Notifications
Clear all
Topic starter
01/08/2026 8:59 pm
TL;DR: Agentic SOC-as-code can be deployed in Baselining, Lean, or Tiered forms, with inspectable agent logic, event-driven workflows, and published cost profiles that range from about $0.10 per false positive to $8.60 for advanced true-positive handling, according to LimaCharlie. The governance question is not whether AI can assist SecOps, but whether the identity, policy, and audit model is explicit enough to control what agentic systems do.
NHIMG editorial — based on content published by LimaCharlie: Use Agentic SOC-as-Code to Right-Size Your AI Operations
By the numbers:
- A 5,000-endpoint environment typically generates around 50 detections per day.
- For most environments where the majority of alerts are false positives, the Lean SOC can run 30–50% cheaper than Tiered overall.
Questions worth separating out
Q: How should security teams govern AI-assisted actions in the SOC?
A: Security teams should treat AI-assisted SOC actions as policy-governed machine behavior, not informal automation.
Q: Why do agentic SOC workflows create IAM and PAM concerns?
A: Because the agents can take operational actions, not just recommend them.
Q: What breaks when AI SOC logic is hidden behind a black box?
A: Teams lose the ability to explain, audit, and adjust why a decision happened.
Practitioner guidance
- Define each agent as a governed non-human identity Assign explicit permissions, allowed actions, and revocation conditions to every agent that can touch tickets, alerts, or remediation workflows.
- Start with the weakest operational environment first Use a baselining model where false positives are high and detection rules are immature, then migrate only after the ticket trail and suppression logic stabilise.
- Require inspectable decision paths before automation expands Make rule triggers, handoff logic, and agent outputs reviewable by the SOC and by IAM or PAM owners.
What's in the full article
LimaCharlie's full blog covers the operational detail this post intentionally leaves for the source:
- Prebuilt Baselining, Lean, and Tiered configurations with their deployment order and role separation.
- Per-agent pricing and workload assumptions that help teams model operating cost against alert volume.
- GitHub-hosted READMEs with architecture diagrams and installation paths for each SOC pattern.
👉 Read LimaCharlie's analysis of agentic SOC-as-code and deployment models →
Agentic SOC-as-code: what it means for SecOps teams now?
Explore further
01/08/2026 9:06 pm
Agentic SOC tooling is becoming an identity governance problem, not just a SecOps tooling problem. Once AI agents are allowed to triage, route, and remediate, they behave like non-human identities with operational authority. That means policy, privilege, and auditability matter as much as model quality. Security teams should treat each agent as a controlled actor inside the SOC, not as a feature layered onto existing workflows.
A question worth separating out:
Q: When should organisations move from baselining to a tiered agentic SOC model?
A: Move only after alert noise has dropped, false-positive rules are stable, and the ticket trail shows consistent agent behaviour. If the environment is still immature, adding specialist agents increases operational complexity without improving control. The migration point is maturity, not enthusiasm for more automation.
👉 Read our full editorial: Agentic soc-as-code changes how teams right-size AI operations
