Virgin Money Slashes Alert Backlog 60% Using AI SOC Automation

Virgin Money achieves dramatic SOC efficiency gains

Virgin Money reduced its security operations center alert backlog by more than 60% in under two months by deploying Legion Security's agentic AI automation platform, according to a case study published by the vendor.

The UK bank, which serves over 6 million customers with a security team of approximately 200 people, faced tens of thousands of backlogged alerts—many low-value or false positives. Legion's platform processed 30,000 of these alerts during the two-month period while learning the bank's existing analyst workflows.

"Legion has just completely transformed the way I think about automation. You take your existing operation and really just 10x it," said Neil Robinson, CISO at Virgin Money.

How the automation works

Legion uses vision models and other techniques to observe how security analysts investigate alerts. The platform then helps organizations either codify those processes or optimize them into visual agentic workflows that teams can inspect and verify.

Crucially, Virgin Money did not need to define workflows manually or redesign its SOC operations. The system learned from existing practices, a departure from traditional automation approaches that require extensive upfront configuration.

Robinson emphasized that transparency was essential for adoption. "It feels a little bit like magic when you first turn it on, but then it gives you this really nice workflow diagram where you can see exactly what it's doing," he said.

Why it matters

Alert fatigue remains one of the most persistent challenges in enterprise security operations. When analysts face overwhelming volumes of alerts—many of them false positives—critical threats can slip through unnoticed. Virgin Money's results demonstrate that AI automation can address this problem without requiring teams to abandon their existing processes or sacrifice visibility into how decisions are made. The 10x efficiency gain Robinson describes suggests that properly implemented AI can meaningfully expand SOC capacity without proportional headcount increases.

Addressing replacement concerns

Virgin Money reviews approximately 100 new security solutions annually, with integrity a top concern for each evaluation. Initial team concerns that automation might replace analysts shifted as the technology proved its value.

"I don't see it as something that's going to replace any of my team. I see it as something that's going to help us defend the increasing speed of the attack," Robinson said.

By automating repetitive investigation work, Legion freed Virgin Money's analysts to focus on cases requiring human judgment and expertise.

Legion Security, backed by Coatue, Accel, and Picture with investors from Island, CrowdStrike, Wiz, and Google DeepMind, maintains offices in New York and Tel Aviv. The company positions its platform as a way for enterprises to adopt frontier AI models gradually while maintaining operational trust.

These details were first reported by Legion Security in a customer case study released August 21, 2026.