Agentic security operations with Claude Code change SOC execution

At a glance

What this is: LimaCharlie demonstrates agentic security operations with Claude Code handling live investigation work inside a SOC workflow, while human approval still gates higher-impact actions.

Why it matters: For IAM, PAM, and NHI practitioners, the key issue is that agentic SOC tooling depends on tightly governed permissions, traceability, and approval boundaries, not just model quality.

Context

Agentic security operations extend AI from recommendation into execution, which changes the control problem from output quality to action governance. In this model, the agent is not just generating analysis, it is querying live telemetry, invoking tools, and preparing operational steps inside the security stack.

That shift matters wherever AI can act through existing permissions, because the risk is no longer limited to bad advice. When an AI system can operate across investigation tools, authorization boundaries, logging, and escalation paths, security teams need a clear view of who or what can act, under which conditions, and with what oversight.

The article’s starting position is increasingly typical of modern SecOps pressure: analysts are overloaded, and organisations want AI to accelerate investigation without surrendering control.

Key questions

Q: What breaks when an AI agent can investigate but not be governed like an operator?

A: The failure mode is uncontrolled delegation. If an AI can query production telemetry, call tools, and prepare response steps without being treated as a governed operator, the organisation loses clarity on who authorised which action. The fix is not to block AI entirely, but to assign it scoped permissions, explicit owners, and approved boundaries like any other privileged non-human identity.

Q: Why do agentic SOC tools need human approval for containment actions?

A: Because containment changes the environment, not just the analysis. An AI can be useful at gathering evidence and proposing next steps, but isolation, blocking, or suppression can interrupt business services if the picture is incomplete. Human approval preserves speed in investigation while preventing the agent from making irreversible operational decisions on partial evidence.

Q: What are the signs that AI-assisted investigations are too loosely controlled?

A: Look for missing tool-call logs, unclear permission ownership, one-size-fits-all access for read and write actions, or agents that can move from detection review into containment without an approval step. Those are signs that the workflow has collapsed into convenience-driven delegation rather than controlled execution.

Q: How should security teams govern AI-enabled workflows that can act on their own?

A: Treat them as identity-governed execution paths, not just software features. Assign a named owner, define least-privilege access, log every tool call, and require revocation paths for credentials and tokens. If the workflow can touch production systems or sensitive data, its permissions must be reviewed with the same discipline used for privileged machine identities.

Technical breakdown

How agentic SecOps uses the security stack as its execution layer

Agentic SecOps differs from a chatbot because the AI is connected to operational tooling rather than only producing text. In this setup, Claude Code can query detections, inspect processes, pull network telemetry, and assemble an investigation path through the platform’s API layer. The important architectural point is that the model is acting through existing security controls, not around them. That means the platform design, not the model prompt alone, determines what can be seen, executed, and logged. The security challenge shifts to execution governance: what actions the AI may initiate, what it may only recommend, and how every step is recorded for later review.

Practical implication: govern AI through the same control plane that governs analysts, not through an unmonitored side channel.

Why auditability becomes a control requirement for AI-driven investigations

Auditability is not a reporting extra in agentic SecOps. It is the mechanism that lets defenders distinguish between useful automation and unreviewable action. If the AI runs queries, enumerates processes, and drafts response steps, the organisation needs a complete record of what it asked, what it received, what tools it called, and what it attempted next. That log trail supports oversight, post-incident review, and incident reconstruction. Without it, AI-assisted investigation becomes a blind delegation problem. The core design principle is simple: if the system cannot prove its own reasoning path, the team cannot safely rely on it in an operational environment.

Practical implication: require immutable logs for AI tool use, not just final outputs.

Why human approval still matters for containment actions

The article draws a clear line between investigation and impact. Claude Code could inspect, correlate, and prepare isolation steps, but the higher-impact action still required human approval. That separation is important because containment changes the environment, not just the analyst’s understanding of it. In security operations, the risk of mistaken isolation is real, especially when an AI is operating on incomplete telemetry or a partial incident picture. The strongest pattern is therefore supervised execution: let the agent gather evidence and prepare options, but keep disruptive actions behind an explicit approval gate. That preserves speed without handing the system autonomous authority over the environment.

Practical implication: separate evidence collection from containment authority in every agentic workflow.

Threat narrative

Attacker objective: The objective in the named scenario was Cobalt Strike beaconing for covert command-and-control and continued access inside compromised Windows systems.

1. Entry in the demonstrated scenario began with suspicious RunDLL32 activity that the AI triaged as worthy of investigation across two Windows systems.
2. Credential or process abuse was then inferred through repeated beacon-like connections, process inspection, and memory hunting for Cobalt Strike indicators.
3. Impact was the identification of two confirmed beacons with ready isolation steps, showing how quickly the agent could move from telemetry to containment preparation.

