What is an agentic SOC?
In an agentic SOC, part of the investigative work is done by AI agents: programs that receive a goal (for example, determining whether an alert is malicious), decide which queries to run, use tools such as the EDR, the SIEM, threat intelligence or the user directory, and return a conclusion with its evidence. The analyst stops gathering data and moves on to reviewing conclusions and making the decisions with impact.
The term is used for very different things, from an assistant that summarizes alerts to agents that investigate and act. Always ask exactly what the agent does and what it can do without permission.
How is it different from a SOC with SOAR?
| Aspect | SOC with SOAR | Agentic SOC |
|---|---|---|
| Logic | Deterministic playbooks: if A happens, do B. | Agents that plan the investigation based on what they find along the way. |
| Unanticipated cases | They fall outside the playbook and go to the manual queue. | The agent can investigate them, with lower confidence and more human review. |
| Maintenance | Every new case requires programming or adjusting a playbook. | You adjust instructions, available tools and limits on what the agent can do. |
| Output | Actions executed and data attached to the ticket. | A reasoned verdict with evidence and a proposed response. |
| Main risk | Rigidity. | Reasoning errors and manipulated inputs if controls are missing. |
The two approaches coexist: known, low-risk work is better served by deterministic automation, and agents add value where judgment is needed to connect the dots.
What do AI agents automate in the SOC?
The data points in that direction: according to IBM's Cost of a Data Breach Report 2026, organizations that make extensive use of AI and automation in security had an average breach cost $1.93 million lower than those that do not. These are the tasks an agent can take on:
- Triage: classifying each alert as benign, suspicious or malicious, explaining why and ruling out repetitive false positives.
- Enrichment: checking the reputation of IPs, domains and hashes, who the user is, what role the machine plays, whether there are open vulnerabilities and whether the indicator appears in threat intelligence.
- Correlation: grouping endpoint, email, identity and network alerts that belong to the same attack, so the analyst sees one incident instead of twenty separate alerts.
- Prioritization: ranking cases by real severity, combining asset criticality, the MITRE ATT&CK technique and the confidence of the verdict.
- Response proposal: suggesting specific actions (isolating a machine, revoking sessions, blocking a domain) with the reason and the expected impact.
- Documentation: writing the case summary and timeline, a task that takes up a lot of analyst time.
What role does the analyst play? (human in the loop)
Human in the loop means a person validates decisions before they take effect. In a well-designed agentic SOC, the split depends on the impact of each action:
- Reversible, low-impact actions (enriching, opening a ticket, tagging a case): automatic.
- Actions with business impact (isolating a production server, disabling an executive's account, blocking a supplier's domain): proposed by the agent and validated by an analyst.
- Ambiguous or new cases: investigated by the analyst with help from the agent.
The analyst also does what AI does not cover: talking to the affected user, understanding the business context, forming threat hunting hypotheses and correcting the agent when it gets something wrong. NIST's generative AI profile (NIST AI 600-1) identifies automation bias and over-reliance as risks of human-AI interaction: the tendency to accept the system's output without questioning it. That is why human validation only protects you if the analyst reviews the evidence before approving.
What are the risks of using third-party LLMs with SOC telemetry?
Many AI products for the SOC send alerts and logs to another company's language model. Before you accept that, think about what that telemetry contains: usernames and email addresses, internal IPs, server names, file paths, command lines that sometimes include passwords or tokens, and the content of suspicious emails.
- Sensitive data leaving your perimeter: the telemetry goes to a service you do not control. Ask where it is processed, how long it is kept and whether it is used to train models. Check with your legal counsel which obligations may apply to you.
- Prompt injection: part of what the agent analyzes is written by the attacker, such as an email subject line, a file name or a command. NIST AI 600-1 describes indirect prompt injection, in which the attacker places instructions in data the system will read. An agent without controls could end up classifying as benign exactly what the attacker asks it to.
- Plausible errors: a language model can produce conclusions that are convincing and false. In a SOC, a well-written false negative is more dangerous than an unreviewed alert.
- Dependence on the model provider: if the third party changes the model or its terms, the agent behaves differently without you deciding it.
- Limited traceability: if you cannot reconstruct what data the agent saw and why it decided something, you cannot audit or improve that decision.
What is sovereign AI in cybersecurity?
The term is used in several senses, including a country's own AI capability. Applied to a SOC, we speak of sovereign AI when the service provider controls the model, the infrastructure it runs on and the location of the data, without relying on a third-party LLM. In practice this means three things: you know in which country and on which servers your telemetry is processed, no third party outside the service receives it for inference or training, and the model's behavior does not change because of another company's decisions.
What controls should an agentic SOC have?
- Least privilege: each agent can only use the tools and actions it needs.
- A written impact threshold: which actions are automatic and which require human validation.
- Complete logging: who or what executed each action, when, on what criteria and on what data.
- Separation of data and instructions: analyzed content is never treated as a command for the agent.
- Quality review: periodic sampling of automatically closed cases to find false negatives.
- Rollback: the ability to switch off automation and return to manual operation without losing the queue.
How Ciberia applies it
Ciberia is an Agentic SOC with sovereign AI. Its agents are built on our own architecture, do not use third-party LLMs, and data is processed on servers located in Spain. They automate about 90% of triage, and every alert follows the same flow: alert, context, decision (the AI proposes and an analyst validates decisions with impact) and action (orchestrated response). Every automatic action is logged: who, when, on what criteria and on what data. With Ciberia MDR, the contractual SLA is 15 minutes from critical alert to initial containment, 24/7.
