The autonomous Security Operations Centre (SOC) is an attractive idea, but it is the wrong ambition. AI is already becoming part of the SOC in several ways, from detection engineering and signal enrichment to LLM-assisted reporting, case summarisation and analyst productivity. But the strongest use of AI in security operations is still assistance, not unchecked autonomy. The cyber security industry often treats autonomy as the inevitable destination, with more automated decisions, fewer humans and a SOC that increasingly runs itself. That story is appealing, especially for organisations facing more telemetry, more fragmented tools and more pressure to respond quickly. It is also the wrong place to start.
The goal should not be fewer analysts in the loop. It should be better-informed analysts making faster, higher-quality decisions. The strongest SOC model is not one that replaces analyst judgement. It is one that gives analysts better evidence, clearer context and more time to make the decisions that matter. In security operations, speed without accountability can create as much risk as delay.
In this context, AI agents are systems that can work through defined investigation tasks within clear limits. Unlike a chatbot that answers a question, an AI agent can follow a sequence of investigation steps, gathering evidence, enriching signals, connecting related activity and preparing findings for review. That distinction matters because the opportunity is not to remove people from the loop, it is to give them more time for the work that genuinely requires human expertise, such as understanding business context, challenging assumptions, hunting for emerging threats, improving detections and making risk-informed decisions.
From summaries to investigation
Agentic AI is not just another way to ask questions or produce summaries. In a SOC, its value is in working through a defined investigation task within clear limits, gathering telemetry, enriching indicators, connecting activity across sources and preparing findings that an analyst can inspect, challenge and use.
That also depends on the basics being in place. AI cannot investigate what it cannot see, and it cannot explain what the service cannot connect. Reliable telemetry, enrichment, asset context and a clear way of linking related signals are what turn AI output from a confident summary into something an analyst can trust, challenge and use.
That is different from simply surfacing alerts. The agent is progressing a controlled investigation, not just describing available evidence. That creates value, but only if governance, transparency and operational discipline are built in from the start.
Where agents can add value
Most SOC teams do not lack effort, they lack capacity. Analysts spend too much time moving between consoles, checking reputation sources, reviewing identity and endpoint signals, and manually piecing together what happened from different sources. Too often, valuable analyst time is lost copying information between tools, notes and tickets before the real judgement work can begin.
These tasks matter, but many follow a familiar pattern. An AI agent can help by doing the legwork first, pulling together the relevant alerts, identity signals, endpoint activity, reputation checks and other context before the analyst starts their review. This gives the analyst a clearer starting point, reduces time spent jumping between tools and makes it easier to see what looks suspicious, what is still unclear and where human judgement is needed.
The value is not full autonomy, it is better investigation support. Agents can handle repeatable steps, gather the facts, show the likely scope, highlight what the evidence suggests and flag what still needs a human decision. That could include phishing triage, suspicious endpoint activity, alert enrichment across SIEM, EDR and identity logs, or early investigation of possible lateral movement. The analyst remains in control, using knowledge of the customer, environment, risk and context to decide what the findings really mean.
For example, in an identity investigation, an agent could gather unusual sign-ins, device history, location changes, authentication events and related endpoint activity, then present the evidence with its confidence level and any gaps. The analyst would then test whether the pattern fits the user’s normal behaviour, add business context the data may not show, challenge unsupported conclusions and decide whether escalation or containment is justified. The result combines machine speed in evidence gathering with human judgement about meaning and risk.
The analyst’s role therefore becomes more active, not less. Analysts need to ask better questions of the technology, recognise when evidence is incomplete, test whether conclusions fit the environment and feed investigation outcomes back into detections and playbooks. AI can assemble the evidence, the analyst turns it into understanding.
For SOC analysts, this should be an opportunity, not a threat. AI can remove the investigative admin that slows investigations down, but it cannot replace the curiosity, scepticism, customer understanding and professional judgement that make an investigation valuable. The analysts who gain the most from AI will not be those who step back from the work. They will be those who learn how to direct it, challenge it and use the time it creates to become better investigators.
Keeping agents in their lane
In the SOC, clear limits do not slow AI down. They make it safe to use. An agent needs to know its job, what data it can access, which tools it can use, what evidence standard it must meet, when to involve an analyst and what decisions it is not allowed to make on its own.
The bigger the decision, the more important it is that a person stays in control. AI can help prepare the evidence and highlight likely next steps, but analysts should decide when to close an investigation, escalate to a customer, change severity, recommend containment or take action that could affect users and systems. Those decisions need context, judgement and accountability, not just a completed workflow.
This also means resisting the temptation to roll out agentic AI everywhere at once. Adoption should be phased. Start with bounded investigation use cases, define what the agent can and cannot do, require evidence trails and confidence indicators, set review points for uncertainty or high-impact actions, keep analysts accountable for escalation and containment decisions, and measure quality as well as speed. Trust in AI is earned through use, review and measurement, not assumed because the ambition is compelling.
For security leaders, that creates a practical set of questions to ask before introducing SOC agents: which investigation tasks are bounded enough to delegate safely; what evidence should the agent show before an analyst acts; which decisions must always stay with a person; how will accuracy and analyst trust be measured; and how will agent outputs feed back into detections, playbooks and service improvement?
No black boxes in the SOC
For AI agents to be useful in the SOC, analysts must be able to question the output. That is not just good operational practice, it reflects the wider direction of AI governance and human-centred cyber security, from regulation such as the EU AI Act to NCC Group’s role as a founding signatory of the CREST AI Charter. AI in cyber security should be transparent, governed and subject to meaningful human oversight where outputs could affect important decisions. NIST’s work on human-centred cyber security adds another important lens, stronger security outcomes depend not only on technology, but on how people understand, use and challenge it. In the SOC, AI should make analyst judgement better informed, not harder to exercise. A confident answer is not enough, the SOC needs to see how the view was reached, what might have been missed and what still requires human decision.
Governance should be built into the workflow from the start, including access controls, logging, quality checks, analyst review, feedback loops and service reviews. The aim is to strengthen SOC discipline and keep people accountable for decisions, not create a second decision system that is hard to inspect.
Used well, AI can also help analysts learn. A junior analyst can compare an agent’s evidence trail with an experienced analyst’s reasoning, while senior analysts spend more time coaching, reviewing complex cases and explaining why context changes a decision. That creates a stronger learning environment, as long as AI output is treated as something to examine, not an answer to accept.
What success should look like
The future SOC should not be judged by how many human decisions it removes. It should be judged by whether analysts have more time, better evidence and clearer context for the decisions that matter. If agents can absorb repetitive investigation work, analysts can focus on complex cases, threat hunting, detection improvement, service learning and risk-informed judgement.
That is the practical measure of success. AI helps the SOC move faster and see more clearly, while skilled people remain responsible for the decisions that affect clients, systems and risk.
What this means in practice
Agentic AI can help the SOC move faster, and that matters. Faster triage, earlier detection and quicker investigation can all lead to better security outcomes, but speed should not be treated as the goal on its own. The goal is better decisions, made faster, by skilled people with stronger evidence and more time to focus on what matters. In the near term, that means controlled delegation of repeatable investigation work, supported by transparency, governance, analyst review and clear quality measures. AI-enhanced workflows should expand where they are consistently faster, at least as good in quality and clear about when human judgement is required.
Over time, some lower-risk tasks may become more automated where the controls are proven and the evidence supports it. But the principle should remain the same, people stay accountable for the decisions that affect clients, systems and risk, the point is not to chase an autonomous SOC, it is to build an augmented one, faster where automation helps, more transparent where decisions matter and always accountable where risk is real.