Loading...
New
See what manual alert triage really costs your security team.
New
See what manual alert triage really costs your security team.
See what manual alert triage really costs your security team.
See what manual alert triage really costs your security team.
Loading...
An AI SOC maturity model measures how much of a SOC's work AI Agents do without human approval, across five levels set per action: manual, AI-assisted, agentic and gated, agentic and policy-bound, and autonomous SOC. On the October 2026 Cyber Defense Benchmark, no frontier model covers 50% of attack steps on credential access or lateral movement.
Many AI SOC maturity models give your whole SOC one number. That's the wrong unit of measurement. The question you have to answer is narrower: which actions can an Agent take at 3 a.m. without anyone approving them, and what evidence says it should?
Get that wrong in one direction and you have an expensive assistant waiting for a human who is asleep. Get it wrong in the other and an Agent that saw less than half of an attack is resetting credentials across your estate. On credential access, the best frontier model in the October 2026 Cyber Defense Benchmark we publish covers 37% of the attack's steps.
An AI SOC maturity model is a scale for how much of your security operations center's investigate-decide-act cycle you have handed to AI Agents, and how much a SOC analyst still approves. Call it a delegation score, set per action, that tells your board who decides what.
A classic SOC maturity model such as SOC-CMM sits alongside it and scores capability across business, people, process, technology, and services. The five SOC maturity levels below follow a shape common to vendor and research models. The right-hand column maps them to the four AI Agent autonomy levels Gartner published in May 2026. Gartner classifies whole AI Agents. Applying its levels to each action is our extension.
| Level | What the AI does | What your SOC team does | Closest Gartner level |
|---|---|---|---|
| 0. Manual or scripted | Nothing, or SOAR playbooks and security automation you wrote | Investigates and acts | none |
| 1. Assisted | Alert triage, enrichment, suggested next steps | Decides and acts | Observe / Advise |
| 2. Agentic, gated | Investigates to a verdict and proposes the response | Approves every action | Act with Approval |
| 3. Agentic, policy-bound | Acts alone on action classes you released, proposes the rest | Sets policy, reviews exceptions | Act with Approval and Act Autonomously, split by action |
| 4. Autonomous | Acts on everything inside guardrails | Reviews outcomes in aggregate | Act Autonomously |
An automated SOC built on SOAR playbooks and EDR prevention policies sits at Level 0 on this scale. It acts without approval, on rules you wrote, so the judgment is still yours. Vendor auto-remediation running at full automation is different. There the vendor's judgment acts without approval, so score those action classes as Level 3, or Level 4 if you review them only in aggregate, and hold them to the evidence test below.
Scored per action, Level 3 means the action runs without approval under a policy you wrote and can revoke. Level 4 means it runs without approval and you review it only in aggregate.
Adoption is running ahead of maturity. In the 2026 SANS AI Survey of 536 practitioners, just 27% called their AI deployment mature production. In the same survey, 63% reported significant AI shortcomings in threat detection and response, up from 45% a year earlier.
Agentic SOC is Levels 2 and 3, and autonomous SOC is Level 4. They are often sold as one category, but they differ on who approves. In an agentic SOC, AI Agents investigate alerts and propose or take responses, while your team decides which actions run unapproved. In an autonomous SOC, nobody approves individual actions and people review outcomes afterward.
| Feature | Agentic SOC (Levels 2–3) | Autonomous SOC (Level 4) |
|---|---|---|
| Who approves a response | Your team, per action or per action class | Nobody, per action |
| What the Agent does | Investigates, reaches a verdict, proposes or takes released actions | Acts on everything inside guardrails |
| What people review | Proposals and exceptions | Audit logs and aggregate outcomes |
| Main risk | Approval queues and fatigue | One error repeated at machine speed |
| Where it fits today | Most action types, gated by your team | Not a whole SOC, on current evidence |
An Agent running an alert investigation end to end in a demo is showing you Level 2 capability. Closing the case and disabling the account on its own is a Level 3 step, and it needs evidence of its own.
Yes, a SOC's maturity level differs by action, and treating the whole SOC as one level is the mistake Gartner now warns about. "Enterprises are treating AI agent governance as binary, either locked down or fully trusted, and that is the root cause of failure," Gartner Senior Director Analyst Shiva Varma said in May 2026.