Breaches seen in the wild

• Anthropic GTG-1002 AI espionage campaign: A state-sponsored group ran Claude Code agents to attack about 30 organisations, harvesting and reusing credentials at machine speed.
• Sentry MCP Agentjacking 2026: Researchers showed a fake Sentry error, posted with a public DSN, could make AI coding agents run attacker code with developers' credentials.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic SecOps is becoming an execution-governance problem, not a model-selection problem. Once an AI can query telemetry, enumerate processes, and prepare response actions, the decisive question is who can authorise each class of action. That moves the control boundary from prompt quality to operational authority, which is why identity and privilege governance now sit at the centre of AI-assisted SOC design. Practitioners should treat the agent as a privileged operator with a constrained task scope.

Transparent AI action trails are now part of security architecture. Logging the final answer is not enough when the AI can call tools and traverse investigation workflows. Security teams need evidence of each action, each query, and each escalation step so that reviews, audits, and incident reconstruction remain possible. The named concept here is investigation provenance: the ability to reconstruct not just what the agent concluded, but how it moved through the environment. Practitioners should require that provenance before allowing production use.

Human approval remains the correct control for environment-changing actions. The article’s strongest governance signal is the separation between safe investigation and disruptive containment. That pattern avoids the false choice between fully manual operations and unchecked autonomy. For identity and access teams, the lesson is that policy must distinguish read-only investigative authority from privileged response authority. Practitioners should map those tiers explicitly, because the same agent may be safe for analysis and unsafe for isolation.

Agentic SOC adoption will widen the gap between governed and ad hoc operations. Teams that archive successful workflows, constrain tool use, and reuse validated investigation paths will compound operational learning faster than teams treating AI as an interactive assistant. That is not just efficiency. It is governance maturity, because the organisation is codifying how machine operators should behave under supervision. Practitioners should use this moment to formalise agent operating boundaries before scale makes them harder to enforce.

This pattern intersects directly with non-human identity governance. The agent is acting through credentials, permissions, and tool access that must be owned, scoped, and revocable like any other NHI. If an AI can query across production telemetry, its identity lifecycle and approval boundaries matter as much as any service account’s. Practitioners should fold agent permissions into NHI and PAM reviews rather than leaving them in an AI pilot lane.

From our research library:

• Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
• 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Investigation provenance is the control gap agentic SOC teams will need to close first. If an AI can query detections, inspect processes, and prepare response steps, the programme needs a full record of action lineage, not just a final summary. That pushes SOC governance closer to NHI and PAM discipline, because the agent is now acting as a constrained operator rather than a passive assistant.

The longer-term signal is that SecOps automation is moving from workflow assistance to governed execution. Teams that separate read-only investigation from response authority will be able to adopt agentic tooling faster and with less operational risk than teams treating all AI actions as equivalent.

For practitioners

• Define separate read and write boundaries for agentic SOC workflows Allow AI systems to query detections, inspect telemetry, and draft response steps, but require explicit approval for containment, suppression, or production changes.
• Log every AI tool invocation and decision path Capture prompts, queries, returned evidence, tool calls, and approved actions so the full investigation chain can be reconstructed during review or incident response.
• Inventory agent identities as governed non-human identities Treat each AI operator, CLI integration, or automated investigation workflow as a named identity with scoped permissions, owners, and revocation paths.
• Archive validated investigation playbooks for reuse Store successful investigative sequences, detection logic, and analyst refinements so future runs inherit proven logic instead of starting from scratch.

Key takeaways

• Agentic SecOps changes the control problem by letting AI execute investigation steps inside the stack, which makes permission scope and auditability central.
• The live Cobalt Strike example shows that AI can already connect telemetry, process inspection, and network analysis into a coherent investigation flow.
• Human approval remains the essential limiter for containment actions, because read access and operational authority are not the same thing.

Key terms

• Agentic SecOps: A security operations model in which AI systems can coordinate tasks and take bounded actions across alert handling, investigation, and response. The critical question is whether those actions are governed, explainable, and reversible enough to fit enterprise control requirements.
• Investigation Provenance: Investigation provenance is the record of what evidence was gathered, what context was used, and how a conclusion was reached. In MDR and SOC operations, it is the difference between a claim about an incident and a case that can be reviewed, challenged, and governed.
• Human Approval Gate: A human approval gate is a control point where a person must confirm an action before it proceeds. For AI agents, it is the clearest boundary between assistance and execution, especially when the action can move money, expose data, or trigger irreversible change.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, and secrets management. It helps practitioners align emerging AI operators with the same lifecycle discipline used for privileged identities.