Weaving Agentic AI into the SOC: A Practical Playbook for Operationalizing and Scaling Autonomy
Weaving Agentic AI into the SOC: A Practical Playbook for Operationalizing and Scaling Autonomy.
Summary
Overview: Benjamin Spencer of Optiv joins an ISMG session on weaving agentic AI into the SOC, sharing practical lessons from MDR operations and SOAR modernization efforts.
Key Topics: Where autonomous agents add measurable SOC value versus where they don't; guardrails for safe AI deployment; organizational hurdles from pilot to production; and avoiding treating AI as upgraded SOAR without engineering.
Technical Details: Spencer shares war stories from Optiv's attempt to operationalize agentic AI in detection and response workflows, emphasizing that AI agents require the same rigorous engineering as traditional SOAR playbooks, not less.
Takeaways: Agentic AI in SOCs needs deliberate engineering and guardrails, not just vendor promises. Teams should identify specific high-value triage tasks rather than attempting full autonomy replacement.
Related talks
AUSCERT·41 min
Rarely Complains
Project Kitsune: The Agentic AI SOC Analyst That Never Sleeps (and Rarely Complains).
AUSCERT·38 min
Corien Vermaak
The Evolution of AI/ML in the Security Operation Centre SOC.
BSidesCharm·23 min
Keyur Rajyaguru
2025 - AI Agents Could Be Running Your SOC To Prevent Cyber Attacks.