Notifications
Clear all
Topic starter
02/08/2026 12:03 pm
TL;DR: SOC leaders are being pushed toward automation as rising alert volumes, tool sprawl, labour costs and breach expenses make the traditional staffed model unsustainable, according to Torq. The real shift is not “AI help” but machine-speed investigation and remediation that changes how operations, accountability and control design are managed.
NHIMG editorial — based on content published by torq: Running a SOC has never been cheap, but in 2026 it’s become unsustainable
By the numbers:
- The average SOC analyst salary tops $100K, but many leave within 18 to 24 months.
- Enterprises now average 80+ security tools.
- The average cost of a breach is $4.88M.
Questions worth separating out
Q: What should SOC teams automate without losing control?
A: SOC teams should automate repetitive enrichment, correlation, and routing, but keep decisions that change incident status, evidence integrity, or containment authority under human oversight.
Q: Why do autonomous SOC tools change identity governance requirements?
A: Autonomous SOC tools change identity governance because they make decisions at runtime rather than following a fixed script.
Q: What breaks when SOC teams try to scale only with more analysts?
A: Costs rise faster than coverage improves.
Practitioner guidance
- Define autonomous response boundaries List the exact containment and enrichment actions an AI system may execute without human approval, and separate them from actions that change privileged access, disable accounts, or alter evidence.
- Inventory workflow credentials and service accounts Map every token, API key, service account, and integration credential used by SOC automation.
- Measure response against attacker dwell time Track time from alert creation to containment, not just mean time to acknowledge.
What's in the full article
Torq's full analysis covers the operational detail this post intentionally leaves for the source:
- Implementation framing for hyperautomation across SOC workflows, including how to map repetitive tasks to machine execution.
- Details on the three-pillar architecture, including AI agents, hyperautomation, and enterprise-grade data handling.
- Operational claims about alert clearing, tier coverage, and response efficiency that would help teams assess fit for their environment.
- Source examples and commentary on cost reduction, staffing pressure, and architecture choices that underpin the vendor's argument.
👉 Read torq's analysis of agentic SOC economics and AI-driven response →
Agentic SOC economics: what it means for SOC teams now?
Explore further
02/08/2026 1:09 pm
Agentic SOC is a governance model, not just an efficiency play. The article frames automation as a way to reduce toil, but the deeper shift is that security operations are moving from human-paced work to machine-paced execution. That changes where accountability sits, because the system making the first containment move may no longer be a person. For identity programmes, the relevant question is how access, privilege, and approval boundaries are enforced when an AI agent is acting inside operational tooling.
A question worth separating out:
Q: Which metric best shows whether an agentic SOC is working?
A: Track whether containment time is falling faster than alert volume is rising. If the organisation can reduce dwell time, preserve investigation quality, and keep automation decisions auditable, the model is working. If not, the SOC has only shifted manual toil into a different interface.
👉 Read our full editorial: Agentic SOC economics are forcing a reset in security operations
