Notifications
Clear all
Topic starter
02/08/2026 11:28 am
TL;DR: An AI SOC agent is only as effective as the live, auditable context it reasons from, according to torq, citing SANS 2025 survey data that 73% of teams name false positives as their biggest detection challenge and IBM’s 241-day average breach containment figure. The real control problem is not model quality but context freshness, traceability, and decision capture.
NHIMG editorial — based on content published by torq: agentic SOC context graphs and AI grounding
By the numbers:
- The average breach still took 241 days to contain.
- 90% of leaders said explainable AI decisions matter most.
Questions worth separating out
Q: How should security teams govern AI SOC agents that rely on shared context?
A: Treat the context layer as part of the control plane, not a reporting convenience.
Q: Why do static snapshots create risk for agentic security operations?
A: Static snapshots age quickly because assets, privileges, exceptions, and ownership change continuously.
Q: What do teams get wrong about explainability in AI SOC tools?
A: They often treat explainability as a reporting layer instead of a control requirement.
Practitioner guidance
- Define context freshness SLAs for SOC data Set freshness thresholds for asset, identity, policy, and exception data that feed AI-assisted investigations.
- Record verdicts and overrides as governed data Capture analyst decisions, suppressions, escalations, and policy exceptions in a queryable store linked to the exact graph state used at the time.
- Model identity and privilege as typed relationships Represent who grants access, which policies govern a resource, and which exceptions remain active using explicit relationship types rather than free-text notes.
What's in the full article
Torq's full article covers the operational detail this post intentionally leaves for the source:
- The production context-graph design choices behind agent grounding and why Torq says they matter for SOC fidelity.
- The bitemporal and decision-capture model used to make AI recommendations replayable and auditable.
- The practical difference between inventory data, policy semantics, and SOC judgment in an agentic workflow.
- The source article's description of how the graph stays isolated per tenant while still supporting reuse across investigations.
👉 Read torq's analysis of agentic SOC grounding and context graphs →
Agentic SOC context graphs: are your investigations grounded yet?
Explore further
02/08/2026 12:43 pm
Context is now a governed security control, not an implementation detail. The article is right to frame grounding as the layer underneath the agent, because AI reasoning is only as safe as the environment it can see. In SOC operations, the critical question is whether the system can prove what it knew at the moment it acted. That is a governance problem as much as an engineering one, and it belongs in the same control conversation as identity state, exception handling, and auditability.
A question worth separating out:
Q: When should organisations keep AI triage advisory instead of fully automated?
A: They should keep AI triage advisory whenever the context layer is incomplete, the data age is uncertain, or the identity and exception model has not been formally governed. Automation becomes risky when the system cannot prove the basis for its decision. In those cases, human review should remain the final control.
👉 Read our full editorial: Agentic SOC context graphs are becoming the real control plane
