Agentic AI in IT security: Where expectations meet reality

Agentic AI has quickly shifted from lab demos to real-world security operations centers (SOC) deployments. Unlike traditional automation scripts, autonomous software agents are designed to act on signals and execute security workflows intelligently, correlating logs, enriching alerts, and even take first-line containment actions.

For some security leaders, the value of agentic AI in the SOC is obvious: freeing analysts from endless triage and scaling response capacity in the face of overwhelming alert volume. For others, the risks of opaque decision-making, integration complexity, and spiraling costs loom large.

To get a clear view of where the technology stands today, we spoke with security executives, product leaders, and researchers who are piloting, deploying, or advising on agentic AI for cybersecurity. Their perspectives highlight what agents do well — and where they stumble — as well as the organizational changes, pricing experiments, and governance models that will shape whether agentic AI becomes a staple of IT security or a short-lived trend.

What agentic AI is (and isn’t) good at

Agentic AI has carved out a niche performing tasks typically handled by tier one security analysts. Instead of simply flagging behavior to be reviewed, agent-based systems “handle first-level tasks, like triaging alerts, correlating signals across tools, and in some cases even taking steps to contain a threat, like isolating an endpoint, allowing analysts to focus on other strategic and more important tasks,” says Jonathan Garini, CEO and enterprise AI strategist at fifthelement.ai.

Vinod Goje, a data-driven solutions and applied AI expert, notes that in an SOC environment, AI agents operate “much like digital tier-one analysts, sifting through data, gathering contextual information, and even producing detailed reports on their activities.” Goje points to practical uses of AI agents in malware examination, script deobfuscation, and coordinating tools.

Itay Glick, VP of products at OPSWAT, adds that agents “are good at the ‘first 15 minutes’ with pulling context, checking threat intel, summarizing logs, and proposing actions for review.” They also help with exposure management by prioritizing vulnerabilities and with hygiene tasks like spotting stale accounts.

Dipto Chakravarty, chief product and technology officer at Black Duck, notes that AI agents reduce alert fatigue by clustering alert patterns and correlating them with threat intel feeds, while natural language processing (NLP)-driven tools summarize alerts at scale.