AI triage is the automated or assisted prioritization of security alerts so analysts can review the most important events first. It uses rules, machine learning, enrichment data, and behavior scoring to rank findings by likely risk, confidence, and urgency. In a SOC, AI triage helps reduce alert overload from tools such as EDR, SIEM, and NDR by grouping duplicates, suppressing low-value noise, and highlighting alerts that look suspicious.
This matters because attackers often create many weak signals before a breach becomes obvious: unusual logins, odd host-to-host traffic, privilege changes, or command-and-control activity. AI triage can connect those signals into a higher-priority case and speed up response. Defenders use it to shorten investigation time, but it is not a replacement for analysts. If the model is poorly tuned or the telemetry is incomplete, important alerts can still be missed or buried.