Business & Technology

Lessons from deploying AI in a live SOC

Published

2 months ago

April 14, 2026

info@oxinfo.co.uk

When SOC teams need to cut through the noise, AI can be crucial. However, it’s true value can only be felt if it’s implemented with operational context and discipline. Through the real experience of running a live SOC, we’ve learned lessons on putting AI into production, rather than just discussing it.

The challenge facing today’s SOC isn’t hard to describe. Too many alerts, too many tools, too little time. To make matters more complicated, there aren’t enough people to keep pace with attackers who are becoming quieter, more patient, and increasingly automated.

Most security leaders already know this. The noise problem is well understood, and the skills shortage is well documented. The pressure being put on analysts is visible every day.

What’s less often shared, however, is what happens when you try to fix it. Talking about AI in SOC is easy. Implementing it inside a live, multi-customer SOC, where mistakes have consequences, is something different.

AI as a change to how the SOC operates

AI shouldn’t be approached as a feature to be added. As a managed security service provider, Gamma Communications runs a live SOC that supports multiple customer environments. Each one comes with different tools, playbooks, and governance requirements.

When we first started integrating AI into our investigative workflows, the goal was to make the SOC sustainable at scale, without endangering trust. We never set out to replace analysts or chase the next big innovation headline.

That distinction matters. Simply adding AI on top of existing processes doesn’t solve the problem. In many cases, it makes it worse.

Automation alone follows rules. It doesn’t reason, adapt or explain itself when something goes wrong. In an environment that depends on judgement and accountability, that limitation shows up very quickly.

AI only creates value when it understands the process

One lesson we learned early on was that single agent AI approaches struggle in real investigations. They can look impressive in isolation, but incidents are messy.

A single phishing case can involve headers, domains, attachments, QR codes, URLs, enrichment from threat intelligence. Not to mention the structured decision making around severity and response.

Human analysts navigate that complexity instinctively, because they have context and experience. AI, on the other hand, needs structure.

That’s why we moved towards a multi-agent approach. Different agents handle distinct parts of the investigation, and deterministic automation handles tasks that must be executed with certainty.

AI reasoning is applied where it genuinely adds value, interpreting patterns, prioritising signals, and supporting decision making. Control over judgement, escalation, and accountability is retained by humans.

An AI-powered, human-led future for SOC

Trust was the hardest thing to earn, both internally and operationally. In a live SOC, you cannot afford confident but incorrect outputs. Hallucinations must be avoided, and you shouldn’t be left with decisions that can’t be audited or explained.

Guardrails were foundational, not optional.

We constrained what the AI could see, how it could reason, and what it was allowed to produce. Strict workflows were defined, outputs were validated continuously, and human oversight over escalations and high severity incidents was maintained. Performance was also monitored over time – not just in testing, but in production, across real cases.

Consistency builds trust

The benefits didn’t show up everywhere, which is important to say. AI didn’t magically eliminate the need for skilled analysts. Instead, it changed how their time was spent.

The most measurable impact came through early investigation and triage. By accelerating data gathering, enrichment, and structuring, we saw five to ten times improvements in Mean Time to Investigate at that initial stage. Work that previously took twenty minutes could often be reduced to a few minutes, without cutting corners.

That matters, but not because speed is everything. Analysts were given the space to focus on judgement, rather than noise.

Analysts now have time to think

There’s a growing temptation in the market to treat AI adoption as a buying decision. You pick a tool, switch it on, and move on. Our experience suggests that approach rarely survives in a real-world situation

Some commercial solutions are valuable, while others lack the flexibility required in multi-customer environments. Internal development brings control, but also responsibility.

In practice, a multi-model, multi-solution approach proved necessary as it reflected how real SOCs operate. Elegance was never a driving factor.

This is where many organisations will struggle. The AI works, but implementation is often treated as a technological project, rather than an operating model change.

GenAI: Designed in, not bolted on

The uncomfortable truth is that doing nothing is no longer an option. The scale of threats, the pace of change, and the pressure on people mean the traditional SOC model will continue to fracture under load.

AI can help restore balance, but only when it’s introduced safely and deliberately. The role humans still play in security decision-making must continue to be respected.

The mistake many organisations will make is treating AI in the SOC as a technology upgrade. In fact, it’s an operating model decision, and it will expose every weakness in process, governance, and accountability that already exists.

The real question is whether your SOC is ready to absorb AI without increasing risk. That means knowing where AI should reason, where automation must remain deterministic, and where human judgement can never be removed. It means recognising that illumination comes from discipline and experience, not from adding more tools.

How do we know this? Because we’ve been there. AI was implemented inside a live, multi-customer SOC, where mistakes are visible and trust is earned the hard way.

The takeaway is simple. Illumination stems from an understanding on how people, process, and AI work together at scale.

Want to know how AI fits into your SOC? Join our live webinar on Tuesday 21st April to see how organisations can move forward with clarity rather than guesswork.

Source link

Business & Technology

Oxford business wins award for its apprentice support

Published

20 minutes ago

June 15, 2026

info@oxinfo.co.uk

Haysham Ltd, based in Oxford, was named a regional winner in the JTL 2026 Employer Recognition Awards at Plaisterer’s Hall in London.

The awards celebrate employers who excel in training and developing future talent in the building services engineering sector.

Adam Bolley, director at Haysham Ltd, said: “We’re delighted to receive this recognition from JTL.

“Investing in apprentices is an important part of how we build skills for the future, and JTL’s training support helps ensure our apprentices gain the knowledge, confidence and practical experience they need to thrive in the industry.”

