The Security Operations Centre (SOC) has long been the frontline of cyber defence, but has evolved to take a very different form, moving from manual monitoring to increasingly automated operations. Today, AI is transforming SOCs from rules-based environments into AI-assisted hubs where analysts are empowered to work more efficiently. Tasks such as alert enrichment, investigation triage, and automated containment are already benefiting from AI, helping to reduce alert fatigue and improve the accuracy of investigations.
Whilst the use of AI for good is increasing, the next wave of disruption is on the horizon as agentic AI threatens to rock the boat. Unlike traditional AI that requires human prompting, agentic AI can operate autonomously, executing tasks and making decisions independent of human involvement. This evolution could lay the foundation for the autonomous SOC, where AI not only supports analysts but actively manages detection, investigation, and response processes. In practice, this means AI could dynamically construct and execute investigation playbooks, assess whether activity is malicious, and remediate threats without human intervention.
The rise of agentic AI
The path to a fully autonomous SOC is far from straightforward and brings with it some immediate implications that introduce hesitation with the potential obsolescence of level one analysts. Though automation helps junior analysts level up their skills, guided by Security Orchestration, Automation, and Response (SOAR) tools, agentic AI would see this role become redundant. However, organisations risk creating a future skills gap and increasing dependence on AI without these entry-level analysts.
SOC teams must navigate challenges around system integration, fine-tuning outcomes, and defining appropriate governance and recognise that agentic AI is not a simple plug-and-play solution. Additionally, while AI promises speed, the cost of processing at scale remains significant, particularly for full incident response and can be twice as expensive as existing automated SOC and MDR solutions, making strategic application essential. Without careful management, AI-driven operations could become prohibitively expensive as alert volumes increase.
A phased approach
Organisations must consider this and look to adopt a staged approach to AI autonomy. Early experimentation has already revealed inconsistencies, such as identical alerts producing different investigation outcomes, highlighting that agentic AI still requires calibration. By phasing the approach, businesses can begin with AI-assisted SOCs, where analysts leverage AI to augment their work. The next phase, partial autonomy, introduces agentic AI for specific use cases such as lower-risk responses or investigative guidance, while humans remain in the decision-making loop. Ultimately, for full autonomy to be achieved, AI will handle all SOC operations and humans act as overseers, refining AI performance and ensuring alignment with evolving threats.
This phased strategy allows organisations to integrate AI without disrupting SOC operations or compromising security and also buys time for the technology to mature and for outcomes to be verified in practice rather than theory.
Organisations must identify where autonomy delivers tangible benefits, assess the impact on staffing and skills development, and understand the technical and economic implications of AI adoption. For many organisations, fully autonomous SOCs may initially be out of reach but Managed Security Service Providers (MSSPs) can play a key role here, serving as testbeds for agentic AI while shielding clients from the risks and costs of early adoption. Selecting an MSSP with a clear roadmap for AI integration ensures that organisations can benefit from innovation while mitigating exposure to its current limitations.
The case for autonomy
Despite these challenges, the autonomous SOC is becoming increasingly necessary as threats surge, many of which are AI-driven, meaning that SOCs need the speed and adaptability of AI to respond effectively. Agentic AI could detect, investigate, and remediate incidents by rolling back systems to a pre-infection state, revoking compromised credentials, and updating firewall rules without human intervention.
Partial autonomy already provides tangible benefits through Large Language Models (LLMs) that predict new attacks and devise detection logic, while agentic AI can suggest remediation strategies for high-risk situations. Human analysts then make the final decisions to ensure oversight while letting AI handle repetitive or low-risk tasks.
Full autonomy will extend this further, allowing AI to dynamically create and execute playbooks, make verdicts on suspicious activity, and remediate threats independently. Humans will remain in the loop to guide improvements and help the system adapt to emerging threats.
The agentic future
The rise of the autonomous SOC will not be without disruption as entry-level roles may diminish, dependency on technology will increase, and costs will need to be managed strategically. However, with a phased, carefully managed approach, organisations can harness AI while mitigating risk.
While agentic AI is still in its infancy, organisations need to be cautious, verifying outcomes and prioritising use cases that deliver clear benefits. For many, partnering with MSSPs may be the most practical way to adopt this technology safely and cost-effectively to deliver on the promise of a transformative SOC. By embracing AI in stages, SOC teams can remain agile and resilient, combining speed, precision, and scalability to keep businesses secure