How do a SOC and a CERT respond to AI-powered attacks?

A SOC and a CERT respond to an AI-powered attack the way they respond to any attack, only faster. The SOC detects abnormal behaviour, without trying to work out whether a message was written by AI, and contains it quickly. The CERT then takes over to understand the attack, remove the attacker, restore service and stop them coming back.

This article is part of our series on attack response in the age of AI. For the overall picture, see What is machine-speed incident response?.

An “AI attack” is still an attack

Public sources agree: attackers use AI to speed up familiar stages (phishing, reconnaissance, code development, sifting stolen data), not to invent a new kind of attack. In its February 2026 report, France’s ANSSI says it has not identified any AI system able to run every stage of an attack on its own, and Microsoft, in its Digital Defense Report 2026, observes that use is concentrated on specific parts of existing workflows. Details in How do attackers use AI?.

So the incident response method still holds: detect, contain, investigate, eradicate, recover, learn. See How does incident response work?. What changes is the pressure on three points:

• speed, with less time between initial access and damage;
• credibility of lures, which makes users less reliable as detectors;
• variability of malicious code, which weakens signature-based detection.

The SOC’s role: detect behaviour and contain fast

Faced with a perfectly written message, the SOC does not judge the text. It watches what happens next: a sign-in from an unusual country, a forwarding rule created in a mailbox, consent granted to an unknown app, a script run on a laptop. Microsoft, in the same report, notes that cross-correlating signals from endpoints, identities, cloud, email and network reveals patterns that stay invisible when each source is analysed alone.

On endpoints, EDRs analyse how processes behave, which remains effective against code that keeps changing shape. Once an analyst has triaged the alert, containment is best done quickly: isolating compromised systems, cutting propagation channels and preserving forensic evidence. At Cyna, alerts are handled by people, analysts based in France, not by a chatbot. AI is used, among other things, to help design automation rules for its SOAR; analysts remain involved in every alert.

Preserving evidence during containment matters for what comes next. See How to contain without destroying evidence.

The CERT’s role: investigate, eradicate, secure recovery

Containment stops the spread; it does not tell you how the attacker got in or whether they left a way back. The CERT rebuilds the timeline, identifies affected accounts and machines, looks for persistence, removes the attacker’s access and supports the return to service. It also provides the facts needed for any reporting, whose deadlines are set by law: NIS2 provides for an early warning within 24 hours for entities in scope, and the GDPR for notification to the supervisory authority within 72 hours for a personal data breach.

At Cyna, the CERT is a member of InterCERT France, works with the SOC teams and can be mobilised quickly. Cyna’s incident response on-call team is available 24/7 from the Report an incident page. To understand its role, see What is a CERT in cybersecurity?.

Who does what during the incident

Phase	SOC	CERT	MSP and client
Detection	Correlates signals, triages	Not yet involved	Reports any doubt
Containment	Isolates, cuts, preserves evidence	Advises on complex cases	Approves high-impact actions
Investigation	Provides logs and alerts	Reconstructs the attack	Gives access and context
Eradication and recovery	Monitors the restart	Removes access, hardens	Restores, decides on restart
Reporting	Provides the timeline	Provides technical facts	Notifies the authorities

Two situations that need more than technology

Deepfake fraud. ENISA, in its Threat Landscape 2025, notes AI use in voice phishing and impersonation fraud involving deepfakes. Sometimes there is no malicious code at all. The response is first organisational: stop the payment if possible, keep the evidence, report it to the police, then check whether a mailbox was compromised to prepare the fraud. Prevention comes down to one rule: any change of bank details is confirmed by calling back on a known number.

The organisation’s own AI tools. ANSSI points out in its February 2026 report that AI systems can be targeted and that AI tool accounts have been compromised by infostealers. During an incident, treat these accounts and the access granted to assistants like any other access: revoke tokens, rotate secrets, review the logs.

Stopping the attack from happening again

A faster attack can also come back faster. Once the incident is closed, the lessons learned must fix the entry point and confirm that no access remains. See How to prevent a second attack.

Talk to an expert

Want to check that the SOC, CERT and MSP chain is ready for your clients? If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch.

Under attack? Report an incident: Cyna’s on-call team is available 24/7.

Frequently asked questions

How do you detect a phishing email written by AI?

You do not try to tell whether AI wrote it. You watch what happens next: an unusual sign-in, a forwarding rule created in the mailbox, consent granted to an app, a script run on a device. Those behaviours give the attack away, whoever wrote the message.

What should you do after deepfake CEO fraud?

Contact the bank immediately to stop or recall the payment, keep the evidence (recordings, messages, logs), report it to the police and check whether a mailbox was compromised beforehand. The CERT helps establish the facts.

Does the CERT help with regulatory reporting?

It provides the timeline and technical facts. Reporting rests with the organisation concerned: NIS2 (Article 23) provides for an early warning within 24 hours for significant incidents, and the GDPR (Article 33) for notification to the supervisory authority within 72 hours for a personal data breach.

What is the difference between a SOC and a CERT?

The SOC monitors continuously and detects; the CERT steps in on a confirmed incident to investigate and remediate. See CERT, CSIRT and SOC: what are the differences?.