Blits.ai
Meet Blits.ai at Singapore FinTech FestivalNovember 18 to 20, 2026 · Singapore · Stand 3-SK-30
Book a 1:1 →

Business function

AI use cases for security operations

The most documented AI use cases for security operations are physical security video analytics, security alert triage and identity and access review agent, across 56 public deployments by 51 organizations. Threat detection, incident response and vulnerability management.

Use cases
11
Deployments
56
Organizations
51
Outcome disclosed
77%

The 10 most common AI use cases for security operations

Ranked by the number of organizations with a public deployment, as of 11 November 2026.

  1. 1
    AI video analytics and screening for physical security

    Physical security video analytics is AI that watches camera feeds or walk through sensors at a site and flags a likely weapon, intrusion or theft.

    13 organizations
    at least 90% search time reduction
    one deployment, vendor claim
  2. 2
    AI for security alert triage and investigation in the SOC

    Security alert triage and investigation is an AI agent in the security operations center that picks up each new alert or user reported phishing email.

    7 organizations
    60% median productivity gain
    3 deployments
  3. 3
    AI agent for identity and access review and certification

    An AI agent that runs user access reviews, flags entitlements that differ from peers in similar roles, and leaves only the exceptions for a human reviewer.

    5 organizations
    75% cycle time reduction
    one deployment, vendor claim
  4. 4
    AI for software vulnerability triage and remediation

    AI vulnerability remediation is AI that takes security findings from scanners, fuzzers and bug reports and turns the real ones into a drafted code fix for developers.

    5 organizations
    about 70% automation rate
    one deployment, vendor claim
  5. 5
    AI blocking of phishing and scam text messages in the operator network

    Scam text message blocking is AI in the operator's messaging network that scores text messages as they pass through and stops phishing and scam messages before they reach the subscriber.

    4 organizations
  6. 6
    AI content moderation for trust and safety at online platforms

    AI content moderation for trust and safety scans user generated content, such as live video, images, chat and audio, against an online platform's policy in real time.

    4 organizations
  7. 7
    AI for detection engineering and detection rule writing

    AI detection engineering drafts, tests and tunes the rules that find attacks in security logs, from threat reports, vulnerability disclosures or plain language requests, for an engineer to approve.

    4 organizations
    67% false positive reduction
    one deployment, organization claim
  8. 8
    AI for threat intelligence collection and reporting

    Threat intelligence collection and reporting is AI that gathers threat reports, extracts the indicators and drafts summaries and briefings for a human analyst to check and send.

    4 organizations
    at least 70% handling time reduction
    one deployment, vendor claim
  9. 9
    AI assisted proctoring and integrity monitoring for remote exams

    Exam and assessment integrity AI supports the integrity of a remote, high stakes exam by verifying a test taker's identity and watching for signs of cheating.

    3 organizations
  10. 10
    AI crowd density and flow monitoring for venues, transport hubs and pilgrimage sites

    Crowd density and flow monitoring is AI that counts people on camera feeds and flags crowding, movement against the flow and congestion points so operators can act early.

    2 organizations

11 Security operations use cases

51 organizations in 12 countries run these use cases in public. 77% of those 56 deployments disclose a measurable outcome.

Cross industryTechnology and software

AI agent for identity and access review and certification

An AI agent that runs user access reviews, flags entitlements that differ from peers in similar roles, and leaves only the exceptions for a human reviewer. It pulls entitlement data from every connected application, scores each grant against the peer profile, groups or pre approves low risk, expected access, and keeps an audit ready record of every decision.

Deployments
5 public, best grade C
Reported cycle time reduction
75%
Sprout Social, vendor claim
Education

AI assisted proctoring and integrity monitoring for remote exams

Exam and assessment integrity AI supports the integrity of a remote, high stakes exam by verifying a test taker's identity and watching for signs of cheating. It analyzes behavior such as typing patterns, facial matching and session activity for signs of impersonation or unauthorized help, and flags sessions for a trained human reviewer to decide, rather than letting a model issue an automated finding of misconduct on its own.

