AI agents in the SOC need orchestration, not just more automation

At a glance

What this is: This blog argues that AI agents in SOC operations are useful, but only when they are governed as part of a larger system that allocates work between automation and reasoning.

Why it matters: For security teams, the issue is not whether agents can help, but whether they can be controlled, costed, and integrated without creating a new operational bottleneck.

👉 Read Crogl's analysis of why AI agents alone do not solve SOC scaling

Context

Security operations have been built around human-paced workflows, but attackers now move at machine speed and mutate tactics faster than traditional triage loops can adapt. In AI-driven environments, the core governance problem is not adding more tooling, but deciding which problems should be handled by deterministic automation and which require agentic reasoning. Where AI agents interact with tools, data, and response actions, their identity and authority boundaries become part of the control problem, not a separate concern.

The article's central point is that SOC modernisation fails when teams treat every security task as if it belongs in one operating model. For identity and security practitioners, that means the governance question extends from detection quality into privilege, delegation, and orchestration. The same tension appears in NHI and agentic AI programmes: unmanaged autonomy creates cost and control risk even when the underlying capability is strong.

Key questions

Q: How should security teams decide where to use AI first in the SOC?

A: Start with the layer that has the clearest operational pain and the cleanest success metric. Detection, triage, and response solve different problems, so the best first use case is usually the one where AI can reduce noise, improve analyst throughput, or speed containment without introducing opaque decision-making.

Q: Why do API-connected AI agents create new governance risks in SecOps?

A: Because the agent can move from analysis to action across multiple systems in one chain. When it can fetch data, generate artefacts, and execute writes, the organisation is no longer governing a recommendation engine. It is governing delegated operational authority, which requires access control, logging, and policy enforcement.

Q: What signals show that AI SOC automation is failing?

A: Common warning signs include inconsistent case notes, unexplained escalations, duplicated investigations, and automation outputs that analysts must repeatedly correct. Those symptoms usually mean the underlying workflow is unclear or the tooling lacks enough identity and event context. If the process is fragile, AI will expose that fragility faster rather than hide it.

Q: How can organisations make AI agents useful without overspending?

A: Limit agents to cases where reasoning changes the outcome, then codify the discoveries back into rules and workflows. This reduces repeated compute spend on problems that no longer need an agent. The operating model should aim to shrink agent use over time for known patterns while reserving it for genuinely uncertain cases.

Technical breakdown

Why deterministic SOC automation breaks under novel attacks

Deterministic automation, such as fixed playbooks, works when the environment is predictable and the decision tree is known in advance. The problem is that AI-assisted attackers can vary reconnaissance, payloads, and sequencing faster than rule-based workflows can be updated. Once a workflow meets an unexpected branch, human analysts re-enter the loop and response latency rises sharply. This is not an automation failure in principle, but a control-design failure where the system assumes the attack path is stable.

Practical implication: separate repeatable detections from novel-case investigation paths instead of forcing one workflow to handle both.

What dynamic intelligence allocation means for SOC architecture

Dynamic intelligence allocation means using the least expensive and most reliable control that can still solve the problem. Known events should stay in deterministic pipelines, while ambiguous or first-seen activity should be escalated to agentic reasoning. This approach treats AI agents as a scarce decision resource, not a default replacement for every workflow. In practice, it requires a meta-layer that decides routing, cost thresholds, and confidence boundaries.

Practical implication: build routing logic that chooses between automation and agents based on uncertainty, not convenience.

How agent identity changes the governance model

When AI agents can access tools, data, and response mechanisms, they operate as non-human identities with runtime authority. That means access scope, delegation boundaries, and revocation become governance controls, not implementation details. The risk is not only what an agent knows, but what it is authorised to do at the moment it acts. This is especially important where agents chain actions across systems, because control failure can occur before a human ever reviews the output.

Practical implication: treat agent authority like NHI governance and define explicit scope, logging, and revocation conditions before deployment.

Threat narrative

Attacker objective: The objective is to outpace detection and response long enough to complete intrusion, persistence, or exfiltration before the SOC can adapt.

1. Entry occurs when AI-enabled attackers exploit the faster generation and mutation of offensive activity to bypass human-paced SOC workflows.
2. Escalation happens when deterministic playbooks fail on novel branches, forcing analysts into manual triage and slowing containment.
3. Impact is delayed detection and response, with the defender losing time, coverage, and control to machine-speed operations.

NHI Mgmt Group analysis

AI SOC operations are becoming an intelligence-allocation problem, not just an automation problem. The article is right to reject the idea that more agents automatically create better security. The real design challenge is deciding which workloads require deterministic control and which require reasoning under uncertainty. That aligns with broader automation governance principles in NIST-CSF and NIST-800-53, where control selection has to match operational risk. Practitioners should stop asking how many agents they can add and start asking where intelligence actually belongs.

AI agents in SOC workflows must be governed as non-human identities, not treated as interchangeable software features. Once an agent can choose actions, access tools, and influence response timing, it becomes part of the identity and privilege model. That creates a direct bridge to NHI governance, because authority boundaries matter as much as model quality. In practice, the governance question is who can delegate what, for how long, and with what revocation path. Practitioners should map agent authority into identity controls before operationalising it.

Dynamic orchestration will become the differentiator between tool sprawl and operational resilience. The article points toward a future where the winning SOC is not the one with the most agents, but the one that can continuously rebalance automation, reasoning, and cost. That is a control maturity issue, not a feature race. Frameworks such as NIST-CSF and MITRE-ATT&CK help teams structure the detection side, but the orchestration layer still needs explicit governance. Practitioners should measure whether their SOC can shift work at runtime without losing assurance.

AI governance debt is emerging in SOCs that adopt agents before defining operating boundaries. If teams deploy reasoning systems without policy for scope, confidence thresholds, and escalation, they accumulate hidden risk that becomes expensive to unwind. This is a familiar pattern in identity programmes too: capability arrives first, governance trails behind, and the exception layer expands. The right response is to define when the agent acts, when the automation absorbs, and when a human must own the decision. Practitioners should treat ungoverned agent deployment as deferred risk.

The future SOC will reward systems that codify discoveries back into controls. The most useful insight in the article is the feedback loop between agentic investigation and deterministic automation. That loop turns first-seen activity into repeatable policy, which is exactly how mature security programmes reduce uncertainty over time. It also mirrors the lifecycle logic used in identity governance, where what is learned during investigation should harden into repeatable access and response control. Practitioners should build feedback from investigations into policy, not leave it in tickets.

What this signals

AI SOC orchestration will become a governance discipline before it becomes a platform category. Teams that cannot explain when an agent should act, when automation should absorb, and when a human must own the decision will accumulate operational debt quickly. The practical next step is to formalise routing policy and validate it against control objectives in NIST AI Risk Management Framework language, especially around manage and govern functions.

Agent identity is now part of SOC resilience planning. Once agents can touch tools and response systems, their delegated authority becomes a control surface that must be inventoried and reviewed. That means security programmes should align agent governance with NHI controls, and use resources such as Ultimate Guide to NHIs , Why NHI Security Matters Now to frame ownership, lifecycle, and revocation expectations.

The organisations that win here will not be the ones that deploy the most agents. They will be the ones that can turn investigation outcomes into durable control improvements without inflating cost or uncertainty. That makes feedback loops between detection, policy, and orchestration the real operating advantage.

For practitioners

• Define the intelligence-routing model Classify SOC use cases into low-uncertainty and high-uncertainty paths so deterministic automation handles repeatable events and agents handle novel investigations. Document the routing criteria, confidence thresholds, and handoff rules in the operating model.
• Treat agent authority as NHI governance Assign explicit scope, logging, and revocation conditions to every AI agent that can access tools or data. Link each agent to named owners and review the delegated permissions as you would for other non-human identities.
• Build a codification loop from investigations Require every agent-led investigation to produce a reusable control outcome, such as a rule, playbook update, or detection pattern. Use those outputs to shrink the volume of cases that still require reasoning.
• Measure cost per decision path Track the compute, analyst time, and escalation rate for automated versus agent-led workflows. If agent usage rises without a corresponding reduction in uncertainty or response time, the orchestration model is not working.

Key takeaways

• The article's core warning is that adding more AI agents does not fix SOC complexity if coordination, cost, and control remain undefined.
• Machine-speed attackers expose the weakness of deterministic workflows, which break when the threat path diverges from the known playbook.
• The durable response is a governed orchestration model that treats agents as non-human identities and converts investigations into repeatable controls.

Key terms

• Dynamic Intelligence Allocation: A control model that routes security work to the cheapest reliable mechanism that can still solve the problem. Low-uncertainty tasks stay in deterministic automation, while ambiguous cases escalate to reasoning systems or humans. The objective is to preserve speed without turning every decision into an expensive AI task.
• Agentic Orchestration Layer: The governing layer that decides when an AI agent should act, what it may access, and when another system should take over. It is the policy and routing function above the agent, not the agent itself. In mature environments, this layer defines scope, confidence thresholds, and revocation boundaries.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Governance Debt: The accumulation of unresolved identity control weaknesses created when teams prioritise speed over lifecycle design. In NHI environments, it shows up as accounts with unclear ownership, undocumented purpose, stale credentials, and no reliable retirement path, all of which make later security work harder.

What's in the full article

Crogl's full blog covers the operational detail this post intentionally leaves for the source:

• A deeper explanation of why deterministic playbooks collapse when attackers deviate from expected patterns.
• The article's own framing of how to balance human analysts, automation, and AI agents across different SOC tasks.
• Crogl's view of the meta-level system needed to allocate intelligence, control cost, and learn from investigations.
• The end-state operating model for a self-optimising SOC that improves as it encounters new threats.

👉 Crogl's full blog covers the orchestration model, cost trade-offs, and learning loop in more detail.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity control to the wider security operating model.