In the same May 2026 press release, Gartner predicted that by 2027, 40% of enterprises will demote or decommission autonomous AI Agents because of governance gaps found only after production incidents.
In practice, one SOC's response actions sit at different maturity levels on the same day:
| Response action | Who approves it | Maturity level (0–4) |
|---|---|---|
| Close a known-benign phishing report | The Agent, with a written verdict | 3 |
| Isolate one employee laptop | The on-call analyst, in one click | 2 |
| Reset a service account's credentials | A named owner, after reviewing the evidence | 2 |
| Isolate a domain controller | A named owner, every time | 2, until you decide otherwise |
Mohsin and colleagues got there first. Their five-level SOC autonomy framework was published in ACM Transactions on Internet Technology in July 2026. It ties each level to task-specific trust thresholds, so autonomy changes with each task's complexity and risk. The table above takes it one step further: isolating a laptop and isolating a domain controller get different owners because the asset changes the risk, and a clinical workstation or an OT controller changes it more.
An AI SOC should act without approval only where the Agent has been shown to see most of the attack, on alert types you know, with a response you can reverse. Today that covers enrichment, alert scoring, read-only queries, and closing known-benign alerts. Account disables, credential resets, privilege changes, and multi-host isolation stay gated.
Isolating a single endpoint, where you can undo the isolation in minutes, is the first candidate to release, on evidence from your own alerts.
Simbian built the Cyber Defense Benchmark and sells an AI SOC, so weigh what follows with that in mind. The paper (arXiv 2604.19533) and the public attack datasets it draws on are open for anyone to check.
The benchmark runs frontier models through full attack chains across 105 procedures and 13 tactics, 1,418 runs in the October 2026 edition. Its coverage score is the share of each attack's steps a model backs with evidence. The pass bar is 50% on every tactic, a line we set and called "the minimum bar for unsupervised SOC deployment" when we first published the benchmark. None of the 32 frontier models clears 50% on every tactic.
Broken out by tactic, the results show where a bare model's picture of the attack is thinnest. A response built on a thin picture is the one most likely to be scoped wrong, so that's where gates should start. The right-hand column is our reading of the data.
| MITRE ATT&CK tactic | Best frontier-model coverage (October 2026) | Models reaching 50% coverage | Approval-gate recommendation |
|---|---|---|---|
| Credential Access | 37% | 0 of 32 | Keep credential resets and account actions gated |
| Lateral Movement | 38% | 0 of 32 | Keep multi-host isolation gated |
| Collection | 37% | 0 of 32 | Gate data-access revocations |
| Exfiltration | 32% | 0 of 32 | Gate egress blocks on production systems |
| Initial Access | 43% | 0 of 32 | Start host isolation gated, even on the first host |
| Defense Evasion | 57% | 7 of 32 | Most models still miss; lift only on your own evidence |
| Impact | 67% | 7 of 32 | Gate service shutdowns; most models still miss the bar, and a shutdown is hard to undo |
Credential theft, lateral movement, collection, and exfiltration are stages where a wrong response is hard to undo. They're also among the stages where even the best model sees the least of the attack, which is too little for a model to decide alone which accounts to reset or which hosts to cut off.
The benchmark also tests bare models with no vendor harness, hunting raw logs with no alert to start from. That's harder than triaging an alert. And it measures how much of the attack a model found, which is a separate question from whether a response was right.
Treat these per-tactic numbers as a floor for a bare model. A harness and your environment's context raise them, so ask any vendor, us included, to show you by how much on your own alerts before you lift a gate. Nobody yet knows how far the next generation of models will move them.
An AI SOC approval gate should lift only on evidence from your own alerts, covering shared inputs, agreement with your analysts, an approval record, a bounded blast radius, and a restore trigger. Gather it for one action class over a period long enough to catch once-a-month alerts, and agree the sample size with your risk team before you start.
Start where benchmarks say to be cautious, then let your approval history show where the Agent has earned more room. The joint guidance CISA and its US and international partners published in May 2026 is explicit about where to begin. Among its recommendations for organizations using agentic AI: "Begin with agentic AI use cases that are low-risk and non-sensitive."
Here is what each one means before an action class moves to Level 3:
Write the restore trigger first. A gate you can lift but never restore is a one-way door, and a new data source or a model change can arrive without anyone in the SOC noticing.