Haysham Ltd was selected from more than 3,800 businesses that partner with JTL across England and Wales.

JTL described Haysham’s commitment to nurturing the next generation of skilled professionals as outstanding.

The national apprenticeship awards also honour exceptional apprentices, tutors and training professionals across England and Wales.

Chris Claydon, chief executive of JTL, said: “Delivering high-quality apprenticeships is always a shared effort, and our Employer Recognition Awards are about celebrating the vital role employers play in making that possible.

“The businesses recognised have shown outstanding commitment to supporting, mentoring and investing in apprentices, helping to create the skilled, confident workforce our industry needs for the future.”

JTL currently supports around 8,000 learners across the UK in the electrical and mechanical engineering services sectors.

Source link

Business & Technology

UK retail investors top up accounts ahead of SpaceX

Published

1 hour ago

June 15, 2026

info@oxinfo.co.uk

KAREN JOY BACUDO

Finance Editor

UK retail investors increased top-ups to investment accounts by 27% ahead of SpaceX’s Nasdaq listing, according to TrueLayer data, pointing to stronger retail trading activity in the run-up to the share sale.

The London-based payments group recorded the increase across its trading and investment platforms over the past two weeks. It compared average top-up volumes with the previous two-week period and with longer baselines across 2026.

The same pattern did not appear in its other business segments during that period. Reviews of its iGaming and eCommerce data showed no similar rise, suggesting the increase was concentrated in financial services.

TrueLayer processes Pay By Bank transactions for a range of UK investment and trading platforms, giving it visibility into when retail customers move money into brokerage and investment accounts. It said this can provide an early indication of investor activity before it appears in broader market data.

SpaceX is expected to begin trading on Nasdaq under the ticker SPCX at a fixed offer price of USD $135 per share. At that price, it would be valued at about USD $1.75 trillion, making the flotation the largest initial public offering on record.

The listing has drawn attention because of the share allocation set aside for individual investors. TrueLayer said SpaceX had earmarked up to 30% of the offering for retail buyers, compared with about 10% typically seen in large IPOs dominated by institutions.

Retail interest

The data offers a snapshot of how UK consumers are preparing to take part in a major US listing. By topping up accounts before trading begins, retail investors can position themselves to apply for shares or buy stock once the company starts trading publicly.

Payment flows into investment platforms have become a useful signal for market watchers during periods of intense retail interest. Spikes in account funding can indicate that private investors are responding to high-profile flotations, volatile trading conditions or broader shifts in sentiment.

TrueLayer’s figure was based on anonymised, aggregated payment information from its network. The 27% rise reflected average pay-in volumes across its financial services segment over the two weeks to 11 June, compared with the preceding fortnight.

Longer-range comparisons showed an even larger increase, but the company used the shorter period as a more conservative measure because payment volumes have trended upwards over time.

“Retail investors are getting their accounts ready, and we can see it on the payment rails. Top-ups to investment platforms and retail brokers are up 27 percent, which tracks closely with the surge of retail interest around the SpaceX IPO,” Francesco Simoneschi, Chief Executive Officer and Co-Founder of TrueLayer, said.

Payments view

Founded in London in 2016, TrueLayer operates across 22 countries and says more than 25 million users rely on its network for transactions. Its service is used by businesses to collect bank payments, move funds and verify account information.

Because it sits between consumers’ bank accounts and a range of merchants, the company can track broad patterns in how money moves between sectors. In this case, the increase appeared specific to investment-related activity rather than a wider lift in consumer payments.

That distinction matters because a general rise across multiple sectors could reflect payday patterns, seasonal spending or other external factors. The absence of a comparable increase in eCommerce and iGaming suggests investors were moving money with a specific purpose tied to the listing.

The scale of the SpaceX flotation has drawn unusual attention to the role of retail demand. A large allocation to individual investors means consumer appetite may play a more visible part in early trading than in many previous blockbuster IPOs.

For brokers and payment providers, this creates an opportunity to gauge activity before orders appear in market data. TrueLayer’s figures suggest that, at least among UK retail investors using pay-by-bank transfers, preparations to participate were already underway before the first trade.

Shares are expected to trade at a valuation of roughly USD $1.75 trillion.

Source link

Business & Technology

Thames Travel hosting bus driver recruitment days in Oxford

Published

16 hours ago

June 14, 2026

info@oxinfo.co.uk

The events will take place in June and are open to anyone interested in a career behind the wheel.

Full-time and part-time positions are available at Thames Travel’s Didcot base, and attendees will have the chance to learn about a £4,000 bonus scheme for existing PCV licence holders.

Luke Marion, managing director of Thames Travel, said: “We’re looking for candidates with excellent customer service skills and strong communication abilities to join our driving team.

“Bus driving is a hugely rewarding career where every day is different.

“New colleagues will enjoy a paid, comprehensive training programme with experienced instructors and stable, long-term employment at a competitive rate of pay.”

The recruitment days will be held from 10am to 3pm on June 14 and June 28.

Visitors can meet management, ask questions and fast-track their application.

Candidates must have a valid manual driving licence, held for more than 12 months.

No previous bus driving experience is necessary.

To take part in a full assessment, attendees must bring their current UK photocard driving licence and proof of eligibility to work in the UK.

Mr Marion said: “Many of our trainees join from different backgrounds, and no previous bus driving experience is required.

“These events are for anyone wishing to join our team, whether you’re a trainee or a PCV licence holder.”

Additional benefits include free travel on all Thames Travel, Oxford Bus Company and Carousel Buses services, discounts at shops, cinemas and health clubs, and a refer-a-friend scheme.

Source link