The Advent of the Agentic SOC
When OpenAI released its chatbot in late 2022, it was a novelty for most. It helped us debug code here and there and draft emails. It was a useful tool. But since then, AI has undergone rapid development, to the point where some models have been withheld from release over fears of abuse by cybercriminals. This has led to widespread adoption in nearly every field on earth, including cybersecurity operations.
As someone who just started in this field, it is an interesting time to be here. From AI-assisted triaging to threat hunting, there is an incoming shift toward new tools, new methods, and the redefinition of roles. The biggest change is the move toward an Agentic SOC, where everything is AI-first.
The Inevitable Shift to Agentic AI Operations
The first time I used an AI chatbot, it was to ask about an error in the app I was building at the time. I still remember the relief after solving it without opening Stack Overflow. I kept using it more and more until I barely opened a search engine for programming issues.
Now, transitioning into security operations at this particular moment, I see that AI will be a real relief for analysts. It will serve not only as a tool to prompt and answer but also as a system that can operate autonomously. Instead of a human driving an investigation, it can be the other way around. For example, an agent can be given a task to investigate a suspicious incident. The agent will autonomously gather data, correlate logs, map activity to the MITRE ATT&CK framework, and suggest a response, all while the human focuses on validation.
What does this look like in practice?
Cisco's XDR platform is rolling out a feature called Instant Attack Verification, which applies agentic AI to strengthen how security incidents are identified and prioritized. Rather than simply flagging anomalies, the system evaluates each alert as it arrives and determines whether it constitutes a genuine attack.
The output is a straightforward assessment. An incident is either confirmed as an attack or dismissed, complete with an explanation of its impact and a measure of how certain the system is about its conclusion.
The analyst then reviews the agent's logic and decides whether to act on its recommendations.
This approach enables rapid investigation that operates at near-machine speed. This is important because attackers are using AI to craft their campaigns, which demands the same level of energy from defenders to defeat them.The Evolving Skillset
Two key responsibilities of analysts in the agentic SOC will be overseeing the work of AI agents and proactive threat hunting. Analysts will need to verify that the agents' conclusions are correct and that their actions align with business context. With AI handling the initial triage, human analysts will have more time to focus on proactive threat hunting to uncover threats that AI might miss.
This shift from manual investigations will require new skillsets for SOC analysts. The day-to-day grind of manual triage will give way to a role that demands a deeper understanding of applied AI, the ability to interpret AI-driven insights, and a more strategic mindset.
The Agentic SOC is coming, and for analysts and cyber defenders, it represents an opportunity to learn new working methods to counter AI-powered attacks.