Security teams already know the problems with SOAR. Playbooks take work to maintain and start to struggle when an investigation calls for context or judgment. The harder part comes when a team decides to move away from SOAR while it is still running live security workflows.
How do you replace those playbooks without leaving alerts uncovered during the changeover?
Gartner placed SOAR in its “obsolete before plateau” category in the 2024 Hype Cycle. Gartner analyst Eric Ahlm told Dark Reading the label targets “the field of vendors who sell nothing but dedicated platforms for automation.” Automation itself keeps spreading into SIEM, XDR, and other security products.
A SOAR playbook has a defined state: it is running, or it isn’t. An AI SOC cannot inherit that status when it takes over an alert type. The team first has to see how it handles real cases and decide when it can operate without supervision.
There is no way to compress that period. Cut over too early and the team is trusting decisions it has not properly tested. Keep the old playbook running after the AI SOC has proved itself and the team ends up maintaining and paying for both.
For a time, both systems have to run against the same alert type. The playbook can come out once the team has enough evidence to trust the replacement.
Step 1: Map the Playbooks You Have
Start by listing the alert types the SOC handles and the state of the automation behind each one:
- The playbook works and is actively maintained
- The playbook exists, but has gone stale, or regularly hands work to an analyst
- No playbook exists
Volume and severity can wait. It is easy to assume that high-volume or high-severity alerts carry the most migration risk. But if a maintained playbook already handles those alerts reliably, there is little reason to move them first.
In customer transitions, Prophet Security, a leading AI SOC platform recognized in Rising in Cyber 2026, starts with the alert types where deterministic automation runs out and analysts have to make a judgment. Its analysis of common SOAR playbook use cases covers where that boundary tends to fall.
That brings stale playbooks, frequent analyst handoffs, and alert types with no playbook higher up the list. The weak spot already exists. In some cases, it is easy to miss because there is technically a playbook in place, even though an analyst regularly has to finish the job.
Step 2: Start With the Automation That Struggles
A high-volume playbook that works is not the urgent problem, so you can leave it running.
Look first at alert types where the playbook regularly breaks, needs analyst intervention, or was never built because the investigation could not be reduced to a reliable decision tree.
The coverage gap already exists in those cases. An analyst may be filling it manually, so it does not necessarily show up on an architecture diagram or automation report.
AI SOC platforms can take on more of that investigation because they gather evidence and reach a verdict from what they find. Before the SOC allows one to do that without supervision, the team needs to see how those verdicts hold up on real alerts.
Step 3: Run the AI SOC in Shadow Mode
Keep the current process in place for each alert type being moved. At the same time, let the AI SOC investigate the same alerts without controlling the production response.
Does the AI SOC reach the same conclusion as the analyst? What happens on the cases that usually force the playbook to hand off? When the AI and playbook disagree, which conclusion does the analyst support?
That last question can uncover problems with the existing automation too. Until there is another investigation to compare against it, a playbook can make the wrong call without anyone noticing. Shadow mode can expose those cases before the team retires anything.
Shadow mode ends when the AI SOC’s verdicts consistently agree with the existing process and the analyst reviewing the cases. When they disagree, the analyst needs to work out why. The playbook may be the one making the wrong call.
That comparison needs to cover enough cases to include the ones that usually give the playbook trouble. Until then, the team does not have enough evidence to switch it off.
Step 4: Switch Off Individual Playbooks
Once the AI SOC reaches that point, the team can retire the playbook.
Other playbooks keep running while their replacements remain in shadow mode. There does not need to be a day when the entire SOAR platform gets switched off.
Each alert type still needs a point at which the old playbook comes out. Otherwise, what started as shadow mode can become the permanent setup, leaving the team with the cost and maintenance of SOAR alongside the AI SOC.
Step 5: Work Out What Still Belongs in SOAR
Not every workflow needs to move. Some response actions can stay behind a fixed gate. A team may still require specific conditions before isolating a host or disabling an account, for example.
That leaves SOAR with a narrower security role. Some vendors already position it around general IT and workflow automation, including tasks such as ticket creation and approval routing.
Most of the security work moves to the AI SOC: investigation, triage, and the response that follows a verdict. Fixed gates still make sense for the smaller set of security actions where the conditions can be decided in advance. That set is getting smaller as more of the work around an alert depends on investigation and judgment.
Build the Map Before You Move Anything
Before planning the cutover, list every alert type and mark its playbook as actively maintained, stale, or nonexistent.
The high-volume alerts with functioning automation do not have to go first. Start with the alert types where analysts already compensate for missing or unreliable playbooks. Run the AI SOC beside the existing process, compare the results, and retire each playbook when the team has seen enough to trust what replaces it.
Kirsten Doyle has been in the technology journalism and editing space for nearly 24 years, during which time she has developed a great love for all aspects of technology, as well as words themselves. Her experience spans B2B tech, with a lot of focus on cybersecurity, cloud, enterprise, digital transformation, and data centre. Her specialties are in news, thought leadership, features, white papers, and PR writing, and she is an experienced editor for both print and online publications. She is also a regular writer at Bora.
Additional Resources
Video Overview
Infographic
Audio Deep Dive
Follow Brilliance Security Magazine on LinkedIn to ensure you receive alerts for the most up-to-date security and cybersecurity news and information. BSM is cited as one of Feedspot’s top 10 cybersecurity magazines.