Who owns decisions at 3 a.m.? Staffing and coverage for each model

Why start with the night?

Daytime staffing hides problems. Most teams can approve an action at 11 a.m. The test of a model is 3 a.m. on a Sunday: who sees the alert, who decides, and who acts.

What does each model need?

• SOAR needs engineers who write and maintain playbooks, and analysts for whatever the playbooks do not cover. At night, playbooks run for the cases they were written for; everything else waits.
• An AI SOC analyst platform needs analysts who review verdicts and own approvals. At night, the agent keeps investigating. Whether it can act depends on the autonomy you allowed and on whether anyone is reachable to approve the rest.
• MDR needs a person on your side to receive escalations and make business decisions, such as whether to take a production server offline.
• A SIEM copilot needs analysts on shift. It does nothing on its own.

How do vendors handle the night gap?

Some AI SOC vendors sell a human layer for exactly this gap. In our profiles, Prophet Security offers Watchtower, a 24x7x365 human-in-the-loop expert service, and 7AI offers PLAID ELITE, in which its experts run the platform around the clock. Others leave it to your design: Mate Security, for example, describes graduated autonomy with guardrails (Recommend only, Supervised, and Auto-run for trusted categories), so what happens at night depends on which categories you trust it to run.

How do you write it down?

Make a one-page coverage plan:

1. For each stage of the work strip, name the role that owns it by day and by night.
2. For each response action you allow, name who approves it at night, or state that it waits until morning.
3. Name the escalation path when the owner is unreachable.

If a cell stays empty, you have found the model you need to add. An empty night column usually points to MDR or a vendor's managed option; an empty maintenance row usually means SOAR will decay.

What size of team fits which model?

There is no exact threshold, but the pattern is consistent. With no dedicated analysts, software that proposes actions has nobody to approve them. With a small team, agents taking the first pass free people for decisions. Large teams can afford playbook engineering and often already have a SOAR worth keeping.

What does a coverage plan look like on paper?

Draw a grid with the five stages as rows and two columns, day and night. Put a role in every cell: "rules", "agent", "analyst on shift", "on-call lead", "provider". Any cell that says "nobody" or "whoever sees it" is where the next incident will stall. Share the grid with every vendor you talk to and ask which cells their product fills.

Words in this lesson: SOAR, AI SOC analyst, MDR, Alert, SIEM copilot