Notifications
Clear all
Topic starter
01/08/2026 8:59 pm
TL;DR: Agentic SOC triage can reach under $2 per alert, with Morpheus cited at $0.97 and 98% accuracy when uncertainty is deferred to a human, according to D3. The economics matter because SOC automation now has to prove not just speed, but bounded trust, auditability, and analyst oversight.
NHIMG editorial — based on content published by D3: The SOC After the Agentic SOC and related research on triage economics
By the numbers:
- Morpheus: $0.97 at 98% accuracy; when uncertain, it defers to a human.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
Questions worth separating out
Q: How should security teams govern agentic triage in the SOC?
A: Treat the agent as an operational system with scoped access, documented decision boundaries, and mandatory logging.
Q: Why do AI-driven SOC workflows need stronger governance than traditional automation?
A: Traditional automation follows predefined rules, but AI-assisted workflows can change how a case is interpreted, prioritised, or escalated.
Q: What breaks when agentic triage has no clear deferral boundary?
A: The SOC can no longer explain why a case was auto-processed, why a signal was dismissed, or who accepted the risk.
Practitioner guidance
- Define confidence thresholds for escalation Set clear thresholds for when the AI must defer to an analyst, and test those thresholds against real alert samples before expanding autonomous triage scope.
- Measure per-alert savings against analyst effort Track minutes saved, queue reduction, and analyst touchpoints per alert so CFO-facing pricing claims can be compared with actual operating impact.
- Audit the evidence trail for every deferred case Require the case record to capture machine output, confidence score, human override, and final disposition so incident reconstruction remains defensible.
What's in the full report
D3's full research covers the operational detail this post intentionally leaves for the source:
- Field observations from D3 deployments showing how agentic SOC triage changes analyst workload and queue handling.
- Pricing questions that expose whether the AI cost model survives CFO scrutiny under different alert volumes.
- The Morpheus pricing and accuracy framing in more detail, including when the system defers to a human.
- The governance assumptions behind agentic SOC autonomy and where review trails need to be preserved.
👉 Read D3's research on the agentic SOC triage economics and operating model →
Agentic SOC triage economics: what changes for SOC teams now?
Explore further
01/08/2026 9:06 pm
Agentic SOC economics are a governance story, not just a cost story. A low per-alert figure only matters if the organisation can show where human judgment was removed, where it was retained, and how exceptions were handled. For SOC leaders, the decisive issue is whether automation reduces load without creating an evidence gap that undermines incident response, audit, or legal review. The practitioner conclusion is straightforward: treat savings claims as incomplete until they are paired with defensible control design.
A question worth separating out:
Q: Who is accountable when an AI triage system misses an incident?
A: The organisation remains accountable, even if software performed the first-pass analysis. Risk owners, SOC leadership, and the control owner for the workflow need to define approval rights, review obligations, and evidence retention before the system is relied upon.
👉 Read our full editorial: Agentic SOC triage economics are reshaping security operations
