Security operations centres face more alerts than their analysts can read, and agentic AI looks like a natural answer. An agent can take an alert, gather context from logs and threat intelligence, form a hypothesis and propose a response, tasks that otherwise consume hours of analyst time. These capabilities are real and useful. They also come with limits that matter more in security than in most fields, because the environment is adversarial, the data is messy and mistakes can be costly. An agent that disables the wrong account or isolates a critical server can cause as much disruption as the incident it was meant to contain. A realistic assessment separates the tasks where agents add reliable value from those where they should assist, not decide.
Can an agent act without human oversight?
For high-stakes actions, the safe answer is no. Containment steps such as isolating hosts, blocking traffic or resetting credentials have business impact, and deciding whether to take them depends on context the agent may not see, such as an executive travelling or a production deployment in progress. Agents also make errors, and unlike a script, their mistakes are not always predictable. The usual design is graduated autonomy. Enrichment and summarisation run automatically, low-risk and reversible actions run with logging, and impactful steps require explicit approval with the agent's evidence attached. Clear accountability matters too, since an organisation must know who is responsible for a decision that an agent prepared.
Novel threats and manipulation
Agents built on language models generalise from patterns in their training and instructions, so they handle familiar attack types better than genuinely new ones. A custom intrusion that does not resemble known techniques may be explained away as normal behaviour or misclassified. Agents are also targets. An attacker can plant text in a log entry, email or web page that tries to steer the agent, a technique known as prompt injection, and an agent with broad tool access can be tricked into harmful actions. Defences include treating all retrieved content as untrusted, limiting tools to the minimum needed, separating instructions from data and monitoring the agent's own behaviour like that of any privileged account.
Prediction is harder than it sounds
Marketing often claims that AI can anticipate attacks. In practice, what it can do reliably is prioritise, by ranking vulnerabilities, assets and alerts by likely risk based on known patterns and context. Forecasting a specific future intrusion is much harder, because attackers adapt, base rates are low and labelled examples are scarce. Models can also produce false positives that waste analyst time, or false negatives that provide false comfort. Teams should evaluate agents on their own data, with measurements of precision, missed detections and time saved, and should keep a baseline of how human analysts perform. Claims that cannot be tested in the organisation's environment should be treated with caution.
Why it matters
Agentic AI is best treated as a capable assistant inside a controlled process. It can reduce toil, speed up investigation and improve consistency, provided its authority is limited, its inputs are treated as untrusted and its results are checked. Organisations that understand its limits will capture the benefits without adding a new, unsupervised source of risk to the systems they are trying to defend.
An agent that can contain an incident can also cause one. Give it authority in proportion to how well you can undo its mistakes.
