What is neurosymbolic AI?

Neurosymbolic AI is an architecture that combines neural learning with symbolic reasoning. The neural layer interprets ambiguous or unfamiliar inputs and reasons across evidence. The symbolic layer provides structure, procedure, and control. In security operations, this means a system can handle messy, inconsistent data while still following the approved procedures, evidence requirements, and audit trails the SOC requires.

Why do AI security prototypes fail to scale beyond the initial demo?

Most AI security prototypes work well on clean, well-structured inputs but break down when they encounter the real operating environment: missing fields, schema variations, APIs that have changed, stale identity data, and detection names that mean different things in different environments. The prototype fails not because the model is wrong but because the system around the model is not complete enough. The model reaches the exciting answer. The system has to reach the operational one — consistent, auditable, and repeatable across all cases, not just the well-formed ones.

What are the limitations of SOAR platforms for security automation?

SOAR platforms encode procedures as fixed playbooks that expect predictable, structured inputs. When the environment drifts — a field name changes, an API updates, a vendor restructures its data — the playbook fails. The automation becomes a maintenance burden rather than a force multiplier. Rules-based systems give consistency and control, but they need a way to survive messy data, changing tools, and cases that no playbook anticipated. That is the gap neurosymbolic AI addresses.

How do agents and skills bridge neural and symbolic AI in the SOC?

The agent is the active layer: it reads context, chooses the next step, calls the right capability, and keeps the investigation moving. The skill is the operating pattern: it defines what to check, which sources to query, what evidence to collect, and how the work is recorded. Skills give the agent structure without turning the workflow into a brittle playbook. The SOC gets a repeatable pattern, but the system can still handle different evidence, different schemas, and different requirements across customers.

How is neurosymbolic AI different from compound AI systems?

Compound AI is the broader architectural pattern: building AI applications from multiple interacting components rather than a single model call. Neurosymbolic AI in the SOC is a more specific operating model within that pattern. It assigns defined roles to each component — the neural layer for reasoning over ambiguous inputs, the symbolic layer for procedure and control, agents for driving the investigation, skills for defining the operating pattern, the knowledge graph for mapping the data environment, and integrations for retrieving facts from systems of record. Compound AI describes the structure. Neurosymbolic describes how reasoning and control are divided within it.

← Resources

BlogJune 10, 2026

Neurosymbolic Systems for SOC Operations

Q: Why does a neurosymbolic security AI system need a knowledge graph?

An LLM can generate queries that look correct without understanding the underlying systems it is querying. In security operations that creates risk: the investigation may return incomplete evidence or produce a false negative that looks like a clean result. A knowledge graph maps the environment — data stores, schemas, entities, relationships, and the use cases they support — so the agent knows where the facts live and how to retrieve them. The graph must be created and updated automatically because security data changes too often for a static catalog to stay useful.

Monzy Merza

Founder & CEO, Crogl

Security operations teams are accountable for outcomes.

They reduce risk under changing conditions, with incomplete information, inconsistent data, and procedures that still have to be followed.

Good analysts already work across both sides of that problem. They reason through ambiguity, recognize patterns, notice exceptions, and connect evidence across systems. They also follow process, document what they checked, preserve evidence, and operate inside the controls their organization requires.

AI that supports security operations has to fit that operating model.

The system needs reasoning because security data is messy. Alerts arrive with missing context. Schemas vary by source. Tools describe the same event in different ways. Threat activity appears in forms no playbook fully anticipated.

The system also needs rules because security work has consequences. Investigations need approved procedures and repeatable execution.

This is the neurosymbolic idea. Neural systems give interpretation and reasoning over unfamiliar inputs. Symbolic systems give structure, procedure, and control. Gary Marcus made a version of this argument in The Algebraic Mind, where he pushed against treating neural networks and symbolic manipulation as mutually exclusive ways to understand intelligence. [1]

The 80 Percent Demo

Most teams have the same first experience with AI in security operations.

