Large language models can investigate security alerts in minutes. But using them to examine every alert an enterprise generates could come with a substantial price tag.
Earlier this year, Anthropic published a video detailing how its internal security team created a system called CLUE (Claude Looks Up Evidence) that uses Claude to investigate security alerts.
Given the right context, Claude developed an investigation plan, gathered evidence from multiple security tools, correlated the findings, and identified a credential compromise coming from an IP address associated with known malicious activity.
The results were quite impressive for this particular scenario. Using this system, they were able to condense hours of analyst work into a few minutes, proving that LLMs have become remarkably capable security investigators especially when directed appropriately.
But the real challenge of using AI in the security investigation process isn’t model capability, it’s tokenomics.
The tokenomics of AI investigation
In this context, tokenomics refers to the economics of AI inference, or how tokens are priced and consumed, and ultimately how that consumption translates into business value.
The investigation shown in Anthropic’s demo isn’t simply a single prompt sent to Claude. Like most agentic systems, it works through a series of sequential tool calls. At each step, the model gathers additional evidence, reasons over everything it has learned so far, and decides what to investigate next.
As the investigation progresses, the amount of context it must repeatedly process continues to grow.
According to Anthropic, CLUE averages 25 tool calls for a single investigation, retrieving data from multiple sources, including SIEM queries, threat intelligence feeds, Slack conversations, internal documentation, code repositories, and other security data.
Each investigation ultimately consumes around 1.5 million input tokens and 10,000 output tokens, and using Anthropic’s pricing for Claude Sonnet 4.6, that works out to roughly $4.65 per investigation.
The average large enterprise receives about 450,000 alerts annually, so running this workflow over that alert volume would cost well over $2 million per year in inference costs alone — before accounting for analysts, security tools, infrastructure, or remediation.
Many AI-assisted investigation workflows are already delivering significant value today, so the question isn’t whether LLMs belong in the SOC, but whether the economics of today’s architectures support comprehensive investigation at enterprise scale.
Why filtering isn’t a new strategy
The immediate response is that not every alert requires this level of investigation, so only high-confidence alerts should be sent to the LLM.
But that’s exactly how security teams already operate. Whether investigations are performed internally or outsourced to an MDR provider, most organizations investigate high-severity alerts, review some medium-severity alerts, and deprioritize the rest because human capacity has always been limited.
The problem is that attackers understand those economics. Intezer's analysis of more than 25 million alerts found that nearly 1% of confirmed incidents originated from alerts initially classified as low severity or informational.
The finding illustrates a limitation of severity-based filtering: some genuine threats begin with signals that appear relatively unimportant. Organizations that consistently deprioritize those alerts risk overlooking incidents that warrant further investigation.
For the average large enterprise, that equates to just over 50 real threats per year hiding in the alerts that don’t get investigated.
When the tokenomics don’t support investigating every alert, organizations inevitably fall back to filtering. And once that happens, they’re making the same trade-offs they’ve always made, and stuck in the same SOC operating model that doesn’t work.
Different AI for different jobs
Anthropic’s demonstration clearly illustrates where LLMs create the most value inside a SOC. Complex investigations benefit from reasoning and the ability to synthesize evidence from multiple sources.
Alert triage is a different kind of problem. It requires consistent evidence collection, forensic analysis, and verdicts delivered across hundreds of thousands of alerts at a cost that makes full coverage practical. Those requirements call for a different AI architecture than the one used for deep, analyst-led investigations.
Think of it like any computing stack with hardware at the bottom, the operating system in the middle, and applications on top. Within an AI SOC, detection tools generate alerts, the automated investigation layer determines which alerts warrant escalation, and reasoning models like Claude sit on top to analyze the relatively small number of alerts that require it.
Just as applications don’t replace the operating system they run on, LLMs won’t replace the investigation layer of the AI SOC. They’ll become more effective when they’re built on top of a system that has already collected evidence, correlated findings, and identified the alerts that truly require human-like reasoning.
The more effectively organizations separate large-scale investigation from deep reasoning, the more valuable both layers become, while also being more token efficient.
The next step for security teams is not simply to determine how many alerts an LLM can investigate, but to measure what each investigation costs and how reliably different approaches identify genuine threats.
That means comparing cost per alert, investigation accuracy, false-negative rates, escalation quality, and analyst time saved. A layered AI architecture may offer a more sustainable path, but its value will ultimately depend on whether it expands investigative coverage without sacrificing the ability to catch threats that matter.
In other news: Hackers are distributing Yoba malware through fake ChatGPT and Claude downloads hosted on GitHub