What Is Attack Path Discovery? The AI SOC Capability That Replaces Manual Alert Triage

Executive Summary

The average enterprise SOC receives over 4,400 security alerts per day. Large organizations face 10,000 or more across 28+ integrated tools. Yet 67% of those alerts go uninvestigated, because manual correlation simply cannot keep pace with volume. The result: 61% of SOC teams have ignored alerts later confirmed as genuine compromise.

Attack Path Discovery (APD) is the capability that breaks this cycle. Where SOAR platforms execute the same rigid playbook steps regardless of context, and where natural language overlays merely speed up the same manual process, APD autonomously traces how threats propagate across tools and time, delivering structured, L2-quality investigation reports in under two minutes per alert.

D3 Morpheus AI is an AI Autonomous SOC platform that performs multi-dimensional APD on every incoming alert. It correlates vertically into an alert’s origin tool and horizontally across the full security stack, building a unified threat narrative that mirrors what an experienced analyst does manually, but at machine speed, without fatigue, and with consistent depth regardless of whether the alert fires at 3 PM Tuesday or 3 AM Saturday.

This paper explains what Attack Path Discovery is, why it represents a structural shift beyond SOAR-based triage, how Morpheus AI implements it, and what the measurable impact looks like in production SOC environments.

The Triage Problem: Why SOAR Platforms Have Reached Their Ceiling

For over a decade, SOAR platforms have relied on static playbooks to handle alert triage. A SOAR architect designs multi-step workflows (often 250 to 500 steps per complex investigation) that execute the same predefined logic every time an alert fires. This model brought structure and repeatability. It also introduced five structural limitations that define a ceiling for the entire SOAR category.

Five Structural Limits of SOAR-Based Triage

The consequence is measurable: 40% of alerts are never investigated, and 61% of SOC teams report ignoring alerts later proven to be genuine compromise. These are SOAR’s design constraints, baked into the architecture itself.

What Is Attack Path Discovery?

Attack Path Discovery is the autonomous, multi-dimensional correlation of security telemetry to trace how a threat propagates across tools and time. Rather than executing a static checklist, APD follows the evidence, the way an experienced L2 analyst would, to construct a complete threat narrative for every alert.

APD is the core capability that distinguishes the AI Autonomous SOC model from SOAR. Where SOAR runs predefined playbooks, APD investigates from first principles. No prebuilt workflow required.

Morpheus AI performs APD along two axes simultaneously on every incoming alert:

The combination produces what no SOAR playbook can: a contextual, evidence-based investigation report that accounts for the specific threat, the specific target, and the specific environment, every time.

How APD Differs from Manual Correlation

An experienced analyst investigating a suspicious endpoint alert would manually query the EDR console, check SIEM logs, pivot to identity systems, examine network flows, and build a mental model of the attack chain. This process takes an average of 70 minutes per alert. Morpheus AI completes the same multi-tool correlation in under two minutes, with consistent depth regardless of alert volume or time of day. The structural difference: APD moves investigation intelligence from the playbook author to the platform itself. This is what makes the AI Autonomous SOC a replacement for SOAR, not an add-on.

APD in Action: VP of Finance Phishing Attack

Consider a phishing alert targeting the VP of Finance. A SOAR playbook would run its standard 15–20 steps (check URL reputation, scan attachment, query sender history) regardless of who was targeted, what the payload does, or whether the attacker has already moved laterally.

Vertical Discovery: Morpheus AI identifies a novel document containing a macro that downloads a second-stage loader. It traces the process tree from the email client through the document application to the loader execution, identifying command-and-control (C2) communication.

Horizontal Correlation: The platform pivots across the security stack and discovers the attacker used the VP’s compromised credentials to access a sensitive M&A file share. Identity system logs reveal a new MFA registration from an unfamiliar geography. Network telemetry confirms data exfiltration to the C2 domain.

Generated Playbook: Based on the discovered attack path, Morpheus AI generates a bespoke response:

• Isolate the compromised endpoint immediately
• Revoke all active sessions for the VP’s credentials
• Block the identified C2 domain across all perimeter controls
• Scan the M&A file share for unauthorized access and exfiltration indicators
• Notify legal and compliance teams given the sensitivity of accessed data
• Initiate board notification procedures per data breach protocol

A SOAR phishing playbook would have closed the alert at the email layer, missing the lateral movement, credential compromise, data exfiltration, and compliance implications entirely. APD followed the full attack chain. The entire investigation and playbook generation completed in under two minutes, producing a structured report with step-by-step reasoning that an analyst can review, challenge, and learn from.

Why Natural Language Overlays Don’t Fix SOAR’s Structural Limits

Across the SOAR market, vendors are bolting general-purpose LLM interfaces onto existing static playbook engines and marketing the result as AI-powered triage. These overlays provide genuine quality-of-life improvements: faster playbook authoring, natural language data querying, and better accessibility. But adding an AI chat layer to a SOAR platform does not make it an AI Autonomous SOC. The playbook engine underneath remains unchanged.

SOAR + Overlay vs. AI Autonomous SOC with APD

The root cause of this industry pattern is economic: replacing SOAR requires building a purpose-built cybersecurity LLM, redesigning the investigation model, and eliminating the static playbook generator entirely. Most vendors chose the faster, lower-risk path of adding a chat layer to their existing SOAR architecture.

How Morpheus AI Implements Attack Path Discovery

Morpheus AI is an AI Autonomous SOC platform built from the ground up around a purpose-trained cybersecurity LLM. It is not a SOAR platform with AI bolted on; it is a SOAR replacement. Every alert triggers a complete APD investigation automatically, without playbooks, without SOAR architects, and without manual correlation.

Purpose-Built Cybersecurity LLM

D3 Security invested 24 months and 60 specialists (red teamers, data scientists, AI engineers, and SOC analysts) building a domain-specific LLM that understands how attacks propagate at a structural level. A general-purpose model can generate text about cybersecurity. Morpheus AI’s LLM understands the progression from phishing payload to credential theft to lateral movement, recognizes how compromised credentials enable endpoint-to-identity-to-cloud transitions, and distinguishes between benign PowerShell administrative tasks and fileless malware indicators.

No amount of prompt engineering gives a general-purpose model this depth. It requires purpose-specific training data and 24 months of domain-focused development.

Customer-Expandable Intelligence

Organizations are not locked into D3’s base model. They can expand and customize the LLM for their specific environment, threat landscape, and SOC procedures. The result is a proprietary, customer-specific triage capability that improves over time. This becomes an intellectual asset that belongs to the organization, not the vendor. Every step of the reasoning is transparent, reviewable, editable, and overridable. No black boxes.

Capabilities That Amplify APD

Measured Impact: APD in Production Environments

Attack Path Discovery delivers measurable results across the metrics that matter to SOC leaders.

How Analysts Spend Recovered Capacity

Analyst Role Transformation

APD elevates the SOC analyst role. Analysts shift from ticket processors running SOAR playbook steps to strategic operators who review L2-quality investigations, validate AI decisions, conduct proactive threat hunts, engineer detection rules, and advise on security architecture. With 71% of SOC analysts reporting burnout and 64% considering leaving within the year, this transformation addresses retention at the structural level.

Questions for Your Evaluation

When evaluating whether your current SOAR-based triage model can keep pace, these questions surface the structural gaps that Attack Path Discovery addresses.

Next Steps