- Home
- AI agents
- Enterprise AI agent examples
- Security operations
Plan · Enterprise AI agent examples
AI agents in security operations: what SOC teams report and the controls they need
A security operations agent investigates alerts the way an analyst would: it pulls the related logs from the SIEM, endpoint, identity and cloud tools, correlates them, reaches a verdict with the evidence and, where a playbook allows, starts containment. Analysts review critical findings and own every response outside the playbook.
In this guide: 83 pages
Key takeaways
- eSentire publishes detailed figures: more than 120,000 autonomous investigations in 12 months, averaging 6 minutes and 44 tool calls each, with verdicts matching senior analysts more than 90% of the time across more than 500 adjudicated outcomes, as Anthropic reports.
- The other published examples mostly assist analysts. Deloitte and Vertiv report faster hunts and investigations on Google Security Operations, BBVA claims highly automated responses without describing their scope, and the Municipality of Breda counts 717 incidents summarized with Security Copilot.
- A security agent reads attacker-controlled text all day: log lines, email bodies, file names. Everything it reads is data, and it acts only through pre-approved playbooks.
- Agreement with senior analysts on adjudicated cases is the number to measure before you widen autonomy, alert type by alert type.
What do AI agents do in security operations?
They investigate alerts end to end, hunt across large log volumes, draft detection rules, summarize incidents and explain scripts, and in a few deployments start containment through playbooks. Most published uses assist an analyst; one runs investigations on its own.
Security operations tasks by what the agent is allowed to do. "Assists" means it drafts, searches or summarizes and an analyst acts; "acts" means it runs the investigation or a response itself.
| Task | Level | What it touches, and the control we add | Seen in |
|---|---|---|---|
| Autonomous threat investigation across endpoint, identity, network and cloud signals | Acts | Read access to the telemetry; senior analysts review critical findings; we add playbooks for any containment | eSentire |
| Threat hunting across large log volumes | Assists | SIEM search; an analyst runs and judges the hunt | Deloitte, Vertiv |
| Writing detection rules | Assists | Rule drafts an engineer tests and deploys | Deloitte |
| Detect, investigate and respond with automated responses | Acts | Security Operations playbooks; the scope is not described | BBVA |
| Alert summaries, script explanations and guided triage | Assists | Incident data; an analyst decides each step | Municipality of Breda |
eSentire is the one example in this set that describes autonomous investigation in detail. It is a managed detection and response provider, so its agents protect its customers, and senior analysts stay in the loop for critical findings.
What have security teams published about AI agents?
Five organizations publish figures or counts, all through the vendor whose platform they use. eSentire describes its method in detail; the Google entries are one or two sentences in a roundup. Read each as the publisher’s claim.
Publicly reported security operations agents, as published by each source and opened on 2 November 2026. None of these organizations is a QueryNow client.
| Organization | What the agent does | Published figure | Source and date | How to read it |
|---|---|---|---|---|
| eSentire | A multi-agent system in its Atlas platform investigates threats on its own, correlating endpoint, identity, network and cloud signals to judge intent and contain attacks | More than 120,000 autonomous investigations in 12 months, averaging 44 tool calls and 6 minutes; verdicts align with senior analysts over 90% of the time across 500+ adjudicated outcomes; confirmed attacks per customer up 41% while alert volume fell 11% | Anthropic customer story, undated, read 2 November 2026 | eSentire’s figures as Anthropic publishes them; the 6 minutes is set against an industry dwell-time median, with no earlier eSentire time given |
| Deloitte | Gemini in Google Security Operations supports threat hunting and detection rule writing | Analyst efficiency up more than 60%; hunts across billions of logs from hours to seconds; detection rules in moments rather than weeks | Google Cloud use-case list, updated 22 April 2026 | Google’s wording in a roundup entry; Deloitte is also a Google Cloud partner |
| Vertiv | AI-powered Google Security Operations for detection and investigation | Three times the cyber events detected; investigations closed 50% faster | Google Cloud use-case list, updated 22 April 2026 | Google’s wording; no baseline |
| BBVA | AI in Google Security Operations to detect, investigate and respond, with highly automated responses | Critical security data in seconds where it used to take minutes or hours; no percentages | Google Cloud use-case list, updated 22 April 2026 | The scope of automated response is not described |
| Municipality of Breda | Security Copilot summarizes complex alerts, explains scripts in plain language and guides triage and remediation | Help with 717 incidents since April 2024 | Microsoft customer story, 26 June 2025 | A count from an analyst’s quote |
Lloyds Banking Group appears in Google’s list with a security operations transformation that moved more than 40% of engineering capacity to proactive threat hunting, but the entry does not say agents did the work, so it stays out. Attackers use agents too: Anthropic reported in November 2025 that a group it assesses as Chinese state-sponsored used Claude Code against about 30 targets, with AI doing 80% to 90% of the work and succeeding in a small number of cases.
What controls does a security operations agent need?
