Lenovo improves threat detection accuracy 20x with its own AI-powered Security Operations Center
Lenovo’s in-house Security Operations Center reduced threat detection time by 87.5% and improved accuracy 20-fold using an AI-powered model tested internally before broader deployment.
Lenovo’s Security Operations Center (SOC) monitors 15 billion daily computing events, with approximately 4,000 requiring deep investigation and only 25 deemed critical. The company protects 140,000 devices used by 80,000 employees across 150 countries, facing a threat landscape that has doubled in complexity over five years. Previously, analysts manually reviewed device status, file hashes and network data to assess threats, a process prone to delays and human error due to fragmented workflows across multiple security tools.
To address these challenges, Lenovo developed an AI-powered security model through its Powers Lenovo initiative, using its own SOC as a real-world testing ground. The model ingests relevant security signals to reduce noise before alerts reach analysts, while AI agents triage lower-level incidents and enrich higher-risk cases with context and suggested actions. The system does not replace human judgment but directs analysts’ expertise toward the most critical threats, improving efficiency and response accuracy.
The deployment followed an iterative process over several months, with SOC analysts and cybersecurity partners refining AI outputs for different alert types. Alert-specific playbooks ensured consistent AI-supported decisions, while employee upskilling, process adaptations and strict data controls were implemented to integrate AI safely into daily operations. The result is a model that learns from Lenovo’s cybersecurity expertise while maintaining human oversight for complex decisions.
The new model reduced mean time to detect attacks by 87.5%, from four hours to 30 minutes, and improved malware and attack identification accuracy by 20 times. More than 80% of low-level incidents are now resolved without analyst intervention, allowing experts to focus on higher-priority threats. Lenovo also reduced cybersecurity total cost of ownership by 60% and extended AI-powered workflows to address additional threats, including phishing and brute-force login attempts.