How should SOC teams detect agentic attacks that do not behave like scripts or humans?

Why This Matters for Security Teams

Agentic attacks create a detection problem that sits between classic malware automation and hands-on-keyboard intrusion. They can chain tools, revise plans, and recover from failures without following the fixed cadence that many SOC detections assume. That means alerts built around static signatures, single-step indicators, or perfectly repeatable TTPs often miss the event until a later stage of compromise. Guidance from the NIST Cybersecurity Framework 2.0 still applies, but the control objective must be adapted to behaviour that is adaptive, not scripted.

The practical risk is that an agent can look “noisy but normal” if telemetry is assessed in isolation. A login, a query, a file read, and an API call may each appear low risk, while the sequence reveals reconnaissance, privilege discovery, and task re-planning. Security teams also need to distinguish agentic activity from legitimate automation such as orchestration jobs, CI/CD pipelines, and RPA tools. The useful question is not just whether the action is allowed, but whether the action pattern shows goal-seeking adaptation across systems. In practice, many security teams encounter agentic abuse only after lateral movement or data access has already occurred, rather than through intentional behavioural detection.

How It Works in Practice

Effective detection starts by correlating identity, process, network, and application telemetry into one analytic view. SOC logic should score for timing variance, path divergence, and retry behaviour rather than relying only on known bad artefacts. A machine-speed actor often moves faster than a person, but it also pauses after failed tool calls, changes route when a control blocks access, and repeats discovery in a way that reflects decision-making. That is why the behaviour model matters as much as the event.

Teams should build detections around the full chain of interaction. For example, compare the first tool invocation to later tool selection, watch for sudden expansion from read-only actions to write or execute actions, and flag repeated enumeration against adjacent resources. The MITRE ATLAS adversarial AI threat matrix is useful for thinking about attack stages, while the OWASP Agentic AI Top 10 helps frame common failure modes such as tool abuse, prompt manipulation, and excessive autonomy.

• Baselining should include normal automation jobs, service accounts, and approved agent workflows.
• Detections should join identity context, command lineage, and external destination reputation.
• Analysts should inspect reasoning artefacts where available, including plan changes, tool-choice pivots, and explanation traces.
• Containment should be able to revoke tokens, narrow permissions, and isolate tool access quickly.

Where AI governance matters, map this work to the NIST AI Risk Management Framework and to incident patterns discussed in the Anthropic report on the first AI-orchestrated cyber espionage campaign, which is a useful example of adaptive, tool-using adversary behaviour. These controls tend to break down when telemetry is fragmented across SaaS, cloud, and endpoint tools because the agent’s plan can only be seen by joining those streams.

Common Variations and Edge Cases

Tighter behavioural detection often increases analyst workload and false positives, requiring organisations to balance coverage against operational noise. That tradeoff is especially sharp when the environment already contains many legitimate automations, because agentic abuse can resemble normal orchestration until the sequence is reviewed in context.

Best practice is evolving for environments that expose model tools directly to users, allow autonomous browser control, or let agents operate with broad service credentials. In those cases, no universal standard exists yet for how much reasoning transparency SOCs should retain, but current guidance suggests preserving enough evidence to reconstruct intent, tool use, and permission scope. The goal is not to “detect AI” in the abstract, but to detect adaptive activity that crosses trust boundaries faster than a human would.

Edge cases also appear when attackers deliberately imitate human delays or when legitimate agents are trained to behave conversationally. That is why a single signal, such as typing cadence or command rate, is rarely enough. Align detections with MITRE ATT&CK Enterprise Matrix for the surrounding intrusion pattern and use CISA cyber threat advisories to track emerging tradecraft. The hardest failures occur in highly automated SaaS estates where service accounts, AI agents, and human operators share the same network paths and identity events.

Related resources from NHI Mgmt Group

• How should security teams detect AI-orchestrated attacks before exfiltration starts?
• How should security teams detect browser-based copy-paste attacks before they execute locally?
• How should security teams detect living-off-the-land attacks in hybrid environments?
• How should security teams use deception against agentic AI attacks?