01 / DEFINITION
Agency means choosing the next useful step.
An agentic SOC uses goal-directed software agents to gather context, form and test hypotheses, select tools, make decisions and execute permitted response. The agent adapts its path to the evidence instead of following only a fixed sequence.
A chat assistant can explain an alert. An automated workflow can execute a known sequence. An agent can decide which query, source or action is needed next. That difference matters when evidence is partial, tools disagree or the attack does not resemble a predefined playbook.
Agency does not remove operational control. A security agent should have a named objective, bounded credentials, approved tools, explicit action rights and a record of every consequential step.
02 / FIVE CAPABILITIES
The loop must close.
Calling a feature agentic because it generates prose sets the bar too low. A useful security agent should be judged on the complete operating loop.
- 01
Observe
Read triggered signals and relevant state from identity, cloud, endpoint, network and business systems. Observation should be scoped to the active objective.
- 02
Investigate
Form hypotheses, choose queries and retrieve the evidence needed to support or reject each explanation.
- 03
Decide
Reach a verdict with confidence, impact and uncertainty stated. Check the proposed response against policy and current conditions.
- 04
Act
Execute a permitted action or route a complete approval request to a person. Observe whether the action produced the intended result.
- 05
Remember
Keep the evidence, tool calls, policy checks, approvals, action and outcome in a durable record that can be inspected later.
03 / LEVELS OF AGENCY
Not every use case needs the same freedom.
Agency should expand with proof. A team may begin with assistance, move to independent investigation and only then activate bounded response. The practical question is not whether the SOC is autonomous. It is which decisions are autonomous, under which conditions and with what evidence.
| Operating level | System responsibility | Human responsibility | Good fit |
|---|---|---|---|
| Assist | Summarize, retrieve and recommend | Direct each step and take action | Analyst productivity and unfamiliar cases |
| Investigate | Select tools, gather context and produce a supported verdict | Review the case and decide the response | High-volume triage and repeatable investigations |
| Approve to act | Investigate, propose a policy-checked action and assemble approval | Approve, modify or reject consequential actions | High-confidence cases with material business impact |
| Bounded autonomy | Investigate and execute pre-authorized, reversible actions | Set policy, supervise exceptions and review outcomes | Proven paths where delay carries more risk than action |
04 / CONTROL PLANE
Models reason. Policy grants authority.
The language model is one component of an agentic system. The control plane should remain independent of model preference. It decides what data may leave a boundary, which tools can be called, which actions are allowed and when approval is mandatory.
Identity
Every agent and tool call uses a known identity with least-privilege credentials and an attributable execution record.
Policy
Action rights reflect asset class, incident confidence, business impact, time, location and data sensitivity.
Approval
The operator receives the proposed action, supporting evidence, expected effect and policy reason in one decision request.
Observation
Tool calls, model routing, evidence access, decisions and outcomes are logged for security and assurance teams.
05 / THE VIRIAN MODEL
A living system, not a set of isolated bots.
Virian holds the current state of identities, assets and connections in view. Scope maintains that state. Hunt investigates the path behind a triggered signal. Strike evaluates policy and acts on the affected path. The incident record connects all three so evidence does not disappear when responsibility changes.
Know the environment
Current state gives the agent a grounded starting point and limits needless collection.
Pursue the evidence
Investigation changes as facts arrive, while sources remain linked to each claim.
Respect the boundary
Response is selected for the affected path, checked against policy and routed for approval when required.
Make it inspectable
Operators can review the evidence and controls behind the result, not only the final answer.
06 / BUYER QUESTIONS
Test the operating claim.
Agentic language is broad. These questions reveal whether a product can run a controlled security process or only add a conversational layer to existing work.
Where does the evidence come from?
Require source links, timestamps and tool results for material claims in the incident record.
Who grants action rights?
Confirm that authority is configured outside the model and can vary by asset, use case and impact.
What happens when tools disagree?
Look for hypothesis testing, stated uncertainty and escalation, not forced certainty or silent failure.
Can model and data placement change?
Check whether sensitive evidence and inference can stay inside the required operational boundary.
07 / CATEGORY SOURCES
How the market defines the agentic SOC.
- 01Google Cloud, Agentic SOCCATEGORY REFERENCE
- 02D3 Security, Agentic SOC platformCATEGORY REFERENCE
- 03Elastic SecurityHUMAN CONTROL REFERENCE
- 04Palo Alto Networks, Autonomous Security OperationsOPERATING MODEL