Nearly Half of Organizations Say Their SOCs Can't Keep Pace with Modern Threats

New research from Optiv and Palo Alto Networks reveals mounting pressure on security operations as rising threat volume and complexity drive adoption of AI, automation and platform consolidation

LEAWOOD, Kan., Sept. 22, 2026 /PRNewswire/ -- Optiv, the world's largest pure-play cybersecurity company, today published its 2026 Creating a Modern and Mature Security Operations Center (SOC) Report in partnership with Palo Alto Networks. The report examines why traditional SOC models struggle to keep up with increasingly sophisticated and stealthy cyber threats and identifies the strategies organizations are using to modernize security operations.

Based on independent research conducted by Ponemon Institute, the report finds that only 51% of respondents rate their SOC's ability to keep pace with the speed and sophistication of modern threats as effective or very effective.

The findings point to several critical gaps undermining SOC effectiveness, including:

• Insufficient staffing (46%)
• Limited visibility into the systems SOC teams oversee (39%)
• Lack of in-house expertise, including threat hunters and intelligence analysts (37%)

Download the 2026 Creating a Modern and Mature Security Operations Center (SOC) Report from Optiv and Palo Alto Networks: https://www.optiv.com/insights/discover/downloads/creating-modern-and-mature-security-operations-center-soc

At the same time, SOC teams are contending with a growing volume of security alerts and incidents. More than half (52%) of respondents report that alert and incident volumes have either significantly increased (23%) or increased (29%), with SOCs managing an average of 2,566 alerts and incidents each day. Despite this mounting workload, organizations continue to investigate more than one-third (36%) of alerts and incidents through manual processes rather than automated workflows.

"The findings make clear that legacy approaches to security operations are no longer sufficient and can actually put organizations at greater risk," said Kathryn Hall, Optiv's senior vice president of services. "As threats become more sophisticated and alert volumes continue to rise, organizations need to modernize their SOCs with greater automation, intelligence and visibility. Doing so can help security teams move beyond simply managing alerts to proactively identifying and addressing the threats that matter most."

Additional key findings from the report include:

• Cybersecurity Platform Consolidation Is Streamlining SOC Workflows: Forty-six percent of respondents say their organizations have pursued cybersecurity platform consolidation within the past two years. The primary drivers include reducing tool sprawl and the complexity of managing dozens to hundreds of security tools (63%) and to improve visibility and reduce security gaps (55%).

• Organizations Are Making Progress Toward Modernization: Mature SOCs use metrics and key performance indicators (KPIs) to measure effectiveness, prioritize proactive threat hunting and enable automated, AI-driven operations. Forty percent of respondents characterize their SOC as very mature, with 23% saying it's managed based on metrics and KPIs, and 17% saying it's optimized for continuous improvement.

• Automation and AI Deliver Benefits, but Adoption Barriers Persist: Automation and AI can strengthen threat detection, accelerate response, enhance threat hunting and improve overall SOC efficiency, but adoption remains limited. Key barriers to automation include insufficient explainability (49%), poor data quality (45%) and a lack of standardized processes (41%). AI adoption also remains in its early stages, with only 39% of respondents reporting that their SOC currently uses AI and/or machine learning to support detection, investigation and response. Among those using AI, just 38% say it is fully integrated into existing SOC workflows and tooling.

• Identity Security Remains a Visibility Challenge: Sixty-four percent of respondents say identity visibility is very or extremely important to improving overall SOC effectiveness, yet only 32% say identity events and privileged access events are centrally visible to their SOC. As a potential consequence of this visibility gap, just 28% believe identity-related issues involved in SOC security incidents are investigated continuously (18%) or hourly (10%).

"Modernizing the SOC is no longer about adding more tools or asking analysts to work faster," said Kasey Cross, director of product marketing, Cortex XSIAM at Palo Alto Networks. "It requires a fundamentally different operating model, one built around agentic AI, automation, consolidated data and measurable outcomes. The organizations moving fastest in this direction are creating more proactive and resilient security operations, but the findings show there is still a long way to go."

The report findings are based on responses from 574 IT and IT security professionals at organizations with a SOC and who are knowledgeable about its operations.

For the latest news and updates from Optiv, visit https://www.optiv.com/newsroom.

About Optiv Security: Secure greatness.^® 
Optiv is the world's largest pure-play cybersecurity company. With unmatched technology partnerships and deep technical expertise, Optiv securely enables the AI era for more than 6,000 clients. From financial services and health care, to government, energy and retail, organizations trust Optiv to advise, deploy and operate cybersecurity programs that reduce risk and deliver real results. Learn why Optiv is the most trusted brand in cyber at optiv.com.

More Ways to Engage:
Follow Optiv on LinkedIn
Subscribe to the Cyber Landscape Newsletter
Explore Insights and Blogs
View our Newsroom

SOURCE Optiv Security Inc.