AI didn’t replace our security team — it multiplied it.
The New Stack Andy Gombar
Webflow's security team ditched the SOC model and built its own AI-assisted triage system in-house. It cut 504 hours of grunt work in a single quarter without adding headcount.
Based on reporting by The New Stack, Andy Gombar — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
Webflow's security engineers don't sit in a SOC watching a wall of monitors. There is no rotating shift of analysts. Instead a small, technical team owns the whole detection-and-response lifecycle themselves, and over the past year they've quietly rebuilt that workflow around AI, not as a pilot or a demo but as the thing running in production every day.
The trigger was volume, not ambition. When detections jumped 200% in a single quarter, the old habit of starting every alert investigation from zero stopped being viable. So the team started using AI to do the assembly work before a human ever opens a ticket: pulling context, correlating history, drafting a preliminary severity call. High-confidence false positives get auto-closed outright, a decision the team says came only after months of tuning, not a shortcut taken to save effort. That single change bought back 504 hours of engineering time in one quarter.
For the messier cases, the ones with no clean playbook spanning identity, endpoint, and app layers, the team leans on LLMs as a thinking partner rather than a decision-maker. The models summarize logs, surface similar past incidents, and draft timelines, but every judgment call stays with a human. That boundary, they argue, isn't a limitation being worked around, it's the actual design, because blurring it is exactly what makes an incident response hard to audit later.
The more interesting move is what happens after an incident closes. Post-incident reviews are notoriously the thing everyone values and nobody has energy to do well right after a crisis. Webflow now feeds AI the entire paper trail, chat logs, meeting notes, timelines, and has it draft the retrospective, generate concrete action items, and even propose playbook updates. Crucially, the team says AI is good at spotting the lucky breaks in an incident, the stuff that went right by accident rather than by design, which is usually where the best fixes hide.
None of this works without groundwork most vendor pitches skip over. Clean, normalized data feeding the SIEM, an accurate asset inventory, tightly tuned detections, and documented incident history all have to exist first, or AI just amplifies the mess instead of managing it. Webflow also refuses to lock into one AI provider, treating the real question as not which model to use but which decisions deserve AI-assisted speed versus a mandatory human check, calibrated per alert type and risk level.
The upshot, according to the team, is that the ceiling on what a lean security group can cover has genuinely moved. Not because AI is magic, but because it absorbs the repeatable cognitive grind well enough that engineers spend more time on the judgment calls only they can make.
My take — AI-written commentary, not fact-checked reporting
This is the most believable AI-in-security story I've read all year precisely because it's boring in the right ways — no vendor magic, just a team that fixed its data pipeline before touching an LLM. Every SOC vendor selling you 'AI-powered triage' should be asked why a five-person team at Webflow apparently didn't need to buy it. The uncomfortable pattern here is that most orgs fail with AI not because the model is bad but because their detections were garbage to begin with, and no amount of automation fixes a foundation that was never there.
Read more about this at: The New Stack