Most advice on building a security operations centre assumes a team of a dozen and a round-the-clock rota. Many organizations have two people. They also have the same alerts as everyone else. The question is not how to copy a large SOC. It is how to get the highest-value decisions in front of the right human, and keep everything else from burying them.
This note describes a pragmatic design for a two-person team, and where an agentic SOC analyst such as Dropzone AI fits. A caveat first: the product facts below come from the vendor's own documentation and marketing. Speed and accuracy claims are the vendor's, not mine, and the right way to test them is a pilot against your own alerts.
The real constraint is triage
In a small team the scarce resource is analyst attention. Most alerts are benign, duplicated or low-value, but each one still has to be looked at, correlated with other data, and closed with a note. That work is repetitive, it does not scale with headcount, and it crowds out the work that does: detection engineering, hardening, incident response practice and threat hunting.
If two people spend their days on first-line triage, you do not have a SOC. You have two very expensive ticket queues.
What an agentic SOC analyst does
An agentic SOC analyst takes an alert from your existing tools and investigates it the way a junior analyst would: it gathers the relevant data, reasons across it, and writes up a conclusion. According to the vendor's documentation, Dropzone AI receives alerts from connected systems such as EDR, SIEM, cloud-native alerting and workforce platforms, pulls supporting data from those sources and others, and produces a report with a severity conclusion, an executive summary and the key evidence.
- It sits on top of your stack rather than replacing it. Named integrations include SIEMs such as Splunk, Microsoft Sentinel and IBM QRadar, and EDR products such as CrowdStrike, Microsoft Defender and SentinelOne.
- Integrations are API-based, with alert-source connections (what to investigate) separate from data-source connections (context to investigate with).
- Analysts can add organization-specific context and custom investigation strategies, so the tool reflects how your environment actually works.
The promise is that every alert gets a documented investigation, including the low-severity ones a small team would otherwise skip, and that humans see conclusions rather than raw alerts.
A workable two-person operating model
Technology does not remove the need for a clear division of work. A simple model for two people:
- Detection and response lead. Owns triage decisions, escalations, incident response and the relationship with IT operations. Reviews the AI's conclusions, especially medium and high severity.
- Platform and engineering lead. Owns the data pipeline, integrations, detection rules, tuning and automation. Works to reduce the alert volume at the source.
- Shared. Weekly review of a sample of closed alerts, monthly review of detection coverage against the threats that matter to the business, and a quarterly incident exercise.
Add an external managed detection and response provider or an on-call arrangement for out-of-hours cover if the business needs 24/7 response. An investigation tool that works at night is useful, but someone must still be accountable for acting on a real incident at 3 a.m.
Guardrails: keep a human in the loop
An AI analyst is a fast, tireless junior colleague, and it should be supervised like one.
- Verify before you trust. Start in a read-only, advisory mode. Compare its conclusions with human analysis on a sample of alerts and measure agreement before relying on it.
- Keep disruptive actions behind approval. Where a platform can take containment actions such as blocking an address or disabling an account, require a human decision for anything with business impact until you have confidence in its judgement.
- Audit the reasoning. Read the investigation write-ups, not only the verdicts. A confident wrong answer is the risk.
- Handle data carefully. Alert data contains usernames, hostnames and sometimes sensitive content. Review where it is processed, retention, and the vendor's data-handling terms, particularly under GDPR.
- Plan for failure. Know what happens if the tool is unavailable or wrong, and keep the manual procedure alive.
How to evaluate it honestly
Treat vendor claims about faster investigations and reduced response time as hypotheses. A fair pilot looks like this:
- Run it on a representative set of your own alerts, including known true positives and tricky false positives, for several weeks.
- Measure agreement with your analysts, investigation quality, time to conclusion and the hours returned to the team.
- Count the cost properly: licence, integration effort, review time, and how pricing scales with alert volume.
- Define the exit criteria in advance, including what result would make you say no.
What the saved time is for
The point of removing first-line triage is not to reduce headcount. It is to move two people toward the work that changes your risk: writing and tuning detections for the threats you actually face, closing the gaps that generate noise, rehearsing incident response, hunting, and working with IT on hardening. A SOC is measured less by how many alerts it closes than by how few it needs to.
A small team with clear priorities, good data, a supervised AI analyst and a rehearsed escalation path can provide a level of security operations that would have needed several more people a few years ago. It still needs judgement, and that remains human.
If you would like help designing a lean SOC or running a pilot of an AI-assisted triage tool, get in touch through the consultation form.
Sources
Product descriptions are drawn from vendor material and have not been independently verified. Confirm current capabilities, integrations and pricing with the vendor.