Loading...
Loading...
An agentic SOC is a security operations center where AI agents investigate an alert end to end, pivot on what they find, and reach a verdict, with no pre-written playbook of the kind SOAR requires. The model is the easy part: on Simbian's Cyber Defense Benchmark, the best of 25 frontier models scored 45.1% on MITRE ATT&CK coverage and none passed.
Eleven vendors publish a page explaining what an agentic SOC is (Simbian category review, September 2026). Read them back to back and they agree almost word for word: AI agents, reasoning over playbooks, triage at machine speed, humans set the guardrails. The definition is settled.
What is not settled is which part of an agentic SOC is difficult. Every one of those pages implies the answer is the agent. The measurement says otherwise.
An agentic SOC is a security operations center where AI agents plan an investigation, gather their own evidence, decide what to check next based on what they find, and produce a verdict, under policies the security team defines. The agent owns the work between the alert firing and the case closing. Vendors also market this as agentic AI SOC, or agentic AI in the SOC; the terms are used interchangeably.
Agentic SOC and SOAR differ in one place: what happens when an alert matches nothing anyone wrote a playbook for. SOAR stops and hands it to a human. An agentic SOC plans its own investigation and reaches a verdict anyway.
Against the rest of the category:
| Capability | Agentic SOC | SOAR | Copilot | Enrichment tool |
|---|---|---|---|---|
| Needs a playbook for the alert type | No | Yes | No | No |
| Closes an alert with no human in the loop | Yes | Only where a playbook covers it | No | No |
| Changes path mid-investigation | Yes | Only along branches written in advance | Only if re-prompted | No |
| What it hands you | A verdict | A completed script | An answer to your question | A decorated alert |
Agentic SOC models top out at 45.1% because defensive work has almost no gradeable training data. Offense grades itself: the question is "did you get in," the answer is yes or no, and anyone can manufacture unlimited attack data and label it. Defense has no equivalent. Nothing records which defensive action mattered.
Across 25 frontier models and 1,080 runs on the Cyber Defense Benchmark (Simbian, arXiv 2604.19533, August 2026), the highest-scoring model reached a 45.1% coverage score and none passed. Coverage score measures how much of a real attack a model investigates correctly, weighted across MITRE ATT&CK techniques.
Top 7 of 25 models tested. Source: Simbian Cyber Defense Benchmark, August 2026.
| Rank | Model | Provider | MITRE ATT&CK coverage score | Clears 50% bar? |
|---|---|---|---|---|
| 1 | Opus 5 | Anthropic | 45.1% | No |
| 2 | Opus 4.6 | Anthropic | 44.5% | No |
| 3 | Grok 4.6 | xAI | 41.3% | No |
| 4 | GPT 5.6 Sol | OpenAI | 41.0% | No |
| 5 | GPT 5.5 | OpenAI | 37.4% | No |
| 6 | Sonnet 4.6 | Anthropic | 36.9% | No |
| 7 | GLM 5.2 | Open-Weight | 35.0% | No |
Cut the same data per tactic and the picture holds: the leader clears 50% on 7 of the 13 MITRE tactics and fails 6. Zero models pass. Public offensive-security benchmarks, by contrast, are close to saturated, with frontier models routinely reported above 80% (Simbian, arXiv 2604.19533).
The asymmetry is not a quirk of one benchmark. The attacker's goal was never stated, reconnaissance and theft look identical at first, and every path the attacker abandoned leaves no record at all. Models are good at attacking because someone could grade the homework.
Every vendor on your shortlist starts from the same floor, because the frontier model is a component all of them can buy at list price. Whatever a product does above that floor is the only thing you are choosing between, and none of them will put it on a datasheet.
Both exist in the market, and a vendor-chosen demo alert will not tell you which one you are looking at. A real agentic SOC changes what it does next based on what it just found; a relabeled one runs the same sequence every time and calls the output a decision.
The difference shows up in the architecture. The common shape across the category is three fixed stages: the customer picks which integrations supply enrichment, a bundle of pre-selected evidence goes to the model, and customer-written rules flip the final verdict after the investigation has finished. The investigation itself is a closed box. You cannot influence direction, add evidence mid-flight, or change which systems get queried.
In the tiering every SOC manager thinks in, that three-stage pipeline is an L1 analyst. It follows the runbook and produces a consistent result. An L2 analyst pivots. They see a child process nobody expected, go look at the VPN logs, notice the authentication succeeded from a location that makes sense for that team, and change what they are investigating halfway through. The pivot is the job.
Ask a vendor to show you an investigation where the agent changed direction based on something it discovered, on an alert they did not pick in advance.
An agentic SOC learns an environment through context entries: plain-language statements of what is normal there, which the agent consults while an investigation is still running. One entry can cover a whole class of alerts; a whitelist needs a row per instance.
A global mobile-device manufacturer with a China-based subsidiary ran into a structural false-positive problem. Staff installed Chinese-language keyboard helpers that present to most endpoint tools exactly like keyloggers. The same machines sent traffic to China-based infrastructure as part of ordinary business. The endpoint product escalated constantly, and every escalation looked like a genuine compromise.
A deployment engineer added one line of context: the company is China-owned, Chinese keyboard software and China-bound traffic are normal here, look for other signals. Mid-investigation, the agent consults that line, deprioritizes the geography signal, keeps investigating everything else, and classifies correctly.
