Loading story…
Security operations centers (SOCs) are increasingly leveraging agentic AI to address the global shortage of cybersecurity professionals and the overwhelming volume of security alerts. By automating low-level decision-making and triage, agentic AI enables security teams to shift from reactive incident response to proactive threat hunting, allowing them to focus on strategic security initiatives rather than being bogged down by alert fatigue. Industry data highlights that organizations are inundated with hundreds of alerts daily, with a significant portion being ignored due to human limitations, underscoring the need for AI-driven solutions.
AI agent tools are revolutionizing the workflow for SOC analysts by automating complex investigation tasks that previously required manual queries and cross-system checks. These agents utilize structured tool interfaces to translate natural language questions into actionable security investigations, dynamically adapting to new threats and integrating with various security platforms. This evolution in security automation empowers analysts to supervise AI-driven investigations, significantly improving detection, triage, and response capabilities at scale.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
3 references tracked. Mallory keeps watching after this page renders.
dispatch.thorcollective.com
Open sourcesecurityaffairs.com
Open sourcedetectionatscale.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Organizations are increasingly turning to agentic artificial intelligence (AI) to address the growing complexity and volume of cybersecurity threats. Transurban, a global roadway operator, has implemented agentic AI models to automate the triaging and scoring of security alerts, significantly improving the efficiency and accuracy of their security operations center (SOC). This approach allows SOC analysts to focus on higher-priority incidents while AI handles the initial assessment of the majority of alerts, addressing the challenge of overwhelming alert volumes and reducing the risk of missed or mishandled incidents. Industry discussions highlight that the adoption of AI-driven tools is not only a response to technical challenges but also to rising expectations from organizational leadership. CISOs are under increasing pressure from boards to deliver clear, business-friendly metrics and maintain readiness despite limited resources and frequent incidents. The integration of agentic AI into cyber defense strategies is seen as a critical innovation to bridge the gap between operational demands and leadership expectations, helping organizations manage both technical and organizational risks more effectively.
Jun 29, 2026
Artificial intelligence is rapidly reshaping the cybersecurity landscape, with industry analysts and experts predicting that AI agents will soon handle the majority of security operations tasks. According to a recent IDC report, by 2028, AI will process 80% of security alerts in most security operations centers, dramatically reducing the need for manual intervention by human analysts. The report also forecasts that AI will not only bolster defense but also empower attackers, with 80% of organizations expected to face AI-driven phishing attacks using synthetic identities by 2027. Additional trends include the quantification of cyber threats in financial terms, the rise of sovereign AI mandates, and the widespread adoption of AI-powered risk quantification and dynamic playbooks. At the 2025 OWASP Global AppSec conference, cybersecurity veteran Daniel Miessler emphasized that AI agents are breaking down security work into discrete, automatable tasks, fundamentally changing the nature of cybersecurity jobs. Miessler highlighted the potential for organizations to significantly boost productivity by training staff to leverage AI agents, such as Anthropic's Claude Code and its Agent Skills toolkit, which can automate a wide range of specialized tasks. While the shift to AI-driven operations presents opportunities for efficiency, it also raises concerns about workforce displacement and the need for upskilling to remain relevant in an AI-augmented security environment.
Jul 12, 2026
Organizations are increasingly leveraging AI agents to transform security operations from reactive to proactive postures. AI agents differ from traditional AI tools by operating autonomously within an ecosystem, perceiving their environment through various data sources such as APIs, log streams, and configuration files. These agents are capable of making decisions, taking actions, and continuously learning and adapting to new threats and operational contexts. The integration of AI agents into security workflows allows for the automation of complex tasks, reducing the reliance on human intervention and enabling security teams to focus on higher-level strategic activities. In the context of threat hunting, agentic systems are being used to scale operations beyond the limitations of manual analysis. Unlike simple AI assistants that provide one-off answers, agentic systems can break down tasks, execute them in sequence, and learn from the outcomes to improve future performance. A critical component for the effectiveness of these agents is the establishment of a persistent memory, such as a repository where threat hunts are documented and stored. This allows AI agents to build on past hunts, adapt to evolving adversary tactics, and refine detection strategies over time. Security professionals are encouraged to treat threat hunts like code, capturing hypotheses, search queries, results, and notes in structured formats such as markdown files within version-controlled repositories. This approach not only facilitates collaboration and knowledge sharing but also provides a foundation for AI agents to learn and automate threat detection processes. The shift towards agentic security operations is driven by the need to keep pace with adversaries who are increasingly automating their own attack methods. By empowering AI agents with autonomy, memory, and the ability to act across the security ecosystem, organizations can enhance their ability to detect, respond to, and mitigate threats proactively. The adoption of these technologies is also helping to address resource gaps in security teams by automating routine tasks and enabling more efficient use of human expertise. As AI agents continue to evolve, their role in security operations is expected to expand, offering new opportunities for innovation and improved defense against sophisticated cyber threats. The move from reactive to proactive security, powered by agentic systems, represents a significant advancement in the field of cybersecurity. Security leaