What is an agentic SOC?

An agentic SOC is a security operations centre where AI agents take over part of an analyst's work: they investigate alerts, gather evidence, propose a verdict and, depending on the autonomy they are granted, carry out response actions. People supervise and decide the ambiguous or high-impact cases.

What an agentic SOC is, and what it is not

We have not found a normative definition of the term: vendors use it with different levels of autonomy. That is why it helps to separate it from three things it is confused with:

The key difference is that the agent decides the intermediate steps. That is both its advantage and its risk.

What an agentic work cycle looks like

A real design example: Google SecOps' triage and investigation agent reads an alert, runs dynamic searches, enriches with threat intelligence, analyses command lines and reconstructs process trees; when it finishes it returns a verdict (true or false positive), a confidence level, a summary, a timeline and suggested next steps, which the analyst reviews and rates [1]. This is documentation for one specific product, useful for seeing the pattern:

1. Trigger: an alert arrives.
2. Plan: the agent decides what to check.
3. Investigation: it queries SIEM, endpoint, identity and threat intelligence.
4. Verdict with an explanation: not just "malicious", but why and with what confidence.
5. Proposal or action: it recommends containment or, if authorised, carries it out.
6. Feedback: the analyst corrects, and the system learns from that correction.

Autonomy levels

This scale is our own illustrative working framework (not a standard) for deciding how far an agent goes:

Starting at level 1 and moving up on your own evidence is a prudent path.

What evidence exists

Independent public evidence is limited. A randomised controlled trial of Microsoft's phishing triage agent reports up to 6.5 times as many true positives per analyst minute and a 77% improvement in verdict accuracy compared with the control group [2]; it is a preprint about the company's own product, for a single task. It is an indication that agent support can help analysts, not a guarantee for your environment.

Risks worth watching

• Excess autonomy. OWASP lists "excessive agency" among the risks of LLM-based applications (2025 edition) [3], and publishes a dedicated Top 10 for agentic applications that identifies the most critical risks of autonomous systems [4].
• Prompt injection through the data itself. An alert contains text controlled by third parties (email subjects, file names, user agents). If the agent treats it as instructions, an attacker may try to divert it; prompt injection tops OWASP's Top 10 for LLMs [3].
• Verdicts without traceability. A conclusion that cannot be reconstructed step by step is not auditable.
• Data poisoning. NIST catalogues adversarial machine learning attacks, including poisoning and evasion [5].
• Blurred accountability. If the agent acts, who answers for it? Write it down before switching automation on.

To govern all this, NIST's AI Risk Management Framework offers voluntary reference guidance [6], and incident response guide SP 800-61 Rev. 3 places response within cybersecurity risk management [7].

What to ask a SOC provider that uses agents

• Which decisions does the agent take alone and which need human approval?
• Does every verdict link to the evidence and the queries behind it?
• Which response actions are reversible and which are not?
• How do you stop the content of an alert from acting as an instruction?
• What data leaves my environment and where is it processed?
• How is performance measured, and can it be reproduced with my data?
• What happens if the agent fails or the AI service is unavailable?
• Who is contractually accountable for an incorrect action?

Our point of view

We believe agents should start by investigating and proposing, with analysts supervising, and gain autonomy only where your own evidence supports it. A managed SOC (SOCaaS / MDR) with analysts remains the foundation; AI adds speed if it is governed well. For that governance we offer AI security consulting, AI-driven security automation and AI governance and security.

For the background, read what threat intelligence is and how AI improves threat intelligence compared with traditional methods.

Frequently asked questions

What is an agentic SOC?

It is a SOC in which AI agents investigate alerts and propose responses, not a SOC without analysts. In the design Google SecOps documents, for example, analysts review the summary, the timeline and the suggested next steps and can re-run the investigation [1]; and our recommendation is to keep people in charge of validating and deciding high-impact cases.

How does it differ from a SOAR?

A SOAR runs fixed flows written in advance; an agent decides the intermediate steps from a goal and from what it finds along the way.

Is it safe to give an agent response autonomy?

It depends on the limits. The prudent approach is to start by investigating and proposing, limit automatic actions to reversible ones and log every decision. OWASP identifies excessive agency as a risk to control [3].

What improvement can be expected?

The public evidence is limited: a Microsoft trial on phishing triage reports productivity and accuracy gains [2], but it cannot be extrapolated without measuring in your own environment.

Can a small business benefit from an agentic SOC?

Usually through a managed service rather than building one itself. What matters is that the provider explains what the AI does, what people do and how it is audited.

Next step

Considering a SOC with AI support? Let's talk about your case or get to know HodeiShield.

Sources

1. Use Triage and Investigation Agent to investigate alerts. Google Cloud documentation. https://docs.cloud.google.com/chronicle/docs/secops/triage-agent
2. Randomized Controlled Trials for Phishing Triage Agent (preprint). arXiv (J. Bono), 2025-11-17. https://arxiv.org/abs/2511.13860
3. OWASP Top 10 for LLM Applications. OWASP GenAI Security Project. https://genai.owasp.org/llm-top-10/
4. OWASP Top 10 for Agentic Applications for 2026. OWASP GenAI Security Project, 2025-12-09. https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/
5. Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (AI 100-2 E2025). NIST, 2025-03-24. https://csrc.nist.gov/pubs/ai/100/2/e2025/final
6. AI Risk Management Framework. NIST, 2023-01-26. https://www.nist.gov/itl/ai-risk-management-framework
7. Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (SP 800-61 Rev. 3). NIST, 2025-04-03. https://csrc.nist.gov/pubs/sp/800/61/r3/final