AI has not changed the fundamentals of incident response, but it is changing the speed, scale, and quality of context available to security operations teams as they move through the NIST lifecycle. SOAR platforms accelerated DNS, malware, reputation, and threat intelligence lookups, but trusted automation rarely extends into higher-consequence response actions because disabling an account or isolating a system requires more than indicator data alone. As response decisions increasingly depend on supplier, vendor, and external attack surface context, AI can help correlate data that often sits outside SOC visibility and beyond the organization’s own walls.

Using a sUAS base defense scenario, this session examines an incident where trusted atomic enrichment returns clean, but risk emerges from an unmanaged contractor laptop running commercial drone management software that may be bridging or syncing data across environments. It introduces a practical framework for using AI as an interpreter, not a decision-maker, to apply supply chain context beyond standard pre-incident governance and risk management into NIST-aligned active response activities. Attendees will learn how this approach can shape mission impact analysis, containment scope, authorized response options, third-party coordination, and continuous playbook improvement so operators can act with confidence across the full lifecycle.  

Learning Objectives 

• Differentiate what AI has changed in incident response from what it has not, using the NIST 800-61r3 lifecycle to frame how AI improves context across Detect, Response, and Recover activities. 

• Understand why trusted automation often stalls at enrichment, and learn how AI can add the mission impact, entity importance, exposure, and vulnerability context missing from standard indicator data.  

• Explore how to reframe triage decisions from “Is this indicator malicious?” to "What does this mean to the mission, who or what is affected, how exposed are we, and what should we do next?" 

• Learn how AI-enabled context, when applied to internal and external environments, can build the operational confidence needed to extend trusted automation into containment, eradication, and recovery.