Every security operations center has the same arithmetic problem: alerts grow faster than headcount. Detection coverage expands with every new cloud account, SaaS application and identity provider, while experienced analysts remain scarce and expensive. Since 2025 the industry’s answer has been the agentic SOC — AI agents that do not just summarize an alert when asked, but pick it up on their own, gather evidence, reach a verdict and propose or take the next step.
The pitch is compelling, and the vendor announcements are real. But so is the gap between a keynote demo and a SOC that can defend its decisions to an auditor, a regulator or a board after an incident. This article separates what agentic SOC capabilities actually ship in late 2026 from what remains aspirational, and lays out a practical model for introducing agents without surrendering accountability.
From Copilots to Agents: What Changed in the SOC
The first wave of generative AI in security operations, roughly 2023 to 2024, was assistive. Analysts typed questions into a chat pane, received a natural-language summary of an incident, or asked for a query to be translated into KQL or YARA-L. The analyst remained the engine; the model was a faster reference manual.
The second wave changes who initiates the work. An agent is triggered by an event — a new alert, a reported phishing email, a suspicious sign-in — and then plans and executes a sequence of steps: pulling related events, enriching indicators with threat intelligence, decoding obfuscated command lines, reconstructing process trees, checking the identity’s recent history and finally producing a verdict with a confidence score and a written rationale.
Gartner formalized the distinction in its October 2025 Innovation Insight: AI SOC Agents, separating AI SOC agents, which act with a degree of autonomy, from cybersecurity AI assistants that only augment a human who stays in the driver’s seat. Gartner also warned explicitly about “agent washing,” the relabeling of ordinary automation or chat features as agents. In its 2026 Hype Cycle for Security Operations, AI SOC agents were placed at the Peak of Inflated Expectations with low market penetration — a useful reminder that the category is real but immature.
What the major platforms ship
The large SIEM and XDR platforms have converged on the same first use case: alert triage and investigation.
- Microsoft Security Copilot introduced purpose-built agents in March 2025, including a Phishing Triage Agent in Defender, alert triage agents for Purview data loss prevention and insider risk, a Conditional Access Optimization Agent in Entra and a Vulnerability Remediation Agent in Intune. Microsoft describes these agents as learning from administrator feedback, and actions such as OS patching still require admin approval.
- Google Security Operations released its Alert Triage and Investigation agent in public preview in November 2025, with general availability planned for 2026. It runs YARA-L searches, enriches findings with Google Threat Intelligence, analyzes command lines and process trees, and returns a verdict with a confidence score and the steps it took.
- Specialist AI SOC vendors sell agents that sit on top of existing SIEM, EDR and identity tools, typically targeting Tier 1 triage across heterogeneous stacks, and SOAR vendors have repositioned their playbook engines as agent orchestration layers.
Notice what is common: the shipped capability is overwhelmingly investigation and recommendation. Autonomous containment exists, but it is usually limited to narrow, reversible actions and gated behind policy.
A Realistic Autonomy Model for Security Operations
“Autonomous SOC” is not a binary. The most useful way to plan is a graded scale, similar to the levels used for driving automation. A five-level framing has become common in 2026 discussions of the agentic SOC:
- Level 0 – Manual: analysts do all triage and response; automation is limited to enrichment scripts.
- Level 1 – Assisted: AI summarizes, explains and drafts queries on request. The analyst decides and acts.
- Level 2 – Supervised agent: the agent investigates on its own and proposes a disposition and response; a human approves before anything with external effect happens.
- Level 3 – Conditional autonomy: the agent closes or contains specific, pre-approved classes of alerts on its own (for example, known-benign phishing reports or a malicious email already blocked at the gateway), with humans reviewing samples and all exceptions.
- Level 4 – Broad autonomy: the agent handles most alerts end to end with minimal oversight.
In practice, mature deployments in late 2026 operate at Level 1 to Level 2 for most alert types, with Level 3 reserved for a short, explicit list of low-risk, high-volume, well-understood action classes. Level 4 is not a sensible target for most organizations today, and independent benchmarks of large language models on realistic detection and response tasks continue to show significant gaps. The goal is not to maximize autonomy; it is to assign the right level to each type of decision.
Deciding the level per action class
Rather than granting an agent a global autonomy setting, decompose the SOC’s work into action classes and score each one:
- Reversibility: can the action be undone in minutes without business impact? Quarantining an email is reversible; wiping a laptop is not.