They give a model an alert, an advisory, or a chunk of investigation context, and the answer is better than expected. It summarizes the right things. It suggests reasonable next steps. It gets close enough to create momentum.

That first 80 percent is real. The hard part starts after that.

Security operations is made of edge cases. Fields are missing. Schemas vary. APIs change. Identity data is stale. Detection names mean different things in different environments. One customer needs a ticket updated before enrichment. Another needs evidence collected before any action.

Then a well-meaning analyst tries to make the workflow useful for the rest of the team. The magic starts to become a problem. It is hard to see exactly what happened, hard to make small process changes, and even harder to get from a promising answer to something consistent enough for an auditor.

Model choice starts to matter here too. Teams want the flexibility to use the right model for the environment, the task, and the policy constraints without rebuilding the workflow every time.

The prototype usually fails because the system around the model is not complete enough for the operating environment.

The model can get you to the exciting answer. The system has to get you to the operational one.

Each Side Has a Boundary

Security operations has already seen what happens when automation depends too heavily on fixed rules.

SOAR platforms were built on a reasonable premise: encode the procedure, enrich the alert, check the right sources, update the ticket, and save the analyst from repeating the same steps by hand. That worked when the input stayed close to the playbook. It struggled when the environment drifted.

A field name changed. An API updated. A vendor moved data into a nested object. A detection started firing with a slightly different shape. The playbook expected one thing, the tool returned another, and the automation became another maintenance burden.

Rules still matter. They give the SOC consistency, inspection, and control. They also need a way to survive messy data, changing tools, and unfamiliar cases.

Neural systems bring the other half. They can interpret messy inputs, reason across unfamiliar evidence, and suggest useful paths when the case does not fit a known procedure. That flexibility matters because security data is never as clean as the demo.

They have their own boundary. A model can produce a useful answer without following the process the SOC needs followed. It can make a good inference without leaving the evidence trail an analyst needs. It can sound right before the work is actually complete.

A security AI system has to bring these modes together.

The Bridge Between Reasoning and Control

Neurosymbolic systems need more than a neural layer and a symbolic layer. They need a bridge between the two.

That bridge is where agents and skills matter.

The agent is the active layer. It reads the context, chooses the next step, calls the right capability, and keeps the investigation moving.

The skill is the operating pattern. It defines what to check, which sources to use, what evidence to collect, and how the work should be recorded.

Skills give the agent structure without turning the workflow into a brittle playbook. The SOC gets a repeatable pattern, but the system still has room to handle different evidence, different schemas, and different customer requirements.

This is the hybrid model in practice. The agent drives the work through the skill. The skill keeps the work consistent. As the team learns, the skill can improve.

Modularity Is Part of the Architecture

A useful neurosymbolic system also has to be modular.

The neural side should not depend on a single model forever. Different models are better at different tasks, and different environments have different policy, performance, and deployment requirements. The system needs the ability to use multiple models, or swap in the right model for the job, without rebuilding the investigation workflow.

The symbolic side needs the same flexibility through integrations. Security teams already have data lakes, SIEMs, enrichment tools, identity systems, endpoint platforms, ticketing systems, and internal sources of truth. These systems retrieve facts. The AI layer has to work across them without forcing every customer into the same data path.

Modularity keeps the architecture from becoming another brittle automation stack. Models can change. Retrieval sources can change. Enrichment systems can change. The investigation pattern still holds.

The Knowledge Graph Is the Missing Map

LLMs can generate queries that look right without knowing the systems they are querying.

In security operations, that creates risk. If the model does not understand the underlying schemas, data stores, and use case mappings, the investigation can return incomplete evidence or create a false negative that looks like a clean result.

A knowledge graph maps the environment: data stores, schemas, entities, relationships, and the use cases they support. Knowledge graphs are an important substrate for neurosymbolic reasoning because they represent heterogeneous, relational data in a form systems can reason over. [4]

The graph has to be created and updated automatically. Security data changes too often for a static catalog to stay useful.

The agent uses the skill to understand the investigation pattern. The knowledge graph tells it where the facts live and how to retrieve them. The LLM helps reason over the evidence once the right data is in front of it.

