CISOs weigh the risks and rewards of handing threat response to AI agents

Security operations centers face a mounting dilemma: alert volume keeps growing, but analyst capacity doesn't. AI agents offer a tantalizing solution—machines that can autonomously investigate suspicious signals, correlate data across systems, and recommend action. Yet this shift from AI-assisted to AI-driven security raises a critical question: how much control should organizations actually surrender?

The autonomy question#

The distinction between AI assistance and autonomy matters enormously in practice. Asking an agent to flag and investigate a suspicious login is one thing; empowering it to disable accounts, isolate endpoints, or block network traffic is quite another. Autonomous decisions at scale could dramatically accelerate response times, but they also introduce the risk of widespread operational disruption if an agent misfires.

Trust in these systems extends beyond model accuracy. Security teams must maintain visibility into agent actions, enforce clear boundaries on what humans must approve, and retain the ability to reverse bad decisions. Some organizations may need hard limits on autonomy—including kill-switch protocols—to stay comfortable with delegation.

Reshaping the SOC analyst role#

As AI takes on routine investigation work, the security analyst's job transforms from purely reactive investigator to orchestrator and strategist. With queues handled more efficiently, teams could redirect time toward threat hunting, complex judgment calls, and oversight of the agents doing repetitive work. This represents a fundamental shift in how security operations function.

The longer-term vision extends beyond individual tool upgrades. AI-driven "continuous detection and response" could blur the lines between detection, investigation, and response phases—allowing agents to learn from one investigation and apply those insights immediately to the next threat. That's not simply AI layered onto existing SOC structures; it's a new operating model.

Managing the tooling challenge#

Vendors are racing to embed AI and agent capabilities into existing security platforms, but organizations face a familiar trap: another sprawling stack to manage. The promise is a seamless continuous system; the risk is ending up with disconnected products requiring yet more operational overhead.

On September 15, security leaders will gather for The New Stack's AI-Speed SOC CISO Roundtable to explore these tensions with peers including deputy CISOs and product leaders from major security vendors. As attackers gain access to AI-accelerated tactics, the question of how—and how much—to automate defense has become urgent.