Human-AI collaboration is becoming the operating model of the cyber-security operations centre (SOC), suggests Tim Leehealey, Vice President of Corporate Strategy and Operations at the platform Strike48.ย
Agentic AI is often discussed in terms of automation, but this framing doesnโt reflect whatโs actually happening inside security operations. The shift towards AI agents isnโt about removing analysts from the security decisions or reducing the importance of their judgement, but about streamlining how they engage with incident escalation within the SOC.
In SOCs, a large portion of the analystโs effort is spent assembling the context around an alert before making decisions about monitoring and escalation. Security alerts may arrive with a basic level of enrichment, but they frequently lack the necessary context for analysts to act on them quickly. Instead, analysts have to pull together additional signals, validate their assumptions, and work out how the alert fits within the broader environment.
This is a familiar and proven process, but it can also be expensive and time-consuming, and represents a major bottleneck to decision-making speed within SOCs. The time spent trying to understand alerts is the same time that attackers can use to wreak havoc. Itโs this bottleneck that agentic AI can help to mitigate.
Rather than leave context assembly entirely to analysts, AI agents can be configured to automate the earliest steps of the alert process. Agents can correlate relevant signals faster, they can surface historical patterns automatically, and they can present the situation in a form better suited for the higher-level decision-making of analysts.
With agentic AI, the role of security analysts isnโt reduced, but enhanced: analysts remain a critical link in the threat detection chain but, rather than spending the majority of their time building an understanding of the situation, theyโre instead able to focus directly on applying judgement to the data in front of them. Their decisions remain critical, while the path to these decisions becomes clearer and more consistent.
This division between the system and analysts is where the full benefits of agentic AI become clear, and where the difference in productivity produced by real and robust automation becomes even clearer. Agentic AI also helps to maintain consistency: instead of relying heavily on individual experience, agents enable a base level of consistency across all alerts; they can observe historical patterns in the SOCโs logs and in past alerts and escalations, and provide analysts with a view of these trends. This ultimately helps to reduce the variability of decisions across the SOC and ensures a degree of robustness in security responses.
As Keven Knight, CEO of Talion Cyber Security explains: โThe role of the analyst does not diminish as technology evolves, it becomes more critical. Decisions in security operations carry accountability, and that accountability cannot be transferred. What changes is how that individual is supported. As environments become more complex, the ability to ensure that decisions remain consistent and aligned with organisational risk becomes increasingly important. The balance between human judgement and system support is what ultimately determines whether that accountability can be maintained at scale.โ
As environments grow and teams scale, understanding how to manage the balance between analysts and automated systems becomes important. In smaller teams, experience can compensate for gaps in process or tooling. However, as the scale of monitoring increases and the number of alerts grows, it becomes harder to sustain operations, and thereโs a greater reliance on escalation, more need for revalidation, and far more effort spent maintaining alignment across the team.
Agentic AI can be used to stabilise this dynamic: by structuring context assembly, it reduces the variability that comes from relying solely on individual interpretation. Analysts are still making decisions, but they are doing so within a workflow that provides a more consistent foundation.
Confidence in responses to security events increases, not just in individual decisions but in how the system operates as a whole. Analysts donโt feel the need to second-guess what theyโre seeing, and they spend more time acting on incidents; the SOC operates more smoothly because the labour required to process each situation is distributed more effectively between automated systems and analysts. For MSSPs, this becomes particularly significant: operating across multiple clients requires a level of consistency that is difficult to maintain through process alone. Each environment introduces its own context, and ensuring that decisions hold up across those environments is one of the more challenging aspects of scaling the model.
By supporting the analyst directly, agentic AI allows that consistency to be maintained. It enables teams to operate more efficiently while still retaining control over how decisions are made. This changes how the SOC is structured, not by weakening the judgement of human professionals, but by strengthening their capabilities and enhancing their role within the detection and response processes.
The result of integrating agentic AI into the SOC is not full automation: agentic AI creates a SOC where human judgement and system-driven context work together more closely, each supporting the other in a way that allows the operation to scale without introducing unnecessary friction.
See also the Strike48 blog.
