CISOs are now deciding how much authority a software agent gets inside the SOC and in most organizations the answer is a little at a time. Agentic AI in security operations means software agents that investigate alerts, gather evidence across the stack and carry out response steps with limited human prompting. Decisions that once waited in an analyst's queue now live in a governance policy.
Most teams are still granting that authority slowly. In Strike48's The State of Agentic Security 2026, a survey of 100 enterprise CISOs and mid-market security leaders, only 22% would fully automate Tier 1 work, and just 36% had an agent running in production.
That caution tracks a change in what agents do. Once an agent stops recommending and starts to act, every grant of authority becomes a live decision.
"Most teams begin with Tier 1 triage because the volume is high and each alert is a bounded decision. That's where an agent can prove itself against the analysts' own judgment before anyone widens its remit," says Strike48's Tim Leehealey
Agents have moved from suggesting to acting
An agent that executes changes in a live environment carries a different level of risk than one that drafts a summary, and CISOs should treat the two as separate approval decisions. A wrong summary costs an analyst a few minutes of review, while a wrong action can take a production system offline.
John Sapp, field CISO at Chainguard and formerly vice president of information security and CISO at Texas Mutual Insurance Company, points to false positives as the route to that outage. "If you allow full autonomy, it takes action on your environment and now it could actually create an outage," he says. His answer is a human approval step, "that last check before you push the button," before any change executes.
That reviewer can only judge the evidence the agent gathered, so the quality of that evidence becomes the next decision.
An agent is only as good as the data it can see
An agent's verdict is only as reliable as the logs and telemetry it can query, so data coverage is the first thing a CISO should audit. Agents investigate by pulling evidence from the tools around them, and when a source is missing, the agent can still return an answer. The analyst approving it has no way to see what was left out.
The cost of partial data is already visible. In the Strike48 survey, 65% of respondents had at least one investigation stall in the past 12 months because the data they needed sat in a system their tools couldn't access. An agent working from the same partial picture clears the queue while leaving those blind spots in place.
Before an agent receives any authority, a security team should map which log sources it can query, how current they are and whether it can reach them without a human exporting data first. Once the data is sound, the next decision is how much the agent may do with it.
Authority should follow the impact of the action
The safest way to grant authority is by the impact of each action, with reversible, low-risk steps automated first and anything destructive held for approval.
Sunil Varkey, CISO at Hexaware Technologies, draws the line with a concrete case. He would let an agent reset a password and revoke session keys after an impossible-travel login. "Impact is only for one person and based on a threshold we got it," he says. A revenue-generating application that faces the internet is a different matter. "Am I going to immediately block it completely out? I may not do that," he adds.
Ben Rothke, senior information security manager at Experian, frames the same policy through the agent's role. "If that agent is a hospital volunteer, they have very little autonomy. If that agent is the attending, they have a lot more autonomy," he says. The analogy gives a CISO a test for every new capability, which is what a person in that role would be allowed to do without sign-off.
A tiering policy only works if someone has the power to enforce it, and that power doesn't always sit with the CISO.
Someone has to own the kill switch
Every agent needs a named owner who can shut it off, and the CISO may not be that person today. As CISOs restructure their SOCs for agentic defense, the org chart has to settle who holds production authority before the first agent goes live.
William duPont, CEO and co-founder of Applied Identities, raises the problem plainly. "You may find that the CISO doesn't actually have the authority to turn that off," he says. He argues the fix is organizational and comes first, with one person owning the whole system and one owning the kill switch, and only then can policies automate the shutdown.
Containment planning depends on the same ownership. Security leaders are already drafting containment strategies for shutting down AI agents, and those plans only work if someone holds the authority to execute them. Once an owner exists, the agent still needs a way to earn its first grant of authority.
Settle the rollout terms before the first agent goes live
A side-by-side run with human analysts is the most direct way to turn a pilot into a decision, and it works best when the exit criteria are written before it starts. Tim Leehealey, vice president of corporate strategy and operations at Strike48, describes the sequence the company follows for each agent it adds to its own operations.
"Every time we agenticize something at Strike48, we fundamentally go on a one month journey of implementing, making sure it's good, running side by side, monitoring and then ultimately transitioning. That's literally the only way to do it," Leehealey says.
That month is the window to settle four terms, namely the data sources the agent reads, the action tiers it works within, the named owner who can turn it off and the record it leaves behind. The last term determines how far the other three can loosen.
A decision record will set how far agents are allowed to go
The CISOs who widen agent authority fastest will be the ones who can show what an agent did and why it did it. In the Strike48 survey, distrust of agent outputs was the top barrier to deployment, cited by 52% of respondents. A reviewer who can see the evidence behind an action doesn't have to rebuild it, and a CISO holding the same record can hand it to an auditor, thereby preventing the compliance risks AI agents create.
"Agents earn authority one data source and one decision at a time. If every query an agent ran and every log it read can be replayed on demand, a CISO can move an action from approval to automation without guessing," says Leehealey.
Frequently asked questions
What is agentic AI in security operations?
Agentic AI in security operations is software that works a security task from alert to outcome. It gathers evidence from connected tools, reasons over it, decides on next steps and can carry out response actions, while humans set the limits and review high-impact steps.
How is an agentic SOC different from SOAR or an AI copilot?
SOAR runs playbooks that people wrote ahead of time, and a copilot responds when an analyst asks it something. An agent chooses its own investigative steps for each alert and carries them out across the connected tools.
What tasks can AI agents handle in a SOC?
Alert triage and investigation are the core tasks, including collecting context, correlating events and judging whether an alert is a false positive. Some teams also let them run low-risk response actions, such as resetting a password and revoking session keys after an impossible-travel login.
What are the risks of agentic AI in security operations?
The main risks are a wrong action with production impact, an unreliable verdict built on incomplete data, and unclear ownership when nobody has the authority to shut an agent off. Distrust of agent outputs is the top deployment barrier, cited by 52% of leaders in Strike48's survey.
Will agentic AI replace SOC analysts?
Not in current deployments. Only 22% of leaders in Strike48's survey would fully automate Tier 1 work, and just 36% have an agent in production. Analysts' roles shift toward reviewing agent verdicts, approving actions and governing the agents.