A security agent needs broad read access to investigate, so the controls narrow what it can change, check what it concludes and protect it from the text it reads. We set the five below before it touches a production alert queue.
- Separate reading from acting. Give the agent read access across the telemetry an investigation needs, and route every response action, such as isolating a host or disabling an account, through a playbook with its own approval rule.
- Injection defence. Log lines, email bodies, file names and web pages can carry instructions an attacker wrote. Keep tool output marked as data, stop the agent from following links or running content it finds, and red-team it with planted instructions before release.
- Analyst review. Senior analysts review critical findings and a sample of benign verdicts, as eSentire describes. A true positive closed as benign is the failure that costs most.
- Agreement rate. Measure how often the agent’s verdict matches the analyst’s on adjudicated cases, by alert type, and widen autonomy only where agreement holds.
- Own identity and logs. The agent runs under a dedicated identity whose actions are logged, so its activity can be told apart from an attacker using a stolen analyst account.
Two failure modes deserve a test of their own. An agent can close alerts as benign because the evidence it gathered was incomplete, for example while a log source was down, and that looks efficient until an incident review finds the miss; make it state which sources it checked. And an agent asked to summarize an attacker’s script can be steered by comments inside that script, so the summary needs the same injection test as the investigation.
Where should a SOC start with AI agents?
Start with investigation and summaries for one high-volume alert type, with the agent reading and the analyst deciding. Add playbook-driven containment only once you know the agreement rate.
- Pick an alert type with high volume and a known investigation path, such as suspicious sign-ins or reported phishing.
- Let the agent investigate and write a verdict with evidence for every alert of that type, while analysts work the same alerts as before.
- Compare verdicts for a month and record agreement, misses and false escalations.
- Let the agent close benign alerts of that type where agreement is high, with a weekly sample review.
- Add one containment playbook, such as isolating a workstation, with an approval rule and a rollback step.
How do Microsoft, AWS and Google implement it?
Where the published security agents ran, and what each cloud offers to protect agents themselves, with statuses as the vendor pages showed on 2 November 2026.
Capability, Microsoft, AWS, Google
| Capability | Microsoft | AWS | |
|---|---|---|---|
| Security operations with AI | Microsoft Security Copilot, used by the Municipality of Breda | eSentire runs Claude on Amazon Bedrock with the Claude Agent SDK | Google Security Operations with Gemini, used by Deloitte, Vertiv and BBVA |
| Protection for agents and AI services | Defender for Cloud threat protection for AI services (GA) | AgentCore Policy at the Gateway (GA 3 March 2026) | Model Armor on Google Cloud MCP servers (GA 22 April 2026) |
| Identity for the agent | Microsoft Entra Agent ID (GA 1 May 2026) | AgentCore Identity workload identities | Agent Identity (SPIFFE-based); API in preview since 18 June 2026 |
We could not confirm the current status of Microsoft Security Copilot’s agents at a primary source, so the table names the product without a status.
Frequently asked questions
Can an AI agent investigate security alerts on its own?
eSentire reports that its agents ran more than 120,000 investigations on their own in 12 months, with verdicts matching senior analysts more than 90% of the time on over 500 adjudicated cases. Senior analysts still review critical findings.
Should a SOC agent be allowed to contain threats?
Only through playbooks you already trust, one action at a time, with an approval rule and a rollback. Isolating a workstation is a common first playbook; disabling an executive’s account is a poor one to automate first.
How do attackers target security agents?
Through the text the agent reads. A log line, an email or a file name can carry instructions, so the agent must treat its inputs as data and act only through defined tools. Red-team it with planted instructions in alerts before release.
Which alerts should a SOC agent never close on its own?
Alerts on privileged accounts, on executives and on systems in a regulator’s scope, and any alert where a data source the investigation needs was unavailable. Keep those with an analyst even after agreement rates rise for other alert types.
How do you measure a security operations agent?
Use agreement with analysts on adjudicated cases, time to verdict, the share of alerts closed without an analyst, and missed true positives found later. eSentire publishes agreement and detection figures, which is the shape a SOC leader can check.
More in Enterprise AI agent examples
Sources
Each source was read on 2 November 2026. The date shown is the date on the page, or the page’s ms.date for Microsoft Learn; an undated page shows the date it was read.
- How eSentire runs expert-level threat investigations at scale with Claude
- 1,302 real-world gen AI use cases from the world’s leading organizations
- Municipality of Breda customer story (Microsoft Copilot and Security Copilot)
- Disrupting the first reported AI-orchestrated cyber espionage campaign
- Threat protection for AI services (Defender for Cloud)
- Policy for Amazon Bedrock AgentCore is now generally available
- Model Armor release notes
- Gemini Enterprise Agent Platform release notes
- What’s new in Microsoft Entra Agent ID
- Amazon Bedrock AgentCore key features and benefits
- Agent Identity overview
Planning an AI program?
Talk to the team that builds it and runs it after launch.
- Built to SOC 2, HIPAA and GDPR standards
- EU AI Act-aligned delivery
- Microsoft Solutions Partner