Skip to content
AI Cyber Compare

LESSON 8 OF 10 · RUNNING · 3 MIN READ

Running an AI SOC platform by day and a provider by night

The short answer

A split model keeps decisions in-house during working hours and buys coverage for the rest. It works when both sides use the same case record, the same response action catalog and a written hand-over at each shift change. It fails when the night side cannot see what the day side decided.

By The Triage Desk · AI Cyber Compare · Published 2026-10-08

Why split the day?

A small team can own decisions for eight or ten hours a day. Covering the other hours with staff takes several more people. A split model uses software for the first pass on every alert at all hours, your analysts for decisions by day, and outside people for decisions at night.

What are the two ways to buy the night?

  • From your AI SOC vendor, as an option. In our profiles, Prophet Security offers Watchtower, a 24x7x365 human-in-the-loop service, and 7AI offers PLAID ELITE, in which its experts run the platform around the clock. The advantage is one system and one case record.
  • From a separate MDR provider. The advantage is choice; the cost is an integration between two systems and two teams.

What must both sides share?

  1. One case record. The night side must see every verdict, note and action from the day, and the day side must see everything from the night, in the same place.
  2. One response action catalog, with separate night approval columns. The provider should be able to point to the row that allowed each action it took.
  3. One escalation list with names and phone numbers for the business decisions only your company can make.

What happens at shift change?

Write a short hand-over at each change, even if the software keeps working in between: open cases, actions waiting for approval, anything unusual. The most common failure in split models is an action that waits all night because the approval request went to someone who had left for the day.

How do you test it?

Before signing, run a tabletop exercise at a realistic hour. Raise an alert that needs a mid-risk action at 2 a.m. and trace who sees it, who approves it, how long it takes and where the record ends up. If any step relies on someone checking email, fix it before you go live.

When is a split the wrong answer?

If your team has no one to own decisions even by day, a split only moves the gap. And if your night volume is small and your catalog allows software to act alone on the narrow, reversible actions, you may not need night staff at all; you may need only an escalation path for the rare wide action.

What should the contract with the night side say?

Whoever covers the night, write down three things: the response actions they may take from your catalog without calling anyone, the maximum time before they escalate a case that needs a business decision, and the format of the morning hand-over. Review the first month of hand-overs together and adjust the catalog rows that caused calls or delays.

Words in this lesson: Split model, Case record, Response action, Response action catalog, Alert

Sources

Source: Prophet Security homepage · Read 27 Sep 2026

Source: 7AI homepage · Read 27 Sep 2026

Next lessonHand-offs: keeping one case record when two models share the queueWhen playbooks, agents, providers and analysts share a queue, hand-offs fail. How to keep one case record and clear ownership across two SOC models.

Read next

Hand-offsWhen playbooks, agents, providers and analysts share a queue, hand-offs fail. How to keep one case record and clear ownership across two SOC models.AI SOC analyst vs MDRThe two operating models side by side.Staffing and coverageEach SOC operating model needs a different kind of staffing. Who must be awake, who approves actions and who maintains the system, model by model.