Now that six in ten security leaders view AI as a “game changer” across all security functions and 85% of security professionals report increased AI investment and usage in the past year, it’s clear that AI is no longer a fringe technology in security operations.

But the AI conversation has evolved recently as a new buzzword has taken over: agentic AI. Underlying the hype are real advancements that have the potential to transform security operations by adding autonomous, goal-oriented decision making to AI-powered SOCs. Gartner even named agentic AI one of the Top Strategic Technology Trends for 2025.  

Agentic AI is especially promising for security operations as a way to tackle persistent challenges such as alert fatigue, analyst burnout, and an ongoing talent shortage. Additionally, as increasingly automated attacks intensify the stakes for SOC teams, agentic AI will be a pivotal technology to counteract evolving threats through improved proactiveness and scalability. 

2 Key Use Cases for Agentic AI in the SOC 

1. Agentic AI in Phishing Response

Phishing continues to plague SOCs as one of the most common attack vectors for data breaches and ransomware. Agentic AI can elevate phishing response capabilities by streamlining triage, investigation, and containment once detections are flagged by external systems. 

Through seamless integrations with email security, identity management, threat intelligence, EDR, CMDB, and SIEM solutions, Torq’s Agentic AI can autonomously:

• Examine recipients, email content, links, attachments, IOC reputations, and related case and threat information to determine scope and impact, identifying users who received, opened, or interacted with an email. 
• Execute environment-wide sweeps for malicious payloads and correlate data to reveal compromised accounts or systems.
• Initiate containment steps such as quarantining emails, resetting credentials, terminating sessions with enforced MFA, and blocking malicious domains or IPs.  

2. Agentic AI in EDR Response

Experts predict that 20% of new malware strains will be AI-assisted by 2025. Agentic AI can bolster malware detection and response by orchestrating rapid analysis, scoping, containment, and eradication once suspicious activity is flagged by external platforms. 

Torq’s Agentic AI integrates with EDR, CMDB, SIEM, and threat intelligence tools to autonomously:

• Analyze file behavior (including hashes, signatures, and sandbox results), monitor endpoint resource usage, and detect suspicious persistence mechanisms or privilege escalations.
• Correlate anomalies across multiple endpoints to identify the scope of compromise, pinpointing infected hosts, associated IOCs, and potentially affected privileged accounts.
• Swiftly isolate infected endpoints, disable compromised accounts, and kill malicious processes. Malicious file hashes and IP addresses are then added to deny lists for continuous monitoring. Eradication actions can include removing malicious files, cleaning up affected systems, or re-imaging endpoints, ensuring a thorough remediation. 

Torq’s Multi-Agent System: Agentic AI in Action 

When you peel them back, many “AI SOC Agents” on the market are simply ChatGPT-style natural language chatbots. They may be capable of running steps and workflows but lack deep integrations and autonomous capabilities. 

In contrast, Torq’s Multi-Agent System is deeply integrated across the full security stack and able to take complex action and tackle multi-step tasks. At the helm is Socrates, Torq’s agentic AI SOC Analyst which can conduct fully autonomous case investigation, enrichment, and remediation from start to finish, as well as generating contextual recommendations. Alongside Socrates, Torq’s other AI agents provide AI-generated workflows, code, data transformations, case summaries, and more — helping SOC teams get more done, faster.

The Agentic AI ‘Wow Factor’ for Security Operations

“I believe the successful use of agentic AI in SOC operations shows up in practical outcomes. With Torq Agentic AI, the answer is ‘yes’ to questions such as: Are analysts happier? Are they sticking around? Do they have time to focus on more interesting and complex investigations? Are MTTM and MTTR lower? Torq Agentic AI extends and enhances our team so it can make better decisions more quickly — resulting in stronger security all around.”

