Autonomous DLP: 79% of SOCs use AI but only 36% built it in

Almost every security operations team has an AI tool in the mix by now. Far fewer have decided what that tool is supposed to do. The 2026 SANS SOC Survey, built on responses from 444 practitioners and 69 senior security leaders, found that 79% of SOCs use AI or machine learning tools and only 36% have built them into a defined workflow. Roughly two in three SOCs are running AI the way they once ran shadow IT, with each analyst making their own call. If you own data security, that gap lands on your desk. Without a defined workflow, nobody can say which incidents the AI reviewed or who approved the fix.

The SANS findings point to structure rather than skills. Infosecurity Magazine's coverage of the survey reports that the most common approach, used by 38% of respondents, is to run vendor AI tools without any customization. Another 31% customize existing tools and 20% build their own. In the report's own words, analysts are reaching for AI tools individually, often with no organizational structure around how they're used and validated.

Staffing sits underneath that. The same coverage shows 59% of cyber leaders believe management pays close attention to SOC hiring and retention, while only 32% of practitioners agree. Leaders describe what they intend while practitioners describe what they live with. A team short on people will grab whatever AI saves time today. It won't have the hours left to design the process around it.

SANS warns that using AI without structure is inefficient and can produce results nobody can validate. The savings are still real. Swimlane's September survey of 500 security professionals found that 43% now spend less time on repetitive work because of AI.

Think about what repetitive means in data loss prevention. Ask any security team what they do most days and the list is familiar. They build classifiers, investigate issues, write and edit policies, evaluate exception requests and remediate exposure. Each of those tasks needs a consistent answer. When every analyst works from a personal assistant and a personal prompt, two people can reach different conclusions about the same incident with no shared record of why. Time saved that way is hard to repeat or review.

MIND treats the workflow as part of the product. We aren't only adding AI to the alert queue. We're minding the process that decides what happens to your data, so the team can focus on direction instead of babysitting consoles.

MIND classifies by content and context instead of relying on regex. A team of AI DLP Agents then handles the work, with one job per agent.

• The Custom Classifier Agent builds business-specific classifiers and consults a judge to catch false positives.
• The Policy Producer Agent suggests and refines policies from observed behavior and natural language instructions.
• The Issue Investigator Agent analyzes incidents and explains the risk behind them, with suggested remediation actions.
• The Rapid Response Agent executes remediation and escalates when human approval is required.
• The Reason Reviewer Agent evaluates user override justifications against your policy guidance in real time.

That addresses the maturity gap SANS describes. Each task has a named agent, and a human approval step sits wherever a decision needs one. Prevention happens at the endpoint and in the browser, so decisions are made where the data actually moves. Your security team stays in control while the platform does the routine work.

The first change is time. Mike Morrato, the CISO at Noname Security, said it this way.

“MIND saved us 1-2 hours per incident and in some cases 3-4 hours, which translated to 25-50% time savings per incident per day.”

Yaron Blachman, CISO at OpenWeb, described the same shift from the false positive side.

“We're saving a lot of time not looking at irrelevant data and false positives… probably a fifth of the time we spent managing our DLP program in the past.”

The second change is what that time buys. Analysts who aren't triaging by hand can review how decisions get made and tune policy. They have time to talk with the business about AI projects before those ship. Security stops chasing the business and starts working alongside it.

If your team already uses AI in security operations, see what it looks like when the workflow is built in. Book a demo and watch MIND handle classification and remediation in your own environment. Your analysts will see the work get done in minutes. You'll also see where your data risk actually sits.