Managed security operations centre run by the cybersecurity department of AIR Institute

SOC AI is operated by the cybersecurity department of AIR Institute, a non-profit research organisation near Salamanca, Spain, working on intelligent systems, sensing technologies and artificial intelligence. That origin shapes the offering: rather than a product sold into a customer's stack, SOC AI is a monitoring and response service delivered by analysts on a 24/7 rota, with the institute's research in machine learning, distributed ledgers, edge and fog computing and natural language processing feeding the detection side. It is pitched at organisations that will not build their own operations centre, including small and mid-sized companies, public sector bodies, financial institutions, healthcare providers, universities, energy operators and industrial manufacturers.

The monitored scope is deliberately broad. It covers conventional IT assets such as servers, routers, switches and Windows, Linux and macOS workstations, but also industrial control systems and building systems including access and lighting control, iOS and Android devices in employee hands, workloads and data in AWS, Google Cloud and Azure, and logs drawn from across those systems. User-activity monitoring extends to desktop sessions, USB use and file downloads for insider-threat detection. The service describes a four-stage pipeline of data ingestion, analysis, threat detection and response, with machine learning used to identify behavioural patterns associated with malicious activity, automate routine response steps, and reduce the volume of repetitive triage reaching analysts.