Security alerts pour in by the thousands. Analysts can open only a fraction. The rest sit unexamined while teams weigh how much to trust artificial intelligence (AI) agents to close the gap.
Security teams are turning to an agentic security operations center (SOC), a model in which AI agents gather evidence, investigate alerts and take actions to contain threats. At Splunk's .conf26 user conference in Denver, experts and practitioners laid out their vision for how humans and machines will divide the work, and how much authority agents should earn.
"There's too much noise for the amount of signal you get," said Jeetu Patel, chief product officer at Cisco, during his keynote address.
"And most organizations don't have enough people in their SOC to go out and process every single signal that comes in. We actually ignore about 80% of the signal and only go look at the 20% of the signal that might be high-probability signals."
"The agentic era is here," Kamal Hathi, senior vice president and general manager of Splunk, said during the keynote. "And it is redefining how teams work together, how we innovate, how we protect, and how we respond."
The pressure is measurable. According to Ponemon Institute research commissioned by Crogl, enterprises receive an average of 4,330 security alerts per day and investigate just 37% of them. The survey of 649 IT security practitioners found that 42% of in-house security operations teams have just three to five full-time staff. The market is growing fast in response. MarketsandMarkets projects the AI SOC market will expand from $18.10 billion in 2026 to $47.07 billion by 2031.
An agentic SOC is a security operations model in which AI agents autonomously gather evidence, investigate alerts and take containment actions, with human analysts retaining oversight of critical decisions.
What Can AI Agents Do in the SOC Today?
AI agents are already accelerating security work. During the conference's product keynote, Bill Ouellette, senior manager of security information and event management (SIEM) architecture and engineering for Asurion, said AI makes his company's security data easier for analysts to use. He pointed to natural-language interaction through Splunk AI Assistant as a valuable improvement, allowing people to search without relying on administrators to formulate queries.
"We've seen big gains in speed and consistency," Ouellette said.
In the same session, Hossein Korsha, cybersecurity manager for Constellation Energy, described how the company uses AI to accelerate several steps in its security operations, starting with repetitive tasks tested against human analysts' responses.
"We're also able to ingest and observe data much faster, which lets us create detections much faster, find our vulnerabilities much faster, and overall speed up our entire SOC response," Korsha said.
The gains echo a broader shift. Security teams that once spent hours writing queries and parsing logs now delegate that work to agents, freeing analysts to focus on threats that require judgment. But the technology has limits. Korsha said his team tests agents thoroughly before deployment, checking their responses against human analysts.
Why Do Agents Need Better Data and Context?
Strong AI models are not enough to support production-ready security operations, speakers said throughout the conference. The agents need context.
"To have good data, you need to understand your unique business," Korsha said.
"You need to understand your unique network topology, your assets, your identities, and then build governance around it."
That knowledge helps security teams provide tools with the context needed to interpret activity and support an appropriate response, Korsha said.
Context also includes the organization's rules for responding to threats. John Morgan, senior vice president and general manager of Splunk Security, described during the product keynote how existing procedures inform the governance and policy layer of an agentic SOC.
"This is where you can introduce things like your standard operating procedure, so that the agents know how to act and how you want them to behave, as well as the context around that," Morgan said.
How Do Agents Earn Greater Authority?
The authority organizations grant to AI agents should depend not only on how capable and reliable those agents are, but also on the potential business consequences of their actions, experts and practitioners stressed.
During a panel on AI data management, Justin Cohen, leader of Cisco Innovation Labs Canada, noted that locking a single user account and shutting down an entire wide-area network are very different actions with very different stakes. He compared the trust organizations place in agents to the trust they place in entry-level employees.
"I wouldn't let a first-year help desker decide to shut the WAN off, but I would let them lock a user out," Cohen said. "So I think it's setting the blast radius of where we feel it's okay, and then where we need to get a human or a person to escalate."
Korsha described how teams build trust in agents through testing, then gradually expand permissions once agents prove their capabilities.
"The way we adapt AI and enable it is to identify the most repetitive tasks, build around those, make sure that they are tested thoroughly and to exhaustion, and then check their responses with our analysts before we even deploy them in production," Korsha said.
"Once those deployments are running and there is enough trust built into them, then we enable actual action taken on them, like removing read-only permissions."
What Role Do Humans Play in the Agentic SOC?
"We see AI as an accelerator to people," Korsha said.
"We depend on our analysts for their critical thinking, their business savvy and awareness, and their responsibility and deterministic capabilities. An LLM, by nature, is not yet deterministic. So, we want those critical decisions to rely on humans."
Across the conference, speakers described how they see the interplay between agents and humans evolving. The vision included agents gathering evidence and handling repetitive investigations, with analysts shifting their focus to work that requires judgment and institutional knowledge.
Human control is essential even when AI agents are largely capable of performing a task, Morgan said. No matter how adept AI tools become, they cannot ultimately take full responsibility for an organization's security environment.
"At some point, a human has to be accountable," Morgan said.
Related:
Calvin Hennick is a contributing writer. His work appears in BizTech, Engineering Inc., The Boston Globe Magazine and elsewhere. He is also the author of Once More to the Rodeo: A Memoir. Find him on LinkedIn.
© 2026 Nutanix, Inc. All rights reserved. For additional information and important legal disclaimers, please go here.
Related Articles
