Payments processor: Every alert investigated and ~5,900 analyst hours returned a year

The problem

This payments processor operates in a PCI-regulated environment, where every investigation has to be consistent, well documented and fast. Its security team monitors telemetry across SIEM, endpoint, identity, email and web security, with Splunk Enterprise Security as the main alert source.

Alert volume across that stack outgrew the hours available to investigate it. The result was a queue of roughly 2,900 investigations stretching back months, with no realistic path to clear it by hand. Skilled analysts spent their hours on first-pass triage instead of threat hunting or hardening the environment.

The team could not simply let that queue age out. In a PCI environment, a missed true positive or a slow response carries outsized consequences. Phishing added steady pressure, since every reported or detected email needed a first pass before anyone could decide whether to block it.

Much of the volume was also predictable. Some alert types fire again and again on activity the team had already judged benign, and each one still landed in the queue and still took an analyst's time to confirm and close.

The team needed two things at once: every alert that deserved a real look investigated to the same standard, and known-benign alerts kept from reaching a human at all.

The solution

An AI SOC analyst on every alert, with suppression for the known-benign ones

The team deployed Prophet AI to investigate every alert end to end and reach a determination on each, with its own SOPs encoded as playbooks so automated investigations follow the process analysts would run by hand. Prophet AI works across Splunk Enterprise Security, CrowdStrike, Microsoft Defender, Entra ID, Okta and Office 365. Suppression rules close known-benign alert types before they reach anyone. Reported and detected phishing is investigated end to end, and malicious indicators are pushed to Proofpoint to block. Escalations land in Microsoft Teams, and analyst guidance carries into every later investigation.

The results

A months-deep backlog cleared in the first weeks

In the first weeks of the deployment, Prophet AI worked down the queue of roughly 2,900 investigations that had built up over months. The team moved from clearing a backlog to reviewing the cases that need a human decision, each arriving already investigated with the evidence and reasoning behind it.

~17,100 investigations a year, each in about 6 minutes

Over the latest 60 days, Prophet AI completed 2,817 investigations with a mean time to investigate of 6 minutes, a pace of roughly 17,100 a year. Against a 20-minute manual baseline, that is about 5,700 hours of investigation work a year. It surfaced 23 malicious alerts.

~2,600 known-benign alerts a year that never reach an analyst

Suppression rules closed another 431 alerts in the same 60 days, about 2,600 a year. These are alert types the team has already judged benign, so none of them lands in front of a human. At about 5 minutes saved per suppressed alert, that returns roughly 220 more hours a year.

~5,900 analyst hours returned every year

Together, Prophet AI and suppression rules handle about 19,800 alerts a year. That is roughly 5,900 hours, or about 1,060 analyst workdays, returned to the team: the investigation capacity of about 4.2 full-time analysts. That time goes back to threat hunting and hardening the environment.