Deployments
3 public, best grade B
Autonomy
Supervised agent
Telecommunications

AI blocking of phishing and scam text messages in the operator network

Scam text message blocking is AI in the operator's messaging network that scores text messages as they pass through and stops phishing and scam messages before they reach the subscriber. It looks at sender behavior, message volume and links, and it is separate from labeling scam calls and from fraud against the operator itself.

Deployments
4 public, best grade B
Autonomy
Autonomous
Technology and softwareMedia and entertainment

AI content moderation for trust and safety at online platforms

AI content moderation for trust and safety scans user generated content, such as live video, images, chat and audio, against an online platform's policy in real time. It removes or hides the clearest violations and routes borderline cases to a human moderator with its reasoning attached, so the platform can review far more content than a human team alone while keeping irreversible decisions with a person.

Deployments
4 public, best grade C
Autonomy
Supervised agent
Government and public sectorLogistics and transportation

AI crowd density and flow monitoring for venues, transport hubs and pilgrimage sites

Crowd density and flow monitoring is AI that counts people on camera feeds and flags crowding, movement against the flow and congestion points so operators can act early. It estimates how many people are in a zone and which way they move, and leaves every decision, such as opening a gate, redirecting a stream or sending staff, to the operators in the control room.

Deployments
3 public, best grade C
Autonomy
Assist
Cross industryTechnology and software

AI for detection engineering and detection rule writing

AI detection engineering drafts, tests and tunes the rules that find attacks in security logs, from threat reports, vulnerability disclosures or plain language requests, for an engineer to approve. It also translates rules between query languages, tags them with MITRE ATT&CK techniques and checks them against the organization's own data before they go live.

Deployments
4 public, best grade B
Reported false positive reduction
67%
Amazon, organization claim
Cross industryHealthcare

AI for security alert triage and investigation in the SOC

Security alert triage and investigation is an AI agent in the security operations center that picks up each new alert or user reported phishing email. It gathers the evidence from the SIEM, endpoint, identity and threat intelligence tools, gives a verdict with its reasoning and a draft incident summary, and closes clear false positives while an analyst approves every containment action.

Deployments
7 public, best grade B
Median productivity gain
60%
3 deployments
Cross industryTechnology and software

AI for software vulnerability triage and remediation

AI vulnerability remediation is AI that takes security findings from scanners, fuzzers and bug reports and turns the real ones into a drafted code fix for developers. It filters out duplicates and false positives, reproduces and ranks the findings, and drafts a fix with a test for each, which a developer reviews and merges through the normal change process.

Deployments
6 public, best grade B
Reported automation rate
about 70%
AMD, vendor claim
Telecommunications

AI for telecom fraud detection (SIM swap, IRSF and Wangiri)

Telecom fraud detection is AI that protects an operator's network, revenue and numbers from fraud by watching call, messaging, roaming and account activity. It detects SIM swap and port out takeovers, international revenue share fraud (IRSF) and Wangiri one ring scams, blocks or flags them in real time, and shares risk signals with banks and other businesses that rely on the phone number for security. Scam calls aimed at subscribers are handled by call blocking.

Deployments
4 public, best grade B
Reported detection improvement
30%
Vodafone, organization claim
Cross industryRetail and ecommerce

AI for threat intelligence collection and reporting

Threat intelligence collection and reporting is AI that gathers threat reports, extracts the indicators and drafts summaries and briefings for a human analyst to check and send. It watches news, vendor blogs, advisories and filings against the organization's own priorities, pulls out threat actors, vulnerabilities and indicators of compromise, and writes the first version of the daily digest, the incident report or the customer newsletter.

