Machine learning is the key AI technology for detecting suspicious activity without predefined signatures by learning patterns from data and identifying anomalies, outliers, and high-risk behaviors. In SOC contexts, ML can model normal baselines for users, hosts, and applications, then flag deviations such as unusual authentication patterns, unexpected data transfers, or rare process behaviors—capabilities that are particularly useful against zero-days and APTs that evade signature-based tools. NLP is valuable for processing human-language text (tickets, email content, narrative logs), but it is not the primary engine for behavioral anomaly detection across telemetry. Static IP blocking is a manual control that can be bypassed and does not “learn” or adapt. Heuristic-based signatures still rely on predefined patterns, even if they are generalized, and are not the same as adaptive learning. From a SOC perspective, ML can improve detection coverage when combined with strong telemetry and tuning, but it also requires governance: monitoring model drift, validating outputs, and ensuring explainability for analysts. Because the scenario prioritizes signatureless detection and real-time adaptation, machine learning is the best fit.