Human-in-the-loop, where analysts approve each AI action, is the right control at Level 2 of an AI SOC maturity model, but it caps your SOC at human throughput. As the queue grows, approvals stop being a control well before they stop being clicked.
Gartner's Varma makes the same warning about Agents that act with approval: without strong security testing, audit trails, and Agent-specific incident response, "approvals can degrade under time pressure or approval fatigue, creating a false sense of safety while expanding the attack surface."
CrowdStrike's 2026 Global Threat Report puts average eCrime breakout time at 29 minutes. An approval queue that clears in an hour can't defend a 29-minute window, however careful the reviewer.
Level 3 keeps the gate on credential resets and multi-host isolation while shrinking the queue toward that window. Release the routine action classes, such as closing known-benign alerts. The gated proposals that remain are then few enough for a reviewer to clear in time, and each one arrives with its evidence already assembled.
At Level 3 your team owns the policy. It says which action classes run without approval, for which assets and identities, on what evidence, and what brings a gate back. Simbian calls this human-in-control (the industry term is human-on-the-loop). You see every proposal and why the Agent made it, and you can tighten or lift gates whenever your risk changes.
To assess AI SOC maturity, score each response action separately on the Level 0–4 scale, then report how many actions sit at each level. A single SOC maturity score averages away the actions that carry the risk, such as credential resets and host isolation.
Step 3 is the hard one. Any action where you can't fill it in is your real maturity gap. Worse is an action already running at Level 3 with no evidence behind it, because its gate was lifted on faith.
Report the distribution to the board, such as six actions at Level 2, three at Level 3, and one still manual. Attach the evidence behind every lifted gate, so the board can see who decides what.
On Simbian, every customer starts at Level 2. Every action starts gated, including the credential resets and multi-host isolation the benchmark table argues for keeping gated. Your team decides which ones stop being gated, one action type at a time. Everything is audit-logged: every SIEM query, every observable, every decision and why.
The AI SOC Agent investigates every alert to a verdict and responds within minutes, on average under 4 minutes from detection to response. 95% of the responses it proposes are approved by the customer's own analysts. Their call, not ours. In the other 5%, we get context that makes the next response better.
Any approval rate can also hide fatigue, so watch how often your analysts edit a proposal before approving it. Every proposal arrives with its evidence, and the audit log keeps the reason behind each decision.
The same gate applies to what Simbian learns. When it finds a recurring blind spot in its own investigations, it writes the proposed skill change, and nothing is applied until a human approves it. Self-improving, not self-driving.
Q: What are the five levels of an AI SOC maturity model? Level 0 is manual or scripted operations. Level 1 is AI-assisted, where AI enriches and suggests while people decide. Level 2 is agentic with approval gates on every action. Level 3 is agentic and policy-bound, where Agents act alone on action classes you have released. Level 4 is an autonomous SOC that acts on everything within guardrails.
Q: How is an AI SOC maturity model different from SOC-CMM? SOC-CMM and similar SOC maturity models score capability across business, people, process, technology, and services. An AI SOC maturity model scores delegation: how much of investigation and response runs without a human approving each step. You need both, because a capable SOC can still hand an Agent the wrong authority.
Q: Which response actions should stay gated longest? Actions tied to credential access, lateral movement, and exfiltration, such as credential resets, multi-host isolation, and egress blocks. No frontier model reaches 50% coverage on those tactics in the October 2026 Cyber Defense Benchmark. Release low-risk, reversible actions first, such as closing known-benign alerts, and lift the rest one action class at a time on evidence from your own alerts.
Q: Can an AI SOC isolate a host without human approval? Yes, once your team has released that action class, and it should start with a single, reversible endpoint such as one employee laptop. Domain controllers, production servers, and multi-host isolation should stay gated, because no frontier model reaches 50% coverage on lateral movement in the October 2026 Cyber Defense Benchmark.
Q: What AI SOC maturity level is realistic today? Level 3, for narrow, reversible actions. A whole SOC at Level 4 isn't supported by current evidence: no frontier model passes every MITRE ATT&CK tactic in the October 2026 Cyber Defense Benchmark. Separately, only 27% of practitioners in the 2026 SANS AI Survey call their AI deployment mature production. The realistic goal is more actions at Level 3, each one earned.
When you have your ten actions written down, Book a Demo and we'll show you how each one starts gated, what it takes to lift a gate, and what puts it back.
