Security teams have heard the promise before. Automation was going to fix the SOC. Then SOAR. Then ML. Then copilots. Now agentic AI.
Some of those helped. SOAR made repeatable work faster. ML improved detection and scoring. Copilots made analysts more productive. None of that should be dismissed. But alert triage is still broken — because those systems could execute logic without thinking during the investigation. Agentic triage moves the reasoning inside the investigation itself. That's the shift.
The old model worked when the path was known
SOAR and playbooks shine when the next step is predictable: pull this field, run this enrichment, check this reputation source, open this ticket. Real investigations don't always work that way. A login looks suspicious only after you check the user's history. A command-line alert looks noisy until one parameter changes its meaning. A benign-looking alert becomes interesting when you connect it to a recent phishing event or an unfamiliar device.
A static playbook has to pre-commit to the path. Earlier ML could score and classify, but it rarely ran the investigation. Copilots improved the analyst's experience, but the human still had to drive.
Older automation was think, act, stop. Agentic triage is think, act, look again, act again. That loop is where the investigation gets better.
Runtime intelligence is the change
A playbook follows the path someone wrote. Agentic triage can change the path when the evidence changes. Three things had to come together for that to work:
- Models got better at reasoning — at connecting evidence, interpreting commands, and working through ambiguous signals.
- Agents can use tools — they query connected systems, pull enterprise context, and inspect evidence instead of relying only on what the model knows.
- Context engineering became practical — the right context can be brought into the investigation at the right moment, without hard-coding every branch.
Together, those put intelligence inside the investigation loop. The agent asks: what else do I need to know? What's missing? What would change the conclusion? Which system should I query next?
The knowledge barrier has changed
Security judgment has always lived in the heads of experienced analysts — the ones who remember the strange command parameter and recognize when something smells wrong. Most teams don't have enough of those people, and even when they do, they can't apply that attention to every alert.
Modern models change the economics. The kind of knowledge that used to take years to build is now far more accessible through models and APIs. The model doesn't know everything, and it will make mistakes — but the investigation can bring far more security knowledge to bear than most teams could realistically staff for every alert.
A ClickFix example, concretely
In one investigation, our AI analyst Darryl saw a partial PowerShell command and connected its parameters to ClickFix-style attack behavior — combining what was in the alert with broader security knowledge and follow-up checks. A static playbook would have parsed the command, extracted a few fields, checked reputation, and followed a predefined path. A human might have caught it — if they'd seen the pattern before, and if they weren't sitting on 150 other alerts.
Darryl drew the connection between evidence and attack pattern, then used it to guide the next step. That's much closer to what a good human analyst does — and exactly the long-tail knowledge most teams can't count on every analyst remembering, every time, under pressure.
Is AI "good enough"? It depends on the benchmark
Skeptics will say it won't beat their best analyst. Maybe not — at least not on every investigation. But that's the wrong benchmark. Only a tiny fraction of organizations can afford an elite analyst who deeply investigates every alert. For everyone else, the useful comparison is AI against the realistic alternative: a lean team overwhelmed by volume, with no practical way to investigate everything manually.
Good enough means the system can handle a meaningful share of high-volume investigation work — deeply enough, quickly enough, and transparently enough to be tested against real analyst workflows.
Human accountability is the operating model
A great chef doesn't cook every dish, but samples enough to know the kitchen is producing quality. SOC leaders already work this way — they review a new analyst's work, inspect the conclusions, ask what evidence was used, and correct mistakes over time.
Agentic triage doesn't remove human accountability; it changes where humans add value. AI should do the investigation work it can handle at scale. Humans provide QA, context, judgment, and accountability. Models drift, integrations fail, every environment differs — someone has to verify investigation quality before the organization relies on it. AI analysts should earn trust the same way people do: review the work, question the conclusion, inspect the evidence, feed corrections back. Trust, but verify.
Take the ride
Reading about autonomous driving isn't the same as sitting in a Waymo. Before your first ride, claims sound like claims. After it, the questions change — did it work, did it make safe decisions, would I do it again? Agentic triage needs the same moment.
Fast from AirMDR lets you test it directly. Run an investigation. Inspect the evidence. Question the reasoning. Compare it to the alerts your team never gets to. Don't believe another claim — look at the work.