Deployments
4 public, best grade B
Reported handling time reduction
at least 70%
RH-ISAC, vendor claim
Retail and ecommerceEducation

AI video analytics and screening for physical security

Physical security video analytics is AI that watches camera feeds or walk through sensors at a site and flags a likely weapon, intrusion or theft. It works in real time or on search, and leaves the verification and every response action to a human guard or investigator, rather than acting on its own.

Deployments
13 public, best grade B
Reported search time reduction
at least 90%
Kogan, vendor claim

What the evidence says

Computed from the 56 public deployments behind these use cases. Numbers update with every checked record.

Benchmarks with at least 3 pooled values

Benchmarks across Security operations use cases
KPIMedianReported rangeData pointsClaimed by
Productivity gain70%
60% to 336%
53 organization, 2 vendor
Handling time reduction70% vendor reported
60% to 97%
33 vendor
Industries these use cases also serve
AI patterns used
Deployments by stage
  • Announced
    1
  • Pilot
    2
  • Production
    37
  • Scaled
    15
  • Paused or rolled back
    1
Public deployments by region
  • North America
    27
  • Europe
    11
  • Asia Pacific
    8
  • Global
    7
  • Middle East
    3

Organizations with a public deployment

  • AMD
  • Amazon
  • AmeriGas
  • Avanade
  • Bharti Airtel
  • Cathay Pacific
  • Charlotte-Mecklenburg Schools
  • Chatroulette
  • Chelsea School District
  • Duolingo
  • East Baton Rouge Parish Schools
  • Educational Testing Service (ETS)
  • El Centro Regional Medical Center
  • Elastic
  • Expel
  • Federal Housing Finance Agency
  • GAIL's Bakery
  • Google
  • Gwinnett County Public Schools
  • Harry Rosen
  • Highrise
  • Hippo Insurance Services
  • Human Managed
  • Kogan
  • Labelbox
  • Ministry of the Interior (France)
  • Netskope
  • Old Cannery Furniture Warehouse
  • PatientPoint
  • Pearson VUE
  • Plato
  • Proximus
  • RH-ISAC
  • Riyadh Municipality
  • SAP Enterprise Cloud Services
  • SEP2
  • SailPoint
  • Saudi Data and Artificial Intelligence Authority (SDAIA)
  • Sopra Steria Scandinavia
  • Sprout Social
  • St. Luke's University Health Network
  • Tango
  • Telenet group
  • Telstra
  • Tepper Sports & Entertainment
  • TÜV SÜD
  • U.S. Immigration and Customs Enforcement
  • Utica City School District
  • Vodafone
  • gematik
  • mnemonic

Frequently asked questions

What are the most common AI use cases for security operations?
Counted by organizations with a public deployment, the most common are AI video analytics and screening for physical security (13 organizations), AI for security alert triage and investigation in the SOC (7 organizations), AI agent for identity and access review and certification (5 organizations), AI for software vulnerability triage and remediation (5 organizations) and AI blocking of phishing and scam text messages in the operator network (4 organizations). The library documents 11 AI use cases for security operations, 11 of them with a public deployment: 56 deployments by 51 organizations in 12 countries.
How many of these AI deployments are live in production?
52 of the 56 public deployments are live: 37 in production and 15 scaled across the organization. 2 are pilots and 1 are announced.
Which AI use cases for security operations are high risk under the EU AI Act?
One use case falls in the high risk tier: AI assisted proctoring and integrity monitoring for remote exams. For 5 other use cases the tier depends on design, for example whether the system decides on access to an essential service. Each use case page explains its tier and what it requires. This is not legal advice.
Where do these numbers come from?
From the Blits.ai AI Use Case Library. Every deployment is a public record of a named organization with a cited source, and every number is computed from those records. Data as of 11 November 2026.

Explore the library

All AI use cases

Search and filter the whole library.

State of AI Use Cases

Aggregate findings across every record.

KPI benchmarks

Definitions and reported values per KPI.

Methodology

How every record is verified and graded.