AI agents in the SOC: automation with a human hand on the wheel
AI agents in security operations centers are software-driven assistants that continuously triage alerts, investigate threats, enforce policies, and generate reports, automating repetitive security workflows while keeping humans in charge of approvals, oversight, and strategic decision-making. Security leaders who fear that SOC automation agents will replace analysts are missing the point: the most interesting AI security operations work is about scaling human judgment, not removing it. Intezer’s AI SOC already shows what this looks like in practice, with autonomous agents triaging, investigating, and responding to alerts 24/7, covering 100 percent of alerts and escalating fewer than 2 percent for human review. That is not a pink slip for analysts; it is a signal that the grunt work of threat detection automation is finally becoming machine territory, freeing people to handle what they are uniquely good at.
Intezer’s Custom Agents: giving your SOC its own AI staff
Intezer’s launch of Custom Agents makes the shift unmistakable: SOC teams are expected to think like managers of AI staff, not button-pushers for tools. Instead of relying on brittle playbooks or one-off scripts, teams can build their own AI agents directly inside the platform to automate investigation work, report generation, and other recurring SOC routines unique to their environment. The model is clear: autonomous agents do the security work, humans supervise it.
The practical impact on security team efficiency is immediate. Security teams can no longer rely on manual alert handling or scattered automation to keep up with modern threats. With Custom Agents created in natural language—defining what to do, when to run, and which tools to use—routine tasks like writing custom incident reports, tuning rules based on triage verdicts, or proactive threat hunting become background processes instead of daily distractions. Analysts stop retyping the same shift handoff notes and start asking, “What else can we delegate?”
Cequence Platform 9.0: AI-native API security without losing control
On the API front, Cequence Platform 9.0 takes a similar stance: build an AI-native system that automation can drive, but keep humans approving every change. This release is not a chatbot bolted onto an old UI; it exposes the entire platform through an open Model Context Protocol (MCP) server so any MCP-capable agent, SOAR platform, or automation workflow can interact with it, configure it, and pull insights through a consistent API contract. The UI becomes optional, and that is the point: AI security operations are moving from point-and-click to agent-to-platform conversations.
For ordinary users, the experience is deliberately simple. With Platform 9.0, any practitioner can open a conversation and start asking the questions they care about without knowing the interface or how the product works; the platform finds the answers. The built-in AI Assistant can classify APIs, identify risks, draft rules, and create reports using plain language, while a “human in the loop” design ensures all write actions require explicit approval and show the exact change before anything happens. That is how you get threat detection automation at enterprise scale without surrendering control.
Compliance and scale: where AI agents quietly win
The less glamorous but very real pressure behind this wave is compliance and scale. Agentic AI is transforming how enterprises interact with customers, and internal IT teams are adopting AI agents faster than their security tools can keep up. Meanwhile, security teams cannot keep manually reconciling API risks with sprawling regulatory demands. Cequence’s answer in Platform 9.0 is to ship 250+ pre-built risk rules—more than four times the previous version—mapped to 25 global compliance frameworks. According to Cequence, the platform “ships the rules, frameworks, and reports to make customers audit-ready immediately,” removing the need for professional services or custom rule development.
This is the kind of background work AI agents are good at: continuous compliance checks, one-click audit-ready reports built from live data, and observe modes to test new rules without flooding teams with findings. When you combine that with a re-architected API security engine built for massive endpoint counts and lower compute costs, you get quiet but meaningful gains in security team efficiency: fewer spreadsheets, fewer late-night report rewrites, more time for design-level risk decisions.
The new SOC contract: delegate the work, not the responsibility
The pattern across Intezer and Cequence is clear: SOC automation agents are becoming first-class operators, but the accountability line has not moved. Intezer’s platform investigates every alert while escalating fewer than 2 percent to humans, yet its core approach is explicit that autonomous agents do the work and humans supervise it. Cequence’s MCP-based, AI-native platform design assumes agents will drive most actions, while a governance-first, human-in-the-loop model keeps people in charge of approvals and reasoning transparency.
If you run a SOC and keep your analysts stuck in repetitive triage, that is now a choice, not a constraint. SOC teams can delegate routine investigation and remediation tasks to AI agents and reclaim their time for strategic security decisions—from threat modeling and architecture reviews to purple teaming and policy design. Custom agent capabilities reduce the manual SOC workload while maintaining visibility and human control over critical security decisions. The new job description is emerging: not “alert firefighter,” but “AI-enabled defender,” responsible for deciding what should be automated, what must remain human, and how to keep that balance honest as the agentic era accelerates.
