Autonomous SOC Agents: What Is Actually Working, and What Is Marketing

The pitch has been the same for three years: agents triage the queue, humans handle the interesting work. In 2026 there is finally enough production data to separate what holds from what does not.

What is genuinely working

• Enrichment and correlation. Pulling asset ownership, recent change tickets, identity context and prior similar alerts into a single written summary. This is the highest-value, lowest-risk use, and it saves real analyst minutes on every alert.
• Deduplication and clustering. Collapsing forty alerts into one incident narrative with a timeline. Models are good at this and it is easy to verify.
• Draft containment plans. The agent proposes the isolation, the revocation, the block. A human approves. Time-to-decision drops without moving the authority.
• Post-incident writing. Timelines, customer notifications and lessons-learned drafts from the ticket history.

What is still marketing

• Fully autonomous containment on production systems. The failure mode is not a missed detection; it is an agent isolating a payments host at close of business on a false positive.
• "The agent learns your environment." In practice it learns your recent ticket text, which encodes your past mistakes as ground truth.
• Novel threat discovery. Agents are strong at pattern completion and weak at the thing that makes a good hunter valuable: suspicion without a prior.

The design principle that separates the two lists

Every deployment we have seen work draws the line in the same place: the agent may decide, but a human authorises anything irreversible. Reversible actions — enrichment, tagging, ticket routing, notification — can run unattended. Irreversible ones — isolation, revocation, deletion, blocking a customer-facing route — require an approval with a named human on the record.

Instrument it like a junior analyst

• Track agreement rate between agent conclusions and analyst conclusions on a sampled slice, every week.
• Track the false-closure rate specifically. An agent that closes alerts fast is not an achievement unless the closures were right.
• Keep a full prompt-and-tool audit trail. When an agent gets an incident wrong, you need to reconstruct what it saw.
• Re-baseline after every model or prompt change. Silent vendor upgrades are the most common cause of an overnight quality regression.

Automate the reading, not the deciding. Then measure whether the reading was right.