One context entry covered the whole pattern. The per-instance alternative would mean whitelisting every IP address and every keylogger variant, then whitelisting each new variant as it appeared, which is the SIEM-rule treadmill the team was trying to leave.
The same approach also builds patterns the agent writes for itself. At a different customer, a global manufacturer with APAC engineering teams running custom in-house applications, nearly every alert looked unique, so the team believed nearly every alert was real. The agent built a pattern profile across region, team, temporary-directory file paths, successful multi-factor authentication, absence of data movement, and registry changes consistent with the team's own tooling. After a couple of working sessions, the agent identified roughly 91% of alerts as false positives, with no analyst hand-feeding rules (Simbian production data, 2026).
What matters for evaluation is the edge of a known pattern. An alert matching the full profile closes automatically. An alert matching most of the profile but carrying something novel (a zero-day file, legitimate infrastructure behaving like command-and-control, evidence of social engineering) does not stop at the pattern match. It keeps digging. Static rule systems pick one behavior and commit to it.
Most agentic SOC products cannot. They triage the alerts that fire and never touch the reasons alerts stop firing, and roughly 20% of SOC detection rules stop firing within six months (Simbian, 2026). Coverage leaves through the detections nobody noticed breaking.
Ask about three repair surfaces by name:
Telemetry drifts, schemas change, tools get swapped, and none of it throws an error. A SIEM upgrade renames one field overnight, 40 detections go silent, and you find out at the audit. A threat-intelligence feed lapses and enrichment starts returning empty while verdicts keep shipping. An acquisition closes on a Friday and 3,000 endpoints run outside your logging until somebody wires them in.
An agentic SOC that only works the queue inherits every one of those silent failures. It will investigate a diminished stream of alerts, report excellent numbers, and the numbers will be true. The alerts it never received do not appear in any dashboard.
The product writes it and your security team approves it, not the vendor's roadmap. The agent that found a recurring blind spot drafts the fix, and a person on your team clicks yes or no before it takes effect.
Pointed at a query language it had never seen, Simbian's agent went from a 0% query success rate to 60–70% in two iterations, with no engineering tickets filed. Nobody wrote it a parser. It read its own failures and worked out the syntax.
That capability is also how you build a liability. An agent quietly rewriting its own instructions is one bad inference away from teaching itself something wrong about your environment, and nobody would notice for weeks. Security teams already sense this: only 29% say they can deploy agentic AI securely, according to Cisco's State of AI Security, 2026.
So Simbian's agent does not get to rewrite its own instructions unsupervised. Self-evolution proposals never auto-apply. Your team sees the proposal, the before-and-after difference, and a flag on anything that contradicts context you already approved. Then a person clicks yes or no. 95% of proposed actions get a yes from the customer's own team (Simbian production data, 2026). Their call, not ours.
The 5% is the more interesting number: that gap is where a specific environment differs from what the lab has modeled. Ask any vendor what happens to their 5%, and who reads it.
Evaluate an agentic SOC on five things a datasheet will not tell you: whether it pivots on evidence it discovered, whether one context entry covers a whole class of alerts, whether it keeps digging on an alert that matched a known false-positive pattern, whether it detects its own broken connectors, and who approved the last improvement it proposed. Every one is answerable live in a single session, on your own alerts:
None of the five is about the model. Every vendor calls the same frontier models; what surrounds them is the product. Ask Simbian the same five questions on one of your own alerts, and watch where the investigation goes when the evidence surprises it. Book a Demo.
Q: What is an agentic SOC? An agentic SOC is a security operations center where AI agents investigate an alert end to end and reach a verdict on it, under policies the security team sets, with no pre-written playbook for that alert type. The agent owns the case from the alert firing to the case closing.
Q: Is an agentic SOC the same as an autonomous SOC? They describe the same market category from different angles, and neither runs without people. Agentic emphasizes how the work gets done, by agents that reason and act. Autonomous emphasizes how little human involvement each case needs. In production, consequential actions still route through a human, and vendors claiming otherwise are describing a roadmap.
Q: How good are AI models at defensive security work? As of August 2026, across 25 models and 1,080 runs on Simbian's Cyber Defense Benchmark, the leading model reached a 45.1% coverage score. The pass bar is 50% on every MITRE tactic, and the leader cleared it on only 7 of 13. No model passed. Offensive benchmarks, by contrast, are near saturation, because attack training data can be generated and graded at scale while defensive data cannot.
Q: What is the difference between an agentic SOC and SOAR? SOAR executes a playbook a human wrote in advance, and stalls whenever an alert does not match a branch. In the SOAR migrations Simbian runs, teams are typically automating around 25% of alert volume before they switch. An agentic SOC plans its own investigation, pivots on evidence it finds mid-case, and reaches a verdict with no playbook for that alert type. SOAR automates the response you already scripted; an agentic SOC produces the decision that comes before it.
Q: How do you evaluate an agentic SOC? Make five demands, live, on your own alerts rather than the vendor's demo: show me a pivot on evidence the agent discovered, one context entry covering a whole class of alerts, an alert that matched a known false-positive pattern and kept investigating anyway, what happens when a connector breaks, and the last improvement the product proposed and who approved it.
Q: Does an agentic SOC replace SOC analysts? No. Triage moves to the agent, and the people who did triage move to supervising it, handling exceptions, and writing the judgment the agents run on. Containment authority stays with a human, because every buyer insists on it.
