AI in Incident Response: Scoping a Supply Chain Attack in Two Days

What was reported

At [un]prompted 2026, Rami McCarthy of Wiz gave a talk titled "Zeal of the Convert: Taming Shai-Hulud with AI." Shai-Hulud is an npm supply chain campaign. According to The Weather Report AI's day-one summary, McCarthy reported that one agentic tool identified 2,400+ companies impacted by the Shai-Hulud 2.0 attack in two days. The prior two weeks of manual analysis had turned up 200. The conference listing confirms the talk title and speaker.

By our arithmetic, that is 12 times as many impacted companies (2,400 divided by 200) in one-seventh of the time (two days against fourteen). The talk summary is the only source we found for these numbers. We did not find the slides or a recording, and we measured nothing ourselves, so treat the result as reported, not confirmed.

Why scoping is the slow part

In a supply chain incident, the first alert is rarely the hard part. The work that takes weeks is scoping: finding every organization, system, and credential the attacker's foothold touched. That means matching large volumes of leaked or logged data against inventories, removing duplicates, and deciding which matches are real. Those tasks are repetitive and high volume, which suits an automated tool and wears out a human team.

That is our reading of why the reported gap is so wide. The summary does not describe McCarthy's tooling, so we cannot say how it worked.

What still needs a human

A list of 2,400 companies is only the start. Each entry needs checking before anyone sends a disclosure, because a wrong notification costs credibility with the recipient. Someone also has to decide what to tell each organization, in what order, and through which contact. Containment steps that could take down production systems carry business risk that a tool cannot weigh.

The summary reports a manual confirmation of Fortune 100 impact but does not describe how the 2,400 figure was validated. Ask that question of any tool you evaluate: how are false matches found, and who signs off before anything is sent?

What this means for SOC analysts

The reported result points to a change in the analyst's job, from doing every step by hand to directing a tool and checking its output. Analysts who understand attacker behavior well enough to judge whether a tool's scope is complete, or whether a proposed containment step will break a revenue-critical service, gain the most from that change. We expect junior analysts to take on investigations that used to need senior time, and senior analysts to spend more of theirs on threat modeling and review. That is our expectation, not a measured outcome.

Skills to build now

Reading tool output critically. Confidence scores, correlation graphs, and automated scope lists all need interpretation. Know what drives a score and when to distrust it.

Precise queries. AI-assisted security tools answer natural language questions, and a specific question such as "show all lateral movement from this endpoint in the last 72 hours, excluding known service accounts" gets a better answer than a vague one.

SOAR playbooks. Orchestration platforms are where approved actions run. Knowing how to build and troubleshoot playbooks is as useful as knowing how to write SIEM rules.

Data analysis. Tools handle volume and people handle nuance. Statistical baselines, anomaly patterns, and threat hunting results are the skills that keep you useful as the tools change.

Incident communication. A tool can draft an impact report. It cannot run a crisis call with an executive, negotiate disclosure timing with a partner, or decide when to involve law enforcement.

Test yourself with practice quizzes to find gaps, and use CyberFolio to track your progress. Before you plan around the reported numbers, read the source and then test any AI-assisted scoping tool against an incident you have already closed.