Most threat detections still originate from endpoints, but cloud environments are rapidly closing the gap
PRAGUE, June 25, 2025 – ZEBRA SYSTEMS, distributor of N-able solutions in the Czech and Slovak markets, has released its annual 2025 State of the SOC Report, which examines trends shaping security operations based on real-world insights from the Adlumin Managed Detection and Response (MDR) system. According to the report, artificial intelligence is the dominant driver of improved Security Operations Center (SOC) efficiency, but most alerts still require human validation, and one in ten cases even requires intervention by the MDR team.
The report explores the challenges faced by SOCs and highlights their essential role in strengthening cybersecurity. The findings are based on data from the Adlumin system from December 2024 to February 2025, during which it successfully protected businesses by processing nearly 500,000 alerts and creating 83,171 security escalations. Among these incidents, ransomware remained the leading threat, accounting for 2,684 ransomware threats.
Other key findings include:
- Most detections still originate from endpoints, but cloud environments are rapidly narrowing the gap: 56% of detections come from endpoints and 44% from the cloud. Nearly all cloud breaches then require account restriction to mitigate threats.
- Modern attacks are increasingly bypassing endpoints, making rapid restriction of cloud accounts crucial to threat mitigation. During the period examined, 95% of proactive threat responses involved password resets and account deactivation.
- Artificial intelligence is driving more efficient SOCs: the use of AI tools has reduced SOC analysis time, eliminating the need for lengthy manual investigations. AI can now identify indicators of compromise (IOCs) in as little as 10 seconds.
- Human expertise remains critical to the success of AI and SOCs: while AI can help combat threats, it cannot fully replace SOC analysts. The report reveals that 86% of security alerts escalate into tickets, indicating that most alerts still require human validation.
“Today’s cybersecurity landscape requires more than detection—it requires precision, adaptability, and speed. This report confirms what we are seeing across the industry: cyber resilience depends on integrating artificial intelligence capabilities with the experience of human experts,” said Vikram Ramesh, Chief Strategy Officer at N-able. “We are building security operations that can adapt in real time and are prepared to meet future challenges. The Adlumin SOC, which we recently acquired, is an example of our vision for proactive protection aimed at anticipating and defending against emerging threats.”
To view the full report, visit https://www.n-able.com/resources/state-of-the-soc-report-2025.
Article author: ZEBR.ai editorial team