Neurosymbolic AI in the SOC

In security operations, neurosymbolic AI is an operating model for investigation.

The neural layer gives the system the ability to interpret ambiguous inputs, reason across evidence, and adapt when the case does not fit a known path.

The symbolic layer gives the system procedure, constraints, retrieval, evidence requirements, and repeatable execution.

The bridge layer connects the two. Agents keep the investigation moving. Skills define the operating pattern. The knowledge graph maps the data environment. Integrations retrieve the facts from the systems of record.

This fits the broader shift toward compound AI systems, where AI applications are built from multiple interacting components rather than a single model call. Compound AI is the broader system pattern. Neurosymbolic AI in the SOC is a more specific operating model where reasoning, retrieval, tools, procedure, and evidence all have defined roles. [5]

The system can reason through messy inputs without losing the structure the organization requires. This is also consistent with the broader neurosymbolic research direction: combining neural approaches with symbolic methods so learning and reasoning can reinforce each other. [2][3]

Operationally Relevant AI

Security teams are accountable for outcomes, and the attacker-defender asymmetry is becoming an economic problem. Frontier models are getting better at multi-step cyber operations, and capability improves as more inference budget is applied. Meanwhile, the cost of getting defense wrong is measured in millions. The test for any AI system in the SOC is whether it helps practitioners do the work with more consistency, better context, stronger governance, clear auditability, and evidence they can trust. [6][7]

Crogl is a customer-managed neurosymbolic system built for that test. You can download Crogl, join the Slack community, and engage directly with other practitioners and Crogl engineers as you build, test, and extend AI-driven investigations in your own environment.

References

[1] Gary Marcus, The Algebraic Mind: Integrating Connectionism and Cognitive Science, MIT Press, 2001. https://doi.org/10.7551/mitpress/1187.001.0001

[2] Pascal Hitzler and Md Kamruzzaman Sarker, eds., Neuro-Symbolic Artificial Intelligence: The State of the Art, Frontiers in Artificial Intelligence and Applications, IOS Press, 2022. https://doi.org/10.3233/FAIA342

[3] Tarek R. Besold, Artur d'Avila Garcez, Sebastian Bader, Howard Bowman, Pedro Domingos, Pascal Hitzler, Kai-Uwe Kuehnberger, Luis C. Lamb, Daniel Lowd, Priscila Machado Vieira Lima, Leo de Penning, Gadi Pinkas, Hoifung Poon, and Gerson Zaverucha, "Neural-Symbolic Learning and Reasoning: A Survey and Interpretation," arXiv:1711.03902, 2017. https://arxiv.org/abs/1711.03902

[4] Lauren Nicole DeLong, Ramon Fernandez Mir, and Jacques D. Fleuriot, "Neurosymbolic AI for Reasoning over Knowledge Graphs: A Survey," arXiv:2302.07200, 2023; later published in IEEE Transactions on Neural Networks and Learning Systems, 2024. https://arxiv.org/abs/2302.07200

[5] Matei Zaharia, Omar Khattab, Lingjiao Chen, Jared Quincy Davis, Heather Miller, Chris Potts, James Zou, Michael Carbin, Jonathan Frankle, Naveen Rao, and Ali Ghodsi, "The Shift from Models to Compound AI Systems," Berkeley Artificial Intelligence Research Blog, February 18, 2024. https://bair.berkeley.edu/blog/2024/02/18/compound-ai-systems/

[6] UK AI Security Institute, "Our evaluation of Claude Mythos Preview's cyber capabilities," April 13, 2026; and Linus Folkerts et al., "Measuring AI Agents' Progress on Multi-Step Cyber Attack Scenarios," arXiv:2603.11214, 2026. https://www.aisi.gov.uk/blog/our-evaluation-of-claude-mythos-previews-cyber-capabilities and https://arxiv.org/abs/2603.11214

[7] IBM and Ponemon Institute, Cost of a Data Breach Report 2025, 2025. https://www.ibm.com/reports/data-breach