The AI SOC: What Autonomous Security Operations Can Do Today

A security operations centre (SOC) is the team that watches the alerts from a company's security tools and decides which ones are attacks. An AI SOC puts software agents on the first pass of that work. The agent investigates an alert and gives a verdict before a person opens the case. The sections below cover what those agents do as of early November 2026, what has been measured and by whom, where they fail and what to put in place first.

The argument for them is workload. In a survey of 300 SOC professionals that Omdia ran for Microsoft, published on 17 February 2026, an estimated 46% of alerts proved to be false positives and 42% went uninvestigated. Microsoft commissioned the survey. An earlier article here covers grouping related alerts into one incident before triage, so this one starts after that step.

What the agents do today

Investigating an alert and acting on the verdict are separate jobs, and the products treat them differently. The table gives what each vendor says its product does and the status stated on the date of its own page. Where a page gives no release stage, the table says so.

Microsoft's phishing agent shows the pattern. According to Microsoft's documentation, dated 2 July 2026, the agent resolves an alert that it judges to be a false alarm. When it judges an email to be malicious, the incident stays open for an analyst to investigate and act on.

What has been measured, and by whom

The vendors publish their own figures, and the method is often missing. Google's post of 9 June 2026 says its triage agent has investigated more than 5 million alerts and cut a typical 30 minute manual analysis to 60 seconds, with no method given. CrowdStrike's post of 13 February 2025 reports more than 98% agreement between its triage tool and the decisions of its own managed detection team. Agreement with the vendor's analysts is a weaker test than accuracy checked by an outside party. The same post claims more than 40 hours of manual work saved per week on average, a figure calculated by multiplying the alerts triaged by an estimated five minutes each. Neither post reports how often the tool wrongly closed a real attack.

Microsoft has described its own security team. A Microsoft security blog post of 9 April 2026 says agents tested internally "automate 75% of phishing and malware investigations" in live environments, under the supervision of its defenders. The post gives no method, and a result from one large company's own experts tells a smaller team little about what it would see.

Two studies do describe their methods. The Cloud Security Alliance released a study on 7 October 2025 in which 148 participants were randomly assigned to investigate two alerts with or without AI help. The assisted group finished 45% faster on the first alert and 61% faster on the second, and scored 22% and 29% higher on accuracy against model answers written by experts. The AI tool was Dropzone AI's product, and Dropzone supported the project. The release says Dropzone had no influence on the content, and readers should still treat the study as vendor-supported. It also tested people working with an AI tool, which is a different thing from an agent closing alerts alone.

The second is a paper by three Microsoft researchers, posted to arXiv on 5 November 2024. It found that adopting a generative AI tool was associated with a 30.13% reduction in the mean time to resolve security incidents. The authors state that unobserved factors prevent them from saying the tool caused the reduction.

The SANS 2026 SOC Survey, published on 15 June 2026, found that 79% of SOCs use AI or machine learning tools and that only 36% have built them into a defined SOC workflow. The rate of real attacks wrongly closed as false alarms is the number a security lead needs most, and you will have to measure it in your own environment.

Where the agents fall short

An agent can see an attack and still fail to raise it. Hugging Face's account of an intrusion into its systems, published on 27 July 2026, says its AI-based security agent stack correlated the alerts. The stack then "failed to correctly raise the alert's criticality and trigger the on-call team", which cost time in the response. The detection worked and the escalation did not, so test the paging path as carefully as you test the verdicts.

An agent also reads text that attackers write. Fields in a log such as a web address or a browser name are set by whoever sends the request, and an attacker can place instructions to the AI model in them. A preprint posted to arXiv on 23 May 2026 tested this against one model. One type of injected text suppressed 68% of malicious log entries when the classifier used a simple prompt. The strongest defence the authors tried lowered average injection success from 26.6% to 11.8% and did not remove it. The technical name is prompt injection, and our guide to agent security explains it.

The agent's own permissions are a target. Microsoft's Digital Defense Report 2026, published in October 2026, describes an attacker it calls Storm-2885 that compromised a highly privileged cloud identity, in a case uncovered in February 2026. The attacker used that identity to close alerts and resolve detections as false positives before the security team could respond. A triage agent holds a similar right. Microsoft's documentation lists permission to manage alerts among those its phishing agent needs, so give the agent a dedicated identity and protect it as you would an administrator account.

Approval by a person helps, and it can be bypassed. In the same report, Microsoft's red team says it has seen an approval step triggered and then ignored by an agent, and seen one bypassed by a policy stored in the agent's memory. The report notes that the decision to ask a person is often made by the same system an attacker can manipulate. Product limits matter as well. Google's documentation says its triage agent has no investigation queue, so alerts above its limit are not analysed automatically.

What must be in place first

Log coverage

An agent can only investigate what it can read. Google's documentation says its triage agent runs only on data ingested through Google's own SIEM, the system that collects security logs in one place. In the Omdia survey for Microsoft, only about 59% of security tools were reported to send their data to the SIEM. The event logging guidance that Australia's cyber security agency issued with CISA and other national agencies in August 2024 names four things to settle: an approved logging policy, central log access and correlation, secure storage with log integrity, and a detection strategy. Microsoft's 2026 report adds that detection needs baselines of normal activity, including service accounts, administrative jobs, VPN ranges and routine sign-in flows.

Playbooks

A playbook is the written procedure for one type of alert, covering what to check and what to do. Google's June 2026 post describes its preview automation feature as AI agents combined with deterministic playbooks, a design it says keeps analysts in control of high-impact actions. The UK National Cyber Security Centre, in a blog post of 21 September 2026, sets out five factors for judging the risk of an automated defensive action: potency, scope, criticality, rollout confidence and recoverability. In plain terms, ask what the action can change, how much of your estate it touches, how important that part is, how well you could test it beforehand and how quickly you can undo it.

Approval rules

Decide in writing which actions an agent may take alone and which wait for a person. Microsoft's Defender for Endpoint documentation describes semi-automation levels in which remediation waits for approval, and says a pending action times out after seven days and is then treated as rejected. That page recommends full automation. It also notes that from 1 September 2026 these automated investigations no longer run as a separate experience in Defender. The public sector section of Microsoft's 2026 report advises that low-risk steps such as alert enrichment run alone while isolating an account requires human approval. Both are Microsoft positions, one a product default and the other governance advice, and you have to set your own line. Given the bypasses described above, our advice is to enforce the approval in the workflow tool and outside the agent.

A record of agent actions

You need to be able to reconstruct what an agent did and why. Microsoft's documentation says the phishing agent's decisions and reasoning are shown as a decision tree in Defender and recorded in Microsoft Purview audit logs. Google's documentation explains how to audit its agent's investigations through Cloud audit logs. Microsoft also says the group that monitors the agent should hold equal or higher permissions than the agent. Our advice is to add a weekly routine on top of the log, in which an analyst checks a sample of the alerts the agent closed and reports the error rate with the other SOC measures.

Where QueryNow fits

QueryNow is a Microsoft partner that builds AI agents and the foundation enterprise AI runs on. For security teams on Microsoft 365 and Azure, that work includes the approval rules and audit records an agent needs before it is switched on. You can talk to our team about your own environment.