The Analyst Stays in the Loop

At 02:14 on a Tuesday, the triage agent in a mid-sized SOC closes an alert. The CFO's account signed in from Lisbon forty minutes after signing in from Chicago. The agent checks the usual things: the Lisbon IP belongs to a commercial VPN the company has seen before, the session carried a valid MFA claim, the device fingerprint matches a known laptop, and nothing in the session touched sensitive file shares. Verdict: benign, probably travel plus VPN. Confidence 0.91. Ticket closed.

Every individual check was correct. The verdict may still be wrong, and the agent had no way to know it.

The analyst who reads the overnight summary at 08:00 knows two things that are not in any log source. The CFO is not travelling this week. And the company is three weeks from announcing an acquisition, which is precisely the kind of moment when a quiet, well-credentialed intruder is worth a great deal to someone. She reopens the ticket.

That gap, between what the data says and what the data means for this organisation right now, is the subject of this post.

What the agents are genuinely good at

I want to be fair to the tooling, because the honest case for human judgment does not depend on pretending AI is weak.

Triage agents in 2026 are very good at the mechanical half of the job. They enrich an alert with asset ownership, threat intel, and prior tickets in seconds, and they cluster a hundred noisy detections into the four that share a root cause. Nobody should want to go back.

The same is true further up the stack. In November 2024 Google's Project Zero described how its Big Sleep agent found an exploitable stack buffer underflow in SQLite during variant analysis of a recent commit, and the bug was fixed the same day it was reported, before it ever shipped in an official release. That is an impressive result. It is also worth reading how the researchers framed it: they called the results "highly experimental" and said a target-specific fuzzer would likely be at least as effective.

So the question is not whether agents should triage. They should. The question is which decisions they should be allowed to finalise.

Four things the alert does not contain

Context that lives in people's heads

The Lisbon login looked normal against the data the agent could query. It looked abnormal against the calendar, the deal pipeline, and a conversation in the hallway last week. Some of that context can be fed to an agent. Much of it never reaches a system of record. Analysts carry an informal model of the business: who is on leave, which vendor just got a new admin, which team is mid-migration and therefore noisy. That model is incomplete and sometimes wrong, but it is the thing that turns "anomalous" into "concerning".

Business risk is a judgment, not a field

NIST's Cybersecurity Framework 2.0, released on 26 February 2024, added a sixth function, Govern, to the original five (Identify, Protect, Detect, Respond, Recover). Its Organizational Context category opens with GV.OC-01: "The organizational mission is understood and informs cybersecurity risk management." Its Risk Management Strategy category asks organisations to establish and communicate risk appetite and risk tolerance statements.

Read that as an operations requirement and it becomes concrete. The same credential-stuffing burst is a nuisance against a marketing microsite and a board-level incident against the payments API. A model can be told which assets are "critical", but criticality shifts with the quarter. Somebody has to own the mapping from technical event to business consequence, and Govern is NIST's way of saying that somebody should be named.

Attacker intent is inferred, not observed

MITRE describes ATT&CK as "a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations." It is the shared vocabulary of detection engineering, and agents use it well. An agent will correctly tag the Lisbon session as T1078, Valid Accounts.

What ATT&CK cannot tell you is why. Valid Accounts is the technique behind a bored contractor reusing a password, a ransomware affiliate staging access, and a state actor who wants the deal terms and will never deploy anything noisy. The technique is the same. The response is completely different: reset and move on, isolate and hunt, or call legal and quietly widen monitoring without tipping off the intruder. Choosing among those requires a theory of the adversary, and a theory of the adversary is built from campaign reporting, sector chatter, and the analyst's sense of what is worth stealing here.

Accountability has to land on someone

GV.RR-01 in CSF 2.0 reads: "Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving." An agent cannot be accountable in that sense. It cannot explain itself to a regulator, testify about a disclosure timeline, or accept the consequences of a wrong call. If an AI closes a ticket that later turns out to be the initial access for a breach, the post-incident review will ask which human approved the policy that let it do so. The answer should be a written decision, not "the vendor default".

The breach data still points at people

The Verizon 2026 Data Breach Investigations Report, its 19th edition, published on 19 May 2026, analysed more than 31,000 incidents, of which more than 22,000 were confirmed breaches. The human element was present in 62% of breaches, a slight increase from the previous year's 60%.

Two other findings from that edition matter here. Vulnerability exploitation overtook stolen credentials as the most common initial access vector for the first time in the report's history, at 31% of breaches, and Verizon says threat actors are using AI to shorten the time to exploit known flaws. Breaches involving a third party rose to 48%. Verizon also reported that frequent employee use of AI tools jumped from 15% to 45% in a single year.

The picture is not "machines versus machines". Attackers automate to move faster, and incidents still run through human decisions: someone approved the vendor, someone clicked, someone wired an AI tool into a workflow.

A working division of labour

Here is a model that holds up. It mostly writes down what used to be implicit.

Agents decide, humans audit. Closing duplicates, enriching, suppressing known-benign patterns, and grouping related alerts. Sample a fixed percentage of auto-closed tickets every week and track the miss rate like any other control.

Agents recommend, humans decide. Anything touching identities with privileged access, executives, regulated data, or systems named in the current business priorities. The agent drafts the analysis and the proposed action. A named person approves.

Humans only. Declaring an incident, notifying customers or regulators, engaging law enforcement, and any containment that will visibly disrupt the business. These carry legal and reputational weight that has to sit with a person.

Three notes make this work:

1. Feed the agent context on purpose. Travel calendars, change windows, and a short "current sensitivities" list maintained by the security lead will prevent a surprising number of bad closes.
2. Make the agent show its work. A verdict without the evidence chain cannot be audited. Require the summary to list what was checked and what was not available.
3. Keep analysts doing real investigations. If juniors only ever review machine verdicts, you will not have seniors in five years. Rotate people through hands-on hunts.

Why this does not go away

Bruce Schneier, writing on his blog in August 2025 about prompt injection against AI assistants, put it bluntly: "We have zero agentic AI systems that are secure against these attacks." That matters for the SOC too. A triage agent reads attacker-controlled content all day: email bodies, file names, user-agent strings, log lines. Some of that content will eventually be written to persuade the agent, not the human. An analyst who treats agent verdicts as advice rather than ground truth is a control against that, not a bottleneck.

The CFO's Lisbon login turned out to be a phished session token replayed through a VPN exit node. The agent's checks were all accurate. What it lacked was the knowledge that the CFO was in Chicago and that the timing was worth worrying about. The analyst had both. Keep her in the loop, and give her better tools.

Sources

1. NIST releases Version 2.0 of landmark Cybersecurity Framework — 26 Feb 2024 release and the new Govern function.
2. NIST CSWP 29: The NIST Cybersecurity Framework (CSF) 2.0 — exact wording of GV.OC-01, GV.RM and GV.RR-01.
3. MITRE ATT&CK — ATT&CK's self-description as a knowledge base of adversary tactics and techniques.
4. Verizon 2026 Data Breach Investigations Report — the 19th edition and its key takeaways.
5. Verizon 2026 DBIR Executive Summary (PDF) — 31,000+ incidents, 22,000+ breaches, human element in 62% of breaches (up from 60%).
6. Verizon news release on the 2026 DBIR — exploitation at 31%, third-party involvement at 48%, AI tool usage rising from 15% to 45%.
7. Project Zero: From Naptime to Big Sleep — AI agent finding an SQLite bug before release, and the authors' own caveats.
8. Schneier on Security: We Are Still Unable to Secure LLMs from Malicious Inputs — Aug 2025 post on prompt injection against agentic AI.