TL;DR: Agentic AI can reduce SOC triage bottlenecks by querying Wazuh telemetry, correlating alerts, and assembling investigations from indexed events, according to Wazuh. The governance question is not whether agents can help, but whether their access, traceability, and human oversight are constrained tightly enough for security operations.
At a glance
What this is: Wazuh describes a proof of concept where agentic AI queries Wazuh telemetry and correlates alerts to speed SOC threat hunting, while keeping access narrowly scoped.
Why it matters: This matters because once AI agents can inspect security data and drive investigations, IAM and SOC teams must treat them as governed identities with least privilege, auditability, and constrained tool use.
Context
Security operations teams often hit a correlation bottleneck because manual triage depends on analysts stitching together processes, network activity, file changes, and alert context across multiple logs. Agentic AI changes the workflow by letting a system plan, query tools, and assemble investigation steps, but that only helps if the agent’s access is tightly bounded and the outputs remain traceable to source telemetry. This is an identity and governance problem as much as an automation problem.
The article frames a common SOC tension: faster investigations require broader machine access, yet broader access increases the blast radius if the agent is misused, misconfigured, or overtrusted. That makes AI agent identity, service-account scope, and evidence provenance central design choices. The PoC approach is typical of early-stage deployments, but the governance model is already the deciding factor for whether such systems remain defensible in production.
Key questions
Q: What breaks when AI agents are used for SOC investigation without scoped tool access?
A: The investigation boundary breaks first. An agent that can search broadly, enumerate datasets, and iterate without tight permissions may produce plausible answers while drifting outside the intended case. The result is weak traceability, wider blast radius, and a higher chance that analysts cannot reconstruct how the conclusion was reached.
A: Because correlation is not the same as authority. An agent can assemble evidence, but it cannot be assumed to judge business impact, containment trade-offs, or exception handling correctly in every case. Human oversight keeps the final decision anchored to accountability, especially where response actions affect production systems.
Q: How can analysts tell whether AI-driven SOC automation is actually working?
A: Look beyond alert volume and measure whether the platform produces accurate incidents, preserves tenant context, and shortens time to closure without creating rework. If analysts still need to reconstruct the story manually, the automation is reducing noise but not truly improving operational control.
Q: What is the difference between agentic AI and a traditional LLM workflow in threat hunting?
A: A traditional LLM workflow waits for a prompt at each step, while agentic AI can plan and execute multiple actions toward a goal using tools and memory. That makes it more capable for investigation, but also much more dependent on access control, auditability, and role separation.
Technical breakdown
How agentic AI turns telemetry into multi-step investigations
Agentic AI is not just a chat interface over logs. It combines planning, memory, tool calling, and execution so it can query APIs, retrieve historical events, and chain those results into a sequence of investigative actions. In this workflow, the model can decide when it needs more context, call the Wazuh server API, search the alert index, and refine its next step without a fresh prompt for each action. That makes it operationally useful for threat hunting, but also means the agent is effectively a software identity acting across multiple systems.
Practical implication: treat the agent as a governed runtime identity, not an analyst convenience layer.
Why least privilege is the core control for AI agents in SOC tooling
The article’s access design is the right unit of analysis. The agent only needs read-only access to specific telemetry such as agent metadata, file integrity monitoring data, system inventory, and the alerts index. That maps to a classic privilege boundary: the agent should not inherit the analyst’s full operational access just because it can help with investigations. In identity terms, the control question is whether the agent’s service account and indexer credentials are limited to the exact data sets and actions required for the task.
Practical implication: define per-tool, per-dataset access for every agent workflow before exposing live SOC data.
Traceability and on-premises execution reduce, but do not remove, governance risk
Local model hosting and API-bound evidence retrieval improve confidentiality because telemetry stays on premises and outputs are tied back to recorded events. But those design choices do not solve overprivilege, weak account separation, or unclear human approval boundaries. A model that can search logs, correlate alerts, and produce an investigation summary still needs strong provenance, logging, and review controls. Without that, organisations risk replacing manual triage bottlenecks with opaque machine-led decision paths.
Practical implication: require audit trails for every query, tool call, and output that the agent generates.
NHI Mgmt Group analysis
Agentic AI in SOC operations creates a new identity class, not just a new interface. Once a system can plan, query, and execute against security telemetry, it behaves like a governed machine actor with its own privileges and audit requirements. That is why the relevant control question is not whether the agent can summarise alerts, but whether its access lifecycle is explicit, bounded, and reviewable. Practitioners should model the agent as an identity-bearing workload, not as a UI feature.
Tightly scoped access is the decisive control when agents can reach investigative data. The article’s read-only policy design is a useful reminder that SOC automation should not inherit broad analyst permissions by default. If an agent can query historical alerts, inventory data, and file integrity telemetry, then the smallest possible permission set becomes the line between assistance and overreach. Practitioners should separate investigation capability from operational authority.