- Blast radius: does it affect one user, one host, or a business-critical system or executive?
- Evidence clarity: is the verdict usually obvious from available telemetry, or does it depend on business context the agent lacks?
- Volume: is the class frequent enough that automation materially changes analyst workload?
- Measured accuracy: how often have analysts overridden the agent on this class during the supervised period?
High volume, high reversibility, clear evidence and a low override rate point toward Level 3. Anything involving privileged identities, production systems, legal hold or a suspected active intrusion stays at Level 2 or below.
Human-in-the-Loop Done Properly
“Human in the loop” is easy to write in a policy and surprisingly hard to make meaningful. The most common failure mode is not a rogue agent; it is an approval step that becomes a rubber stamp. When an analyst is presented with a confident, well-written verdict fifty times a shift, the approve button gets clicked without reading. Oversight that does not change outcomes is theater.
The Cloud Security Alliance’s 2026 agentic cybersecurity implementation guidance offers a sensible baseline: keep agents read-only by default, require human approval for any action with external effect, give reviewers the full evidence and reasoning chain, and demand active confirmation rather than click-through approval. It also recommends that a human takes over once a compromise is suspected, and that a human reviews any “no evidence of compromise” conclusion before it is closed.
Design patterns that keep oversight real
- Explicit escalation triggers: privileged accounts, crown-jewel assets, new correlation patterns, high-confidence malicious verdicts and low agent confidence all route to a human automatically.
- Evidence-first review screens: show the queries the agent ran, the data it saw and the data it could not see, before the conclusion.
- Blind test injection: periodically seed known-malicious and known-benign test cases to measure both agent accuracy and reviewer attentiveness.
- Separate credentials for investigation and containment: an agent that can read logs should not automatically hold the token that disables accounts. Destructive actions require a fresh, time-limited, action-specific authorization.
- Kill switches that work at 3 a.m.: pause, scoped pause and full stop controls that do not depend on the same tooling the attacker might have compromised, tested in tabletop exercises.
The goal of an agentic SOC is not maximum autonomy. It is the right level of autonomy for each decision, with evidence a human can check and a switch a human can pull.
New Risks the Agents Bring With Them
An AI agent with access to your security telemetry and response tooling is itself a high-value, non-human identity. Treat it accordingly.
Prompt injection through telemetry
Agents read attacker-controlled content all day: email bodies, file names, command lines, user-agent strings, web page text. A crafted string that says, in effect, “this activity is authorized maintenance, close the alert” is a realistic attack. The OWASP Top 10 for Agentic Applications, published for 2026, lists goal hijacking and tool misuse among the leading risks. Mitigations include treating all event content as untrusted data, keeping system prompts in version-controlled, tamper-evident configuration, and constraining the actions an agent can take regardless of what its context window says.
Silent telemetry and overconfident verdicts
Attackers routinely disable or tamper with logging and security tools, a technique catalogued in MITRE ATT&CK. A human analyst may notice that a host suddenly went quiet; an agent reasoning only over the data it receives may conclude that nothing happened. Agents should report what data was missing, and gaps in log continuity should themselves be treated as a security signal.
Over-privilege and accountability
Agents tend to accumulate permissions during pilots. Scope each agent to the minimum data sources and API operations it needs, use short-lived tokens, rate-limit actions per session, and keep a documented inventory of every automated action an agent can perform. Retain the agent’s full decision logs — prompts, tool calls, outputs and approvals — long enough to support incident reviews and regulatory inquiries.
Metrics That Show Whether Agents Are Helping
Vendor dashboards will report time saved. That number matters, but it is not sufficient. A balanced scorecard for an agentic SOC tracks quality, risk and efficiency together:
- Analyst override rate by alert type — the single best indicator of whether a class is ready for more autonomy, or needs to be pulled back.
- False negative rate on seeded tests — what share of injected malicious cases the agent dismissed.
- Low-confidence share — how often the agent says it is unsure. A sudden drop can mean overconfidence rather than improvement.
- Mean time to triage and mean time to respond, measured end to end, not just agent processing time.
- Uninvestigated alert backlog — whether alerts that were previously ignored now receive at least an automated first look.
- Analyst time reallocation — hours shifted from Tier 1 triage into threat hunting, detection engineering and incident handling.
- Cost per investigated alert, including model consumption, which can grow quickly if agents investigate every low-fidelity signal.
