Most SOCs say they’re “not ready for AI.” Others rush in, hoping AI will magically fix years of neglected fundamentals.

Both approaches aren’t ideal.

In this episode, Ahmed Achchak (CEO & Co-founder, Qevlar AI) sits down with Rafal Kitab, Director of SecOps & Incident Response at ConnectWise, to talk about when exactly AI should be added in the SOC.

Rafal argues that AI doesn’t fix broken SOCs. It amplifies whatever you already are. If your processes are solid, AI can extend your capacity. If they’re broken, AI just helps you fail faster with greener dashboards.

You’ll learn:

→ Which AI promises for SecOps in 2025 actually held up in production and which ones collapsed on contact with reality

→ Why adding AI too early can hide inefficiency instead of fixing it

→ The non-negotiable SOC fundamentals that must exist before AI delivers real value

→ How to measure “AI success” without vanity metrics

→ Rafal’s bold prediction for how AI will change day-to-day SOC work in 2026 (and who it benefits most)

Agenda

00:00 – Introduction: Are SOCs really “not ready” for AI?

01:27 – The big AI promises of 2025: what worked and what didn’t

02:44 – Why “AI SOC” testing often fails before it starts

04:41 – How AI can accelerate inefficiency instead of reducing it

05:58 – Why green SLAs don’t mean better detection and response

08:07 – The non-negotiable SOC fundamentals before AI adds value

09:34 – Measuring workload, quality, and real capacity in a SOC

10:26 – Why SOCs fix tools before processes — and pay for it later

13:45 – Rafał’s bold predictions for AI in the SOC in 2026

Follow Rafal Kitab on LinkedIn: https://www.linkedin.com/in/rafal-kitab/

Follow Ahmed Achchak on LinkedIn: https://www.linkedin.com/in/ahmed-achchak-872554109/

Stay tuned for updates from Qevlar AI: https://www.linkedin.com/company/qevlar

Curious how Qevlar AI helps SOCs connect weak signals and surface real intrusions earlier? Head to: qevlar.com