Agentic SecOps is changing SOC automation, but governance lags

At a glance

What this is: Torq argues that agentic SecOps shifts SOC automation from deterministic workflows to adaptive AI agents that can triage, communicate, and act across tools.

Why it matters: This matters because SOC automation now depends on governing agent identity, access scope, and escalation boundaries, which directly intersects with IAM and NHI control design.

Context

Agentic SecOps is security operations where AI agents do more than execute scripted steps. They can reason over alerts, gather context from connected tools, communicate with users, and decide what happens next. That creates a governance problem that classic SOAR workflows never had to solve: who or what the agent is, what it can touch, and when human review is required.

For IAM and NHI programmes, this is the important bridge. A security agent that can call APIs, query identity systems, and close cases is operating as a non-human identity with privileged access to operational tools. The article’s core issue is not whether automation is useful, but whether control models can keep pace with agentic decision-making. That challenge is typical of emerging AI operations work, not an edge case.

Key questions

Q: What happens when SOC automation is deployed without clear boundaries?

A: The automation can create new over-privileged access paths, unclear accountability, and noisy responses that analysts do not trust. In a SOC, an unbounded agent can become another unmanaged identity, which is exactly the kind of operational risk automation was meant to reduce.

Q: Why do AI SOC agents need stricter authorisation than traditional SOAR workflows?

A: Traditional SOAR follows prebuilt rules, so the main risk is a bad playbook. AI SOC agents choose actions dynamically, which means they can combine tool access, context, and reasoning in ways the original workflow designer did not explicitly anticipate. That makes authorisation the control point, not just orchestration.

Q: How do you know when agentic SecOps has become too autonomous for current controls?

A: The warning sign is when the agent can independently gather evidence, communicate with users, make a disposition, and close or escalate a case without a separate approval checkpoint. At that point, governance has not kept pace with operational autonomy, and the organisation should tighten task scope and review thresholds.

Q: Should security teams compare agentic SecOps with traditional SOAR or treat them as separate control models?

A: They should treat them as different control models. SOAR is deterministic automation governed mainly by workflow design, while agentic SecOps introduces runtime reasoning, tool selection, and adaptive decision-making that must be governed through identity, authorisation, and accountability controls.

Technical breakdown

How agentic SecOps differs from static SOAR workflows

Traditional SOAR executes predefined playbooks. Agentic SecOps adds a reasoning layer that chooses actions based on context, prior results, and current tool outputs. In practice, that means the workflow is no longer a fixed sequence of steps but an iterative loop in which the agent can gather more evidence, adjust the path, and continue until the task is resolved. This is powerful because it reduces brittle automation, but it also moves control from workflow design into runtime governance. The real architectural change is that decisions become partially dynamic, so the security boundary must follow the agent, not just the playbook.

Practical implication: Treat agent runtime governance as a control plane problem, not only an automation engineering problem.

Why agent identity and tool access become the control point

The article shows agents interacting with identity systems, messaging platforms, EDR, and ticketing tools. That makes the agent an active actor in the environment, not a passive script. Once an agent can retrieve data, validate employee responses, and create or close cases, it needs an identity, scoped authorisation, and auditability comparable to other privileged non-human identities. The challenge is that a reasoning agent may make several tool calls inside one task, so traditional approval gates built for human workflows can become too slow or too coarse. Governance has to define who the agent can be, what it can access, and which actions require human escalation.

Practical implication: Model AI agents as governed non-human identities with explicit entitlements, logging, and escalation thresholds.

What transparent execution logs do and do not solve

Torq emphasises full audit trails, reasoning traces, and recorded tool calls. That is necessary, but not sufficient. Logging proves what the agent did after the fact; it does not by itself constrain overreach, tool misuse, or incorrect confidence during execution. For SOC automation, the harder question is whether the agent was authorised to take each step before it happened and whether the action was proportionate to the signal quality. Auditability supports review and compliance, but it cannot substitute for least-privilege design, action boundaries, and lifecycle controls on agent credentials.

Practical implication: Use logs for accountability, but pair them with pre-execution policy and scoped authorisation for every agent action.

Threat narrative

Attacker objective: The relevant security objective is not a named external attack, but preventing an AI agent from gaining enough operational trust to make unauthorised or unsafe SOC decisions.