Agent provenance matters because correlation quality depends on source fidelity. Wazuh’s emphasis on derivation from API-retrieved telemetry points to a broader governance requirement: machine-generated summaries must remain explainable back to evidence, not just plausible. That matters for incident response, compliance review, and after-action analysis. Practitioners should insist on traceable evidence chains for every agent-assisted finding.
Agentic AI security depends on the same discipline that governs other non-human identities. The hard problem is not whether the model can reason, but whether the surrounding identity model prevents privilege creep, uncontrolled delegation, and ambiguous ownership. This is where NHI governance intersects directly with SOC automation, because every agent workflow needs a clear owner, a scoped role, and a revocation path. Practitioners should govern agents like high-value service identities.
Scoped automation will outlast generic SOC copilots because it fits existing control expectations. Broad, open-ended agent behaviour is difficult to reconcile with enterprise auditability, but task-scoped investigation workflows can be aligned to security operations controls more cleanly. That means the market is moving toward constrained agent roles, not free-roaming autonomous analysts. Practitioners should expect tooling decisions to pivot on how well agent access can be bounded and evidenced.
From our research library:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- Read next: Agentic AI Identity Guide
What this signals
Agentic AI threat hunting will only scale if identity controls move closer to issuance time. The practical boundary is no longer just who can see the data, but what each agent can do with it in each workflow. That pushes SOC and IAM teams toward task-scoped service accounts, strict evidence logging, and revocation patterns that assume machine actors behave like privileged identities rather than passive tools.
Static credentials are still the weak point in many AI deployments, and SOC automation does not change that. 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey. For readers, the lesson is that agent access governance and secret hygiene need to be designed together, not sequenced as separate programmes.
For practitioners
- Define agent-specific service accounts Create a dedicated identity for each AI investigation workflow, with no reuse of human analyst credentials and no shared access across unrelated tasks.
- Scope data access to read-only investigation sets Grant the agent only the telemetry it needs, such as alert indices, agent metadata, and file integrity data, and block any write or administrative privileges.
- Log every tool call and query Record each API request, index search, and model output so investigations can be reconstructed from source telemetry during review or incident analysis.
- Separate investigation authority from response authority Keep the agent focused on triage and correlation while requiring human approval for containment, remediation, and policy changes.
- Validate local model and API boundaries before production use Test the full workflow in a controlled environment to confirm the agent cannot exceed the Wazuh server and indexer permissions assigned to it.
Key takeaways
- Agentic AI can accelerate SOC threat hunting, but it also introduces a governed machine actor that needs explicit access boundaries.
- The article’s strongest operational signal is the need for read-only, task-scoped access to telemetry and alert indexes.
- Audit trails, human approval, and identity separation are the controls that keep AI-assisted investigations defensible.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The article centers on a separately authenticated AI agent that must be safely constrained. |
| NHI-05 — Overprivileged NHI | The core governance issue is preventing the agent from inheriting broad SOC permissions. | |
| NHI-10 — Human Use of NHI | The workflow shows a human using a machine identity to perform security analysis. | |
| Recommendation — Use NHI-04 to validate that each agent workflow authenticates through its own scoped identity. Apply NHI-05 to keep agent permissions limited to the specific telemetry it must access. Restrict human-driven agent workflows so operators cannot repurpose NHI credentials beyond approved tasks. | ||
| MITRE ATT&CK | TA0006; TA0007 — Credential Access; Discovery | The workflow relies on retrieving telemetry and can expose how an attacker would hunt for useful data. |
| Recommendation — Map agent-accessible telemetry to TA0006 and TA0007 to understand what adversaries could discover. | ||
| NIST SP 800-53 Rev 5 | IA-9 — Identification and Authentication (Service and Organization Users) | The agent and indexer accounts are service identities that need managed authentication. |
| Recommendation — Apply IA-9 to authenticate each service or workload identity used by the agent. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about whether the agent's entitlements are narrowly bounded. |
| Recommendation — Use PR.AA-05 to constrain the agent to the minimum permissions needed for investigation. | ||
Key terms
- Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
- Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
- Least Privilege: A security principle requiring that every identity, human or non-human, is granted only the minimum permissions necessary to perform its function. Least privilege is the single most effective control for reducing NHI blast radius.
- Security Telemetry: The logs, events, and configuration data that let defenders understand and prove what happened in a system. For SaaS governance, telemetry is what turns an application from a black box into something the security team can review, alert on, and investigate.
Deepen your knowledge
The NHI Foundation Level course covers NHI governance, agentic AI identity, and machine identity security through the industry's only accredited NHI security programme. It is designed for practitioners who need to govern AI-driven access as part of a broader identity programme.
Published by the NHIMG editorial team on August 18, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org