Loading story…
Organizations are increasingly leveraging AI agents to transform security operations from reactive to proactive postures. AI agents differ from traditional AI tools by operating autonomously within an ecosystem, perceiving their environment through various data sources such as APIs, log streams, and configuration files. These agents are capable of making decisions, taking actions, and continuously learning and adapting to new threats and operational contexts. The integration of AI agents into security workflows allows for the automation of complex tasks, reducing the reliance on human intervention and enabling security teams to focus on higher-level strategic activities. In the context of threat hunting, agentic systems are being used to scale operations beyond the limitations of manual analysis. Unlike simple AI assistants that provide one-off answers, agentic systems can break down tasks, execute them in sequence, and learn from the outcomes to improve future performance. A critical component for the effectiveness of these agents is the establishment of a persistent memory, such as a repository where threat hunts are documented and stored. This allows AI agents to build on past hunts, adapt to evolving adversary tactics, and refine detection strategies over time. Security professionals are encouraged to treat threat hunts like code, capturing hypotheses, search queries, results, and notes in structured formats such as markdown files within version-controlled repositories. This approach not only facilitates collaboration and knowledge sharing but also provides a foundation for AI agents to learn and automate threat detection processes. The shift towards agentic security operations is driven by the need to keep pace with adversaries who are increasingly automating their own attack methods. By empowering AI agents with autonomy, memory, and the ability to act across the security ecosystem, organizations can enhance their ability to detect, respond to, and mitigate threats proactively. The adoption of these technologies is also helping to address resource gaps in security teams by automating routine tasks and enabling more efficient use of human expertise. As AI agents continue to evolve, their role in security operations is expected to expand, offering new opportunities for innovation and improved defense against sophisticated cyber threats. The move from reactive to proactive security, powered by agentic systems, represents a significant advancement in the field of cybersecurity. Security leaders are advised to invest in the infrastructure and processes necessary to support agentic operations, including the creation of hunt repositories and the integration of AI agents into existing workflows. This transformation is poised to redefine the capabilities and effectiveness of modern security operations centers.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cio.com
Open sourcesecurelybuilt.substack.com
Open sourcedispatch.thorcollective.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security operations centers (SOCs) are increasingly leveraging agentic AI to address the global shortage of cybersecurity professionals and the overwhelming volume of security alerts. By automating low-level decision-making and triage, agentic AI enables security teams to shift from reactive incident response to proactive threat hunting, allowing them to focus on strategic security initiatives rather than being bogged down by alert fatigue. Industry data highlights that organizations are inundated with hundreds of alerts daily, with a significant portion being ignored due to human limitations, underscoring the need for AI-driven solutions. AI agent tools are revolutionizing the workflow for SOC analysts by automating complex investigation tasks that previously required manual queries and cross-system checks. These agents utilize structured tool interfaces to translate natural language questions into actionable security investigations, dynamically adapting to new threats and integrating with various security platforms. This evolution in security automation empowers analysts to supervise AI-driven investigations, significantly improving detection, triage, and response capabilities at scale.
Jul 12, 2026
Organizations across industries are rapidly adopting agentic AI, with a significant shift in 2025 from experimental deployments to operational use in security operations. Companies are leveraging AI agents for tasks such as autonomous alert triage, threat hunting, and intelligent detection tuning, resulting in increased efficiency and productivity. However, this rapid adoption has highlighted the need for robust governance, observability, and lifecycle management to prevent potential risks associated with autonomous agents running unchecked. Regulated industries like financial services are leading in implementing centralized governance and human oversight to ensure regulatory, ethical, and performance standards are met. Enterprises are also benefiting from advancements in AI models, such as Claude 4.5 and GPT-5, which offer improved reasoning and integration capabilities. Despite these advancements, organizations are still working to balance human and agent decision-making, emphasizing the importance of continuous monitoring and responsible deployment of AI agents in critical security operations.
Jun 29, 2026
Artificial intelligence is rapidly reshaping the cybersecurity landscape, with industry analysts and experts predicting that AI agents will soon handle the majority of security operations tasks. According to a recent IDC report, by 2028, AI will process 80% of security alerts in most security operations centers, dramatically reducing the need for manual intervention by human analysts. The report also forecasts that AI will not only bolster defense but also empower attackers, with 80% of organizations expected to face AI-driven phishing attacks using synthetic identities by 2027. Additional trends include the quantification of cyber threats in financial terms, the rise of sovereign AI mandates, and the widespread adoption of AI-powered risk quantification and dynamic playbooks. At the 2025 OWASP Global AppSec conference, cybersecurity veteran Daniel Miessler emphasized that AI agents are breaking down security work into discrete, automatable tasks, fundamentally changing the nature of cybersecurity jobs. Miessler highlighted the potential for organizations to significantly boost productivity by training staff to leverage AI agents, such as Anthropic's Claude Code and its Agent Skills toolkit, which can automate a wide range of specialized tasks. While the shift to AI-driven operations presents opportunities for efficiency, it also raises concerns about workforce displacement and the need for upskilling to remain relevant in an AI-augmented security environment.
Jul 12, 2026