1. Entry occurs when an AI SOC agent is granted access to multiple operational tools, identity systems, and messaging channels so it can investigate alerts.
2. Escalation happens when the agent can chain reasoning across those tools and make successive decisions without a human approving each step.
3. Impact is the possibility of overreach, incorrect closure, or misuse of operational access when agent scope and decision boundaries are too broad.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic SecOps is now an identity governance problem, not only an automation problem. The article makes clear that the agent is no longer a scripting convenience but an operational actor with access to data, messaging, and case management systems. Once that happens, IAM and NHI controls become part of SOC architecture, not an adjacent concern. Practitioners should treat agent identity, entitlement scope, and audit boundaries as first-class design requirements.

Security teams should expect the control point to move from workflow logic to authorisation logic. Static playbooks fail because they assume the workflow itself is the primary control. In agentic SecOps, the dangerous moment is not the sequence of steps, but the agent’s freedom to choose them. That makes bounded authorisation and task-scoped tool use more important than simply making the workflow smarter.

Decisioning drift is the governance risk that will catch many SOCs out. A system that starts by enriching alerts can quickly progress to communicating with users, ticketing, and closing cases automatically. That progression is useful, but it normalises machine-led operational judgement before policy catches up. The discipline should be to define where human accountability ends and agent autonomy begins, then enforce that line technically.

Audit trails are necessary evidence, not a substitute for control. Recording reasoning and tool calls improves accountability, but post-hoc visibility does not prevent over-permissioning or unsafe action selection. The more an agent can do, the more the organisation must govern its identity lifecycle, access boundaries, and escalation conditions. Practitioners should use transparency to support review, but not to justify weak upfront controls.

From our research library:

• Gartner predicts that by the end of 2026, 40% of enterprise apps will feature task-specific AI agents.
• Read next: Agentic AI Identity Guide

What this signals

Agentic SecOps extends the NHI problem into the SOC itself. Once an AI agent can query identity systems, message employees, and create or close cases, it is behaving like a governed non-human identity. That means the reader’s programme needs to think beyond secrets and toward lifecycle control, task-scoped privilege, and revocation when a workflow or model changes.

Decisioning authority will become the next boundary to formalise. The immediate challenge is not whether an agent can enrich alerts, but whether it should be allowed to make a final operational disposition. Teams should map where enrichment ends, where recommendation begins, and where only a human can authorise action.

The adoption curve is likely to outpace control maturity. Gartner predicts that by the end of 2026, 40% of enterprise apps will feature task-specific AI agents, according to the Agentic AI Identity Guide. SOC teams should assume agentic workflows will spread into adjacent tools faster than governance processes adapt.

For practitioners

• Define agent identity before deployment Assign every SOC agent a distinct identity, scoped entitlements, and an owner for lifecycle management, just as you would for any privileged non-human identity.
• Constrain tool use by task and risk level Limit which APIs, case systems, and messaging channels each agent can reach, and separate enrichment, communication, and closure permissions.
• Require human approval for closure thresholds Set explicit escalation criteria for decisions that affect containment, case closure, or user action, so an agent cannot silently finalise higher-impact outcomes.
• Log every tool call and decision boundary Capture reasoning, tool selection, input context, and final action in a reviewable audit trail, then test whether those logs are sufficient for governance review.

Key takeaways

• Agentic SOC automation changes the control problem from workflow execution to runtime authorisation and governance.
• When AI agents can talk to users, query identity systems, and close cases, they function as privileged non-human identities that need lifecycle controls.
• Audit trails improve accountability, but they do not replace scoped access, escalation thresholds, or human approval for higher-impact actions.

Key terms

• Agentic SecOps: A security operations model in which AI systems can coordinate tasks and take bounded actions across alert handling, investigation, and response. The critical question is whether those actions are governed, explainable, and reversible enough to fit enterprise control requirements.
• Decisioning Drift: Decisioning drift is the gradual expansion of machine-led judgement from simple enrichment into higher-impact operational decisions such as ticket closure or incident disposition. It matters because control maturity often lags behind capability, leaving organisations with more autonomy than policy can safely support.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Tool Scope: The specific set of actions or resources a tool-enabled identity is allowed to use. For MCP, scope is the practical boundary that keeps a model-connected server from turning into broad system access. Weak scope design creates unnecessary blast radius and complicates later revocation.

Deepen your knowledge

The NHI Foundation Level course covers NHI governance, agentic AI identity, machine identity security, and secrets management in a practitioner-focused format. It is designed for teams that need to govern emerging AI operations alongside established identity controls.