their high point in April. The figures showed 130 sign-ups for Education and 144 for Arts & Recreation in that month.
Construction stood apart from the wider trend, reaching its annual high in August with 228 sign-ups. It was one of the few major sectors not to peak during spring.
Sector timing
The findings point to different operating cycles across industries rather than a single moment when founders are most likely to set up. Businesses tied to project pipelines, seasonal demand or professional services appear to choose different points in the calendar when arranging a registered or virtual office address.
The data is based on subscriptions for virtual offices and registered addresses rather than total UK company incorporations, so it reflects behaviour among firms choosing that type of business presence. Even so, the scale of the dataset offers a view of how timing differs between sectors.
The records span nearly a decade, covering subscription activity from 2017 onwards. Using SIC classifications, Hoxton Mix mapped sign-up volumes against each month of the year to identify recurring peaks.
For information and communication businesses, the numbers suggest spring remains the strongest period for setting up an address presence. Professional services and retail businesses showed a similar pattern, reinforcing March as the busiest point of the year for a large share of service-based activity.
By contrast, January appears to hold more appeal for some operational and customer-facing sectors. Administrative and support services, along with hospitality-related businesses, recorded their highest sign-up levels at the start of the calendar year.
Construction’s August peak marks one of the clearest breaks from that pattern. The timing may reflect the sector’s own commercial cycle, which differs from office-based and consumer-facing businesses.
A brief explanation accompanied the release of the figures.
“New founders often ask when the best time is to start a business, but our data suggests that’s the wrong question. The real question is: when is the best time to start your type of business? Technology founders appear to launch in spring, construction businesses build momentum later in the year and hospitality businesses often favour January. These aren’t random patterns – they reflect the different commercial cycles, customer demand and opportunities within each industry. It’s a reminder that successful founders aren’t simply following the calendar. They’re timing their launch to give themselves the strongest possible start,” said Chris Sees, Chief Executive Officer, Hoxton Mix.
Muscle Food has offered customers “quality” meat, high-protein meals, supplements, and more for 13 years (founded in 2013).
The brand has built its reputation on offering “macro-friendly” meal options, calorie-controlled bundles, and nutritional transparency, aiming to support customers’ health and fitness goals.
Its website explains: “Muscle Food brings together high-protein meats, curated hampers, supplements, snacks and functional drinks to support every goal.
“From lean, macro-friendly cuts to calorie-packed bulking options, our range is built to fuel performance, recovery and everyday healthy living.
“We focus on quality, clear nutrition and products that help you stay consistent, and we are always expanding to support your journey!
“Every order is carefully packed for freshness and delivered straight to you, making it easy to stay stocked with the food that powers your progress.
“With dependable delivery and consistent quality, MuscleFood fits seamlessly into your routine so you can focus on your goals.”
Muscle Food falls into administration
After 13 years, Muscle Food has now confirmed it has fallen into administration.
Stuart Kelly and Claire Harsley from Mackay Goodwin Limited were appointed joint administrators on July 21, according to The Gazette.
Despite its financial trouble, the company’s website remains online, along with a notice stating the joint administrators are now managing the business and its assets.
Muscle Food said: “The affairs, business and property are managed by the Joint Administrators, who act as agents of Muscle Foods Limited (In Administration) and without personal liability.”
Customers “very distressed” as Muscle Food at risk of closing
Muscle Food has built up a loyal customer base over the past 13 years, maintaining a 3.7-star rating on Trustpilot.
One long-time customer said: “Brilliant service, from delivery to the quality of the meats bought. My family and I have been using Muscle Food since their start-up.
“I first started buying for my family, and now my daughters have grown and have children of their own and now use Muscle Food too.
“I was VERY distressed to hear that they had gone into administration.
“Keep going Guys. There are thousands of us who appreciate you.”
Other UK companies that have closed or entered administration/liquidation in 2026
It has been a tough year for the UK high street, with several other retailers entering administration or liquidation and others announcing widespread store closures.
Major high street brands LK Bennett, Claire’s, and Quiz have been forced to close all their remaining stores after falling into administration.
UK fashion retailer Leading Labels is also set to close its remaining 15 stores after falling into liquidation.
Whitbread recently confirmed it will be closing all its UK restaurants in September:
- Brewers Fayre (89 locations) – September 7
- Beefeater (106) – September 10
- Bar + Block – September 3
- Table Table – September 3
- Cookhouse + Pub – September 3
TG Jones and the British Heart Foundation will also both be closing around 150 stores across the UK.
Other retailers have been forced to close stores this year, including:
Several UK travel companies have also ceased trading or entered administration in 2026:
Meanwhile, four UK airlines have fallen into administration or liquidation:
UK delivery company Yodel is set to be phased out after being acquired by InPost.
It’s also been reported that Morrisons is looking to sell some of its in-store pharmacies as it continues to cut costs.
It hasn’t all been bad news for the UK high street, with several major brands announcing new store openings for 2026, including Aldi, M&S, and Superdrug.
Plus-size clothing brand Evans also returned to the UK high street recently after closing all its stores and concessions in December 2020.
Bodycare has also returned to the UK high street in 2026 after closing all its stores last year, having fallen into administration.
Do you use Muscle Food? Let us know in the poll above or in the comments below.
-
Business & Technology3 weeks agoHSBC UK & Visa test AI shopping with live payments
-
Business & Technology3 weeks agoValarian lands USD $50 million backing for sovereign AI
-
Business & Technology4 weeks agoMouser warns against viral hacks to cool overheating phones
-
Oxford News4 weeks agoNew romantasy bookshop attracts queues of customers
-
Business & Technology4 weeks agoSNP & Palantir launch AI tools for SAP transformations
-
Business & Technology4 weeks agoKane tops England influencer rankings after Mexico win
-
Traffic & Transport4 weeks ago‘I felt my spine and body split’: the woman who was hit by a child on a Lime bike – and denied compensation | Ebikes
-
Oxford News4 weeks agoDWP now checking bank accounts for Universal Credit and Pension Credit