Topic starter
06/09/2026 3:44 pm
TL;DR: SOCs cannot close the machine-speed gap by simply deploying more AI agents, because the real constraint is coordination, cost, and control rather than raw capability, according to Crogl. The practical shift is toward dynamic intelligence allocation, where deterministic automation handles known patterns and agents are reserved for ambiguous investigations.
Editorial analysis by NHI Mgmt Group, based on content published by Crogl: “AI Agents Are Not Enough”.
Key questions
Q: How should security teams decide where to use AI first in the SOC?
A: Start with the layer that has the clearest operational pain and the cleanest success metric.
Q: Why do traditional SOAR playbooks fail when attacks do not match predefined scenarios?
A: Traditional SOAR playbooks fail because they depend on fixed triggers, conditions, and actions.
Q: What happens when AI agents are used for every SOC task?
A: The SOC swaps a human bottleneck for a cost and control bottleneck.
Practitioner guidance
- Define an intelligence allocation policy Classify SOC work into deterministic, assisted, and agentic tiers so the response path matches uncertainty rather than defaulting to one tool model.
- Scope agent authority explicitly Assign each SOC agent a narrow runtime identity, bounded tool access, and clear escalation rules before it is allowed to investigate or respond.
- Codify agent findings into repeatable automation Use agent-led investigations to identify patterns that can be converted into stable detection rules, enrichment steps, or SOAR playbooks.
Bottom line: SOCs do not fail only because they are under-automated. They fail when the control model does not match the speed and variability of the attack.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/09/2026 3:45 pm
Orchestration, not agent count, is the real SOC scaling problem: the article correctly frames AI agents as a governance challenge rather than a feature race. Once agent use expands, the bottleneck becomes control of action, cost, and escalation, not raw task execution. Security leaders should treat this as a control-plane design issue, not a point solution decision.
A few things that frame the scale:
- 62% of organisations are at least experimenting with AI agents, but only 23% have scaled one into a single business function, according to McKinsey's 2025 State of AI survey.
A question worth separating out:
Q: How should teams govern AI SRE agents that investigate incidents?
A: Start by separating investigative access from remediation authority. AI SRE agents should be able to collect evidence, correlate signals, and draft recommendations without being able to change production systems. Human approval should remain mandatory for any action that modifies state, and every proposed fix should be traceable to specific evidence.
👉 Read our full editorial: AI agents in the SOC need orchestration, not just more automation