EP278 The Agentic SOC: Are We Measuring Time Saved or Risk Reduced?

The episode kicks off from Cloud Next 2026, featuring hosts Tim Peacock and Anton Chivacan with guest Matt Grigsson from PWC UK. They set the scene for a deep dive into the evolving concept of the agentic SOC and AI's role in security operations, highlighting the rapid progression towards autonomous security systems and the importance of measuring true success, such as risk reduction versus just time savings.

The discussion explores the current landscape of agency-enabled security operations centres (SOCs), describing two main uses of AI: as a co-pilot helping analysts understand detections and alerts, and as a tool integrated into workflows for containment and autonomous actions. The hosts anticipate that full automation is still in pilot stages, with organizations cautious about handing over complete autonomous remediation. The concept of expanding the 'agentic overton window'—what is acceptable AI behavior—is introduced, aiming to broaden AI's role in SOCs over the next three years.

The conversation emphasizes the benefits of AI agents in reducing risk, response times, and operational costs. It discusses how AI can enable faster decision-making, particularly against sophisticated, AI-enabled attackers, and how the industry is genuinely experiencing these threats. The authors acknowledge fears of hype but reinforce that real, tangible advancements are occurring—like detecting and responding to cyber incidents more swiftly and effectively.

A significant theme is the human-AI teaming analogy, where AI acts as a teammate or co-pilot in security operations. The hosts debate whether AI should be seen as a colleague or a machine, emphasizing that effective collaboration relies on viewing AI as a trusted partner that can handle certain tasks autonomously, while humans oversee and review actions, especially in high-stakes scenarios.

The episode addresses concerns about hallucinations (false positives or incorrect AI conclusions) and human fatigue in SOCs. It’s noted that hallucinations are less prominent in newer models but remain a concern in noisy, complex environments. Human fatigue is acknowledged as a broader industry challenge, affecting decision quality, but the focus remains on improving AI's accuracy and ensuring proper governance to mitigate errors.

Discussion centers on how to assess if a SOC is ready for AI and automation. Key prerequisites include having integrated, high-quality data platforms and effective automation tools like SOAR. Metrics such as mean time to respond (MTTR), automation levels, and reductions in human touches are highlighted as ways to measure success. The importance of cost-benefit analysis is also discussed, advocating for using simpler, lower-cost models where high accuracy suffices, and reserving complex models for high-stakes scenarios.

The hosts speculate on what SOCs will look like in 2030, with some optimistic views that many manual tasks will persist, but environments will become more automated and intelligent. They acknowledge ongoing industry challenges like unpatched systems and insufficient security practices, emphasizing that technological advancements alone won't solve all problems without fundamental security improvements.

For organizations eager to adopt AI, the advice is to start small—build and test simple AI agents integrated with existing platforms, and gradually expand. Staying involved in community conversations on Twitter and other platforms is encouraged to stay abreast of best practices. The emphasis is on practical experimentation and incremental deployment to build confidence and understanding.

The episode wraps up with a recommendation to subscribe and review, and a mention of resources like previous episodes on SIEM and agentic SOCs. The hosts thank the guests and listeners, encouraging ongoing discussion and experimentation with AI tools.