– Mick Leach, Field CISO, Abnormal Security

• Boosting analyst engagement and retention: Rather than replacing human analysts, agentic AI can actually help make their day-to-day work in the SOC more rewarding and engaging by eliminating many of the “SOC analyst killers” that bog them down, such as alert fatigue, summarizing cases, and writing reports. This is crucial in a cybersecurity field that continues to deal with an ongoing talent shortage.
• Augmenting human expertise: For complex and high stakes cases that require human intervention, analysts can collaborate with agentic AI to make faster and better-informed decisions. This is thanks to agentic AI’s ability to correlate information from multiple tools, signals, and third-party threat intelligence to contextually enrich cases and provide deeper insights.
• Improving security posture: Through its ability to identify patterns and anomalies that may indicate malicious activity, agentic AI improves threat detection and response, enabling SOCs to proactively mitigate threats. Automated incident response and alert triage can reduce mean time to detect (MTTD), mean time to respond (MTTR), and mean time to containment (MTTC), minimizing the impact of security incidents.
• Enhancing operational efficiency and scalability: By handling Tier-1 and Tier-2 alerts and automating routine tasks, agentic AI frees up human analysts to focus on more strategic initiatives, such as threat hunting and vulnerability management. Agentic AI also enables SOCs to scale more efficiently, managing a higher workload without adding headcount.

Considerations for Building Trust in AI in the SOC

SOCs planning to deploy AI capabilities, including agentic AI, should take steps now to document and audit current processes, as it will be important to ensure that AI and automation is used to scale effective processes, rather than to compensate for ineffective ones. Security teams should also establish a method to quantify operational gains from an AI deployment. 

As with any new technology, AI in the SOC will require new skills and training for security teams, such as learning how to effectively collaborate with agentic AI. Any agentic AI solution deployed should be able to raise a flag when it is missing information or requires human validation. For example, if the AI’s threat analysis leads it to recommend quarantining a laptop but the user’s title is “CEO”, the system should have the intelligence and boundaries to flag that the decision is “above its pay grade” and then escalate the decision for human review and approval.

To combat the risk of AI hallucinations and build trust in AI, the system must be able to transparently explain why it made the decisions it made and how it came to the conclusions it did. This requires the AI to bolster its insights and recommendations with citations to original, forensic evidence.

AI or Die: Get the Manifesto

While agentic AI is still a relatively nascent technology, its potential to revolutionize security operations is undeniable. But the crowded AI SOC market makes careful selection essential. 

Get the AI or Die Manifesto to learn red flags that separate AI-washed vaporware from truly impactful AI for the SOC, as well as strategic considerations for effective adoption.

Gal Peretz is Head of AI & Data at Torq. Gal accelerates Torq’s AI and data initiatives, applying his deep learning and natural language processing expertise to advance AI-powered security automation. He also co-hosts the LangTalks podcast, which discusses the latest AI and LLM technologies.

Our previous blog post explored how planning with AI systems can set the stage for smooth collaboration between humans and machines. However, a solid plan alone isn’t enough. The next step is orchestrating the execution — ensuring that the AI system can carry out tasks autonomously while maintaining guardrails that prevent errors, hallucinations, or false actions.

The Challenge of Direct Execution: LLMs Alone Aren’t Enough

Moving from a free-text runbook to execution without a structured schema is where most AI implementations fail. While large language models (LLMs) are powerful, they continue to struggle with AI autonomy due to:

• Hallucinations: Making incorrect assumptions or executing invalid steps.
• Ambiguity: Choosing the wrong tools or extracting incorrect arguments from the execution context to pass to the next step.
• Lack of Determinism: Struggling to execute tasks consistently without a clear structure, often leading to indeterministic execution where the AI agent may jump between steps out of order or skip them altogether.

Simply put, letting the LLM orchestrate execution without structure and guardrails lacks the precision needed for a reliable execution process.

Streamlining the Execution of a Clear and Reliable Plan

To address this, Torq implements a concrete structured execution scheme that ensures Torq’s AI system performs tasks deterministically and without ambiguity. Once the high-level plan is developed, the AI extracts each step as an atomic unit — clear, precise, and sequential. 

This structured approach eliminates the risks of indeterministic execution, where the AI agent might skip steps, go out of order, select incorrect tools, or misinterpret arguments due to vague instructions. 

Think of it like following a recipe step by step: after deciding to ‘make dinner,’ you break your activities into clear, sequential micro-tasks like ‘bring water to a boil’, then ‘add pasta to the water.’ 

Similarly, Torq built our AI to execute a detailed plan one micro task at a time, in the right order. This allows Torq’s AI system to analyze and break down instructions and examples for each step, ensuring the AI completes the overarching task accurately. By eliminating ambiguity, the structured execution guides the AI to select the right tools and arguments at every stage, delivering consistent and reliable results.

AI Guardrails: Balancing AI Autonomy and Control

While we aim to maximize AI autonomy, balancing it with guardrails is critical to ensuring its safe and reliable execution. These guardrails act as safety nets that prevent the AI from taking false or unintended actions, ensuring human oversight remains available when necessary.

The key is for the AI to be able to break down the execution process into atomic steps that it can handle precisely. The system then focuses on clear micro-tasks for each step, reducing ambiguity and enabling the AI to perform confidently. 

However, when the AI encounters uncertainty — such as ambiguous context, missing tools, or incomplete arguments — it pauses execution and escalates the decision to a human operator. This human-in-the-loop mechanism mitigates the risks of hallucinations or incorrect tool usage, providing a safety checkpoint before the AI proceeds.

By combining structured execution with these dynamic guardrails, we can push the boundaries of AI autonomy. This allows the AI to operate efficiently and autonomously in most cases, saving significant time and resources while ensuring that safety and accuracy are never compromised.

Reliable AI-Powered Execution at Scale

Orchestrated execution unlocks AI’s full potential by combining precision, autonomy, and control. By leveraging a step-by-step structure, AI can focus on atomic tasks, ensuring consistency and reliability at every stage. This approach streamlines workflows requiring constant human intervention, enabling AI to act efficiently while remaining grounded in a structured plan.

For Security Operations Center (SOC) teams, this translates to faster and more reliable execution of security runbooks at scale. This reduces the need to micromanage AI-powered SOC processes or perfect the prompts to control the AI, giving SOC teams more time for higher-value tasks while ensuring confidence in the AI’s structured execution.

The Future of AI Autonomy in the SOC

Choosing solutions that orchestrate AI execution with appropriate guardrails is critical for building trust, efficiency, and precision in today’s SOC operations. AI that structures execution as a series of deterministic micro steps and balances AI autonomy with human oversight allows SOC teams to confidently rely on AI systems to streamline their workflows.

This collaborative approach enables SOC analysts, engineers, and managers to:

• Maintain control over automated processes
• Trust in AI’s reliability for step-by-step execution
• Focus on higher-value work while reducing uncertainty

The result is a stronger, more efficient autonomous SOC environment where human expertise and AI capabilities work seamlessly together. Schedule a demo today.

As C-suites and boards are bombarded with headlines about AI revolutionizing cybersecurity, it’s no wonder they’re putting pressure on SOC leaders to adopt AI. The promise of AI in the SOC is rightfully alluring. An AI-native autonomous SOC has the potential to create a world where AI Agents collaborate with each other to take care of repetitive tasks and handle the majority of low-level alerts, freeing your human team up for strategic, proactive work. 

The hurdle? The AI cybersecurity landscape is swarming with vendors — and new ones are seemingly popping up out of stealth mode every day with shiny marketing and grand claims. 

This leaves SOC leaders wading through the noise to figure out which tools are overexaggerated AI-washed vaporware and which ones are truly operational, integrated, and trustworthy. Below are some tips for cutting through the hype to find the right AI solutions to help build an autonomous SOC. 

Start with the End Goal in Mind — and Think Big Picture

Step back and start with the big picture. To avoid “scattergun” AI adoption in the SOC that leads to a flood of AI-generated alerts with no context or prioritization, begin by defining clear AI objectives aligned with your overarching security strategy. Before you dive into the AI vendor pool, take a moment to reflect on your SOC’s practical needs. What are your biggest pain points? Where could AI make the biggest impact? Are your analysts drowning in a sea of alerts? Or are they having to spend too much time on tedious tasks? Prioritize AI solutions that directly address these day-to-day challenges.

“I believe the successful use of AI in SOC operations shows up in practical outcomes. With Torq Agentic AI, the answer is ‘yes’ to questions such as: Are analysts happier? Are they sticking around? Do they have time to focus on more interesting and complex investigations? Are MTTM and MTTR lower? Torq Agentic AI extends and enhances our team so it can make better decisions more quickly — resulting in stronger security all around.”

– Mick Leach, Field CISO, Abnormal Security

Leverage AI for tasks where human limitations — such as fatigue and information overload — lead to inefficiencies. Generative AI-powered AI Agents are adept at tasks involving natural language processing and the creation of logical workflows. This makes AI ideal for automating repetitive, monotonous tasks, intelligently triaging alerts and autonomously handling incidents, and providing real-time insights and recommended next steps to speed up human decision-making. In turn, human analysts are freed up to focus on strategic activities and make faster, more informed decisions, significantly improving overall efficiency and effectiveness.

Think holistically to maximize the value of your investment. One-off AI tools from different vendors can’t add up to an autonomous SOC because they can’t connect security signals across your stack and provide meaningful, context-rich insights. Prioritize investing in a centralized automation platform with enterprise-grade scalability and the ability to integrate with every solution in your security environment. Purpose-built AI Agents for the SOC built on this foundation can work as a unifying force at the heart of your security stack to correlate disparate event data, uncover deep, contextual insights, and accelerate efficiency gains across your security operations.

Stay ahead of threats by keeping up with autonomous SOC advancements. Hyperautomation is now table stakes for Security Operations, demanding platforms with native, fully embedded AI capabilities rather than bolted-on GPT wrappers. Agentic AI,  the new frontier for delivering on the promise of the autonomous SOC, is now a reality. Torq just announced a groundbreaking Multi-Agent System for security operations with specialized AI Agents that collaborate, plan, and reason to autonomously analyze and resolve security threats. 

“SecOps organizations that adopt GenAI-based Hyperautomation will benefit from the most advanced LLMs ever, enabling analysts to auto-analyze more events and identify novel threats at the beginning of their cascade of potential impact, rather than after they’ve had a chance to create serious damage. GenAI will also further democratize SecOps, so employees at all levels are able to deploy, manage, and monitor Hyperautomation systems.”

– Leonid Belkind, Torq CTO and Co-Founder | 2025 Predictions: How GenAI and Hyperautomation Will Reshape SecOps and Threat Landscapes

Tips for Evaluating AI Cybersecurity Tools for the SOC

Establish your evaluation criteria: Given the potential risks associated with AI solutions, careful third-party risk management is crucial.  Collaborate with IT teams, business leaders, and legal to ensure alignment with company-wide AI usage policies. Below are some key considerations when choosing a vendor for AI in the SOC:

• Flexibility and integration: Make sure the AI solution you choose can easily integrate with your existing security stack and ingest and intelligently transform data in any format. A flexible platform that can adapt to your evolving needs is essential so you don’t get locked in. 
• Security and privacy: Any solution deployed in your SOC should meet enterprise-grade security standards and have tiers of controls to protect data confidentiality. 
• Transparency: One of the most crucial elements for building trust in AI is to ensure the model can explain why it made the decisions it made and how it came to the conclusions it did. 
• Human-AI collaboration: Effective AI Agents in the SOC facilitate a collaborative, back-and-forth relationship with the human analysts they work with, clearly communicating its capabilities and limitations. When encountering roadblocks, the AI should seek human input or validation.

Ask the right questions: Overexaggerated,  misleading, and outright false claims about AI capabilities are all too common. We’ve got a list of 40 questions to help you understand a vendor’s AI capabilities, integrations, and more, such as:

1. Is all customer data encrypted in transit? Is stored data encrypted on disk? Is data stored in vendor data centers or only in memory? 
2. What countermeasures does the solution have in place to prevent AI hallucinations?
3. Does the system keep immutable records of all inputs and outputs for AI-driven actions?
4. Does the solution have robust and versatile role-based access controls? 

Refine your shortlist: Use your evaluation criteria to narrow down your list of potential vendors. Consider factors like cost, features, and vendor reputation. Conduct thorough research and request demos from your shortlisted vendors. 

Test before you invest: The proof of whether an AI solution is vaporware or truly operational is in the POC. Ask for demos and conduct a proof-of-concept for a key use case to see the AI solution in action in a controlled environment. Pay attention to the scalability, ease of use, and overall performance. 

Consider long-term partnerships: Build strong relationships with vendors who can provide ongoing support and innovation. Ask about their AI product roadmap.

40 Questions to Ask AI SOC Vendors

To help you sharpen your evaluation of AI solutions for the SOC, we’ve put together this list of 40 critical questions to ask vendors. Cut through the noise of “AI-washed” marketing and dig into the AI’s operational and integration capabilities to ensure you get real value.