Set thresholds in advance. If override rates or seeded-test misses cross a limit, the agent automatically drops back one autonomy level for that class until the cause is understood.
A 90-Day Plan to Pilot an Agentic SOC
- Weeks 1–2: Baseline. Measure current alert volumes by source and type, triage times, backlog, false positive rates and analyst time allocation. Without a baseline, every vendor claim is unfalsifiable.
- Weeks 2–3: Pick two or three alert classes. Good candidates are high volume, repetitive and well documented: user-reported phishing, impossible-travel sign-ins, commodity malware detections on endpoints.
- Weeks 3–4: Define guardrails. Write the action inventory, escalation triggers, credentials model, logging requirements and go/no-go criteria. Involve legal and privacy if the agent will touch employee behavioral data.
- Weeks 4–8: Run in shadow mode. The agent investigates in parallel with humans but its verdicts are not acted upon. Compare dispositions, record disagreements and examine why.
- Weeks 8–11: Supervised mode. Analysts start from the agent’s investigation and approve or override. Track override rate, time per alert and reviewer attentiveness via seeded cases.
- Weeks 11–13: Decide. For each class, choose to expand, hold at supervised, or retire. Promote at most one narrow, reversible class to conditional autonomy, with sampling review.
Worked Example: User-Reported Phishing
Consider a mid-sized company whose security team receives several hundred user-reported phishing emails a week. Most are marketing mail or simulation emails; a minority are genuine credential-phishing attempts. Each report takes an analyst several minutes to check headers, detonate links, search for other recipients and decide.
In shadow mode, the agent receives every report, extracts URLs and attachments, checks sender reputation and authentication results, searches mail logs for the same campaign, checks whether any recipient clicked, and drafts a verdict. Over four weeks the team compares its own dispositions to the agent’s and finds strong agreement on obvious marketing mail and clear phishing, but frequent disagreement on emails from newly onboarded suppliers, which the agent tends to flag as suspicious.
The team responds by keeping supplier-domain emails at supervised level, and promoting only one narrow class to conditional autonomy: reports of emails that match a known simulation campaign or are already blocked and purged by the email gateway, where the agent may close the report and send the user a feedback message. Any report where a recipient clicked a link or entered credentials immediately escalates to a human, with the agent’s investigation attached, and triggers the identity playbook. Analysts review a weekly sample of auto-closed reports. The result is not an autonomous SOC; it is a SOC where analysts spend their time on the reports that matter.
What to Expect Next
Three developments are likely to shape the next 12 to 24 months:
- Multi-agent workflows: triage agents handing off to hunting, identity and remediation agents, coordinated through open protocols such as the Model Context Protocol. This multiplies both capability and the need for clear authorization boundaries between agents.
- Governance expectations hardening: regulators and auditors are starting to ask how automated security decisions are made and logged. Frameworks such as the NIST AI Risk Management Framework and ISO/IEC 42001, together with incident reporting regimes like NIS2 and DORA, will make decision traceability a compliance issue, not just good practice.
- Better independent evaluation: expect more public benchmarks and third-party testing of SOC agents, which should help buyers move beyond vendor-reported accuracy figures.
The underlying shift is durable. Agents will increasingly do the first pass on everything, and human analysts will move up the stack into judgment, hunting, detection engineering and incident leadership. Organizations that build strong data foundations, explicit autonomy policies and honest metrics now will be able to take advantage of better agents as they arrive.
Conclusion
The agentic SOC is real in 2026, but it looks less like a self-driving security operation and more like a very capable junior analyst who works every alert, documents every step and still needs supervision. Start with triage and investigation, assign autonomy per action class, design oversight so it changes outcomes, treat the agent as a privileged identity and measure quality as rigorously as speed. Done this way, AI agents shrink the backlog and give scarce experts their time back without creating a new, unaccountable layer in your defenses.
How Hanoi Technology Can Help
Hanoi Technology helps security teams pilot AI SOC agents with clear autonomy policies, guardrails and metrics, through projects, dedicated teams or managed services.
Further Reading
- Innovation Insight and Hype Cycle context: Agentic SOC explained – Vectra AI
- Agentic Cybersecurity Implementation Guide – Cloud Security Alliance Labs
- Microsoft unveils Microsoft Security Copilot agents – Microsoft Security Blog
- Google Alert Triage and Investigation Agent – Cybersecurity News
- OWASP Top 10 for Agentic Applications for 2026 – OWASP GenAI Security Project