Notifications
Clear all
Topic starter
02/08/2026 12:24 pm
TL;DR: Only true positives are escalated in an AI SOC workflow, with roughly 4% of alerts moving forward at 98% accuracy, according to Intezer, then cases are handed to Torq for enrichment and autonomous runbook execution. The governance challenge is not speed alone, but whether agent-to-agent handoffs preserve accountability, auditability, and human override in machine-led response.
NHIMG editorial — based on content published by Intezer: Better together: How Intezer and Torq are powering the autonomous, AI SOC [Video]
By the numbers:
- Noise stays behind, typically only 4% of alerts are escalated with 98% accuracy.
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%).
Questions worth separating out
Q: How should security teams govern autonomous SOC actions without losing control?
A: Security teams should set explicit approval boundaries for every autonomous action, then require logging, rollback, and ownership for each one.
Q: Why do AI SOC workflows create governance risk even when alert accuracy is high?
A: High accuracy only proves that the model performs well on observed cases.
Q: What breaks when autonomous remediation is not constrained by policy?
A: Unconstrained remediation can turn a false positive into a live outage, or let a narrow detection case trigger broad blocking, isolation, or account changes.
Practitioner guidance
- Define delegated authority for SOC agents Map each AI agent in the SOC workflow to a scoped identity, explicit permissions, and a documented action boundary.
- Instrument every agent handoff with policy context Log what case was transferred, which policy allowed it, what data was exposed, and what action set became available on receipt.
- Gate autonomous remediation behind rollback controls Limit any runbook that can affect production systems to approved actions with reversible steps, blast-radius constraints, and exception handling.
What's in the full article
Intezer's full post covers the operational detail this post intentionally leaves for the source:
- Walkthrough of the agent-to-agent workflow between Intezer triage and Torq response orchestration.
- Specific examples of how case enrichment is structured inside the autonomous SOC flow.
- A fuller look at how runbook execution is sequenced after true-positive verification.
- Video context that shows how the two systems hand off work in practice.
👉 Read Intezer's analysis of autonomous SOC workflows and AI agent handoff →
Autonomous SOC workflows: what do AI operations teams need now?
Explore further
02/08/2026 1:24 pm
Autonomous SOC is an identity problem as much as an operations problem. Once AI agents can triage, enrich, and execute, they behave like non-human actors with delegated authority. That means the governance burden shifts from alert handling to access scoping, auditability, and revocation of machine-led actions. Practitioners should treat SOC agents as governed identities, not just workflow components.
A question worth separating out:
Q: How can analysts tell whether AI-driven SOC automation is actually working?
A: Look beyond alert volume and measure whether the platform produces accurate incidents, preserves tenant context, and shortens time to closure without creating rework. If analysts still need to reconstruct the story manually, the automation is reducing noise but not truly improving operational control.
👉 Read our full editorial: Autonomous SOC workflows raise new governance questions for AI operations
