What Does an Autonomous SOC Look Like When Agents Run It?

Two analysts select an alert from one of your noisier detection rules. The activity is limited, and they don't see the technique often, so they triage it on instinct. It takes them two hours, and they close it as a false positive. Behind that alert, a Chinese APT group has been inside a customer's network for weeks, and the first people to say so are threat researchers at the security vendor.

In this episode of The Security Strategist podcast, host Richard Stiennon, Chief Research Analyst at IT-Harvest, speaks with Georges Bossert, Chief Technology and Product Officer and Co-Founder of Sekoia. They question whether the alert-driven SOC has a future, what a CEO should measure in the enterprise for cybersecurity, and how far autonomous security operations can go while still passing an audit under NIS2 and DORA.

The average e-crime breakout now takes 29 minutes, and the fastest on record took 27 seconds. Steinnon says the typical SOC leaves 28 per cent of its alerts uninvestigated, and one in four malicious breaches is now AI-enabled, at about $6 million per breach. To this number, Bossert said, "We've been continuously executing trade-offs and intuition-based security."

Workflows today have been deeply impacted by the decades of scarcity of experts in cybersecurity. “In a year, we’ll transition to a new dimension of security where enterprises will begin to grasp what is actually providing security rather than individual people,” says Bossert.

‘Hundreds of Agents’ Attacking Enterprises

Stiennon cites CrowdStrike's finding that AI-enabled adversary activity is up 89 per cent and asks whether the shift is in sophistication or in speed and volume. Bossert says both are transitioning. When a company is targeted now, he says, "we are targeted by hundreds of attackers or hundreds of agents", and those agents are more sophisticated than the average attacker used to be.

He then describes a case from Sekoia's own threat intelligence team. The researchers were tracking the infrastructure of a Chinese APT group when they found that one of Sekoia's customers was a target. They told the customer and shared the infrastructure details. Together they uncovered an intrusion that had been running for weeks.

The attackers had been extremely stealthy. Their techniques left a limited footprint, and they tripped only some of the customer's most sophisticated detection rules, or its noisier ones. The analysts who saw those alerts dismissed them as false positives. The activity was limited, the group was unfamiliar, and the triage was quick and based on intuition. It took two analysts working together for at least two hours.

Bossert says Sekoia replayed the case with AI agents in place of the intuition. "AI agents that are not tired" investigate systematically, he says, and the attack gets fully identified and highlighted. It requires "a strong investigation methodology that is executed on all the alerts, not just the most critical ones."

Why is AI Harness the Biggest Challenge?

With Anthropic abolishing its tier one and two SOC analysts by wiring AI into the process, Stiennon asks the Sekoia co-founder whether a large enterprise should build its own triage and investigation on existing models. 

Building an AI security agent demo is relatively easy, Bossert says. However, a reliable autonomous defence is "a completely different challenge". The hardest part is the AI harness: the system built around a frontier model. It has to use the enterprises’ own data and not only the generic data inside the model. The harness needs to plug into threat intelligence and into an execution layer so the agent can act, pull data while it reasons, and adapt its reasoning as it goes.

The learning system is another aspect that enterprises need to keep an eye on. Bossert wants each investigation to improve the enterprise’s posture and configuration. The learning loop is the most sophisticated part of today's agent architectures.

Why Analysts Need Training To Operate AI Agents?

Bossert predicted most cyber operations will be run by agents by the end of 2027. The IT-Harvest Chief Research Analyst poses the question of where the next generation of incident responders will come from if tier one SOC work disappears.

Bossert does not expect a 2027 without human expertise. Instead, he expects the year to be one without human execution. Essentially, junior hires will be trained to operate agents and not to run investigations by hand. With agents handling day-to-day execution, new hires can keep working at the methodology level.

The Sekoia Co-Founder leaves a message for CISOs towards the end of the episode. When an operation goes in the wrong direction, stop it, fix the methodology, and replay the operation. Do not step into the execution to patch it as it runs. 

"You don't play inside the loop, you play outside the loop," Bossert says. That’s the approach he adopted in recent months to keep pace with AI.

Key Takeaways

• The average e-crime breakout is 29 minutes; the fastest recorded is 27 seconds.
• Bossert's metric: the share of alerts that got a proper investigation.
• A proper investigation covers network, endpoint, and other domains, at speed.
• Large MSSPs still focus only on the top critical alerts.
• Sekoia researchers found a Chinese APT intrusion by tracking its infrastructure.
• Analysts dismissed the APT alerts as false positives after a quick triage.
• Replayed with AI agents, the same intrusion gets fully identified.
• A frontier model needs a harness, the company's own data and a learning loop.
• Bossert rejects a fixed list of decisions agents may never make.
• Rules of engagement set what agents and people may do on their own.
• Human on the loop governs the rules; human in the loop follows playbooks.
• When an operation goes wrong, fix the methodology and replay it.

Visit sekoia.com.