AI for security defendersAdvancedLesson 1606 min read

From copilot to agentic SOC

An assistant answers questions. An agent can run investigation steps by itself. That power needs guardrails, approvals and measurement.

✦ Ask the tutor🧪 Lab · 25 min📝 Lesson test
Lesson in motion

In 60 seconds

From copilot to agentic SOC

An assistant answers questions. An agent can run investigation steps by itself. That power needs guardrails, approvals and measurement.

1/5
In simple words
A helper who only gives advice is safe. A helper who can also open doors and lock people out is more useful, but you must decide carefully which doors they may open, and when they must ask you first.
A copilot or assistant answers when you ask: "Summarise this", "Write a query for that". An agent is given a goal and tools, and decides which steps to run: query logs, check reputation, look up the user, open a ticket, and sometimes take action.
Assistant (copilot)Agent
Who runs stepsThe analystThe AI, using connected tools
Typical workExplain, summarise, draftInvestigate an alert end to end, gather evidence, draft a verdict
Main riskWrong answer that a person readsWrong action taken on real systems
Main controlHuman reads and checksPermissions, approvals, logging, limits

Guardrails for SOC agents

  1. Start read-only. Let the agent search logs, look up users and check reputation, but not change anything.
  2. Approvals for containment. Isolating a host, disabling an account or blocking an IP needs a human to click approve.
  3. Least privilege. Give the agent its own identity with only the permissions it needs, not an admin account.
  4. Log everything. Record every tool call, input and output, so you can review what it did and why.
  5. Limits. Cap how many actions or queries it can run, and have a way to stop it quickly.
Watch out
The data an agent reads can contain attacker-controlled text: email bodies, file names, user agents. If the agent can take actions, a hidden instruction in that data could trigger one. This is covered later in "Attacks on AI security tools: poisoned logs and prompt injection".

Grow step by step

  1. 1

    Assist

    AI drafts summaries; analysts do everything else.
  2. 2

    Investigate read-only

    Agent runs searches and lookups and writes a case summary.
  3. 3

    Recommend actions

    Agent proposes containment; a human approves or rejects each one.
  4. 4

    Limited automation

    Only low-risk, reversible, well-tested actions run without approval, with sampling and review.

Measure before and after

Do not judge an agent by a demo. Measure it on your own alerts, before and after, for the same kinds of cases.
MeasureWhy it matters
Time to triageIs the first decision faster?
Accuracy vs final verdictHow often does the agent agree with the analyst's final decision?
Missed true positivesDid it call any real attack benign? This matters most.
Analyst editsHow much of the agent's summary did people have to fix?
Actions reversedHow often were approved actions later undone?
Risky agent setup
  • Agent runs with a domain admin account
  • Can disable accounts without approval
  • No record of its tool calls
Safer agent setup
  • Own identity, read-only by default
  • Containment needs a named approver
  • Every step logged and reviewed
Try this. Write down three actions your SOC takes (for example: reset a password, isolate a laptop, block a domain). For each, decide: can an agent do it alone, with approval, or never?

Watch and read more

Lab

A permission plan for a made-up SOC agent, with approvals and metrics.

~25 min

The problem

You are planning an AI agent for a small SOC at an IT services company.

  1. List 8 tools or actions the agent could have (for example: search SIEM, look up user in directory, check domain reputation, open ticket, isolate host, disable account, block IP, send email to user).
  2. For each, choose: allowed read-only, needs approval, or not allowed. Give a one-line reason.
  3. Write what will be logged for every action.
  4. Choose 4 metrics to compare before and after the pilot, and say how you will collect each.

You are done when

Hard questions

Try to answer before you reveal. If you can answer these, you understood the lesson.

Q1Why is "send an email to the user" riskier for an agent than it first looks?Reveal

An email can be used to leak data, to send an attacker-controlled link, or to warn an insider who is under investigation. If injected text in an alert could shape the email, the agent becomes a tool for the attacker. Outgoing messages should need approval or be limited to fixed templates.

Q2Your agent cuts triage time a lot, but analysts edit most of its summaries. Is it a success?Reveal

Not clearly. Heavy editing means the time saved may be partly lost to fixing, and some errors may slip through when people are busy. Look at what they edit: style fixes are fine, but factual fixes are a warning sign. Success is faster triage with no drop in accuracy and no missed attacks.

Please sign in to continue.

Questions people ask

Is an agentic SOC the same as SOAR?

They are related. SOAR tools run fixed playbooks that people design step by step. An AI agent decides its own next step based on what it finds. Many teams combine them: the agent investigates and recommends, and tested playbooks carry out approved actions.

Why start read-only if the agent is accurate?

Because you do not yet know how accurate it is in your environment, and reading cannot break anything. Read-only mode lets you collect evidence about its quality safely before giving it any power to change systems.

Who is responsible if an agent blocks the wrong account?

The organisation and the people who set its permissions and approved the action. That is why approvals name a person, and why logs must show who approved what.

Lesson test

5 questions. Get 3 right (60%) to pass and complete this lesson.

Sign in to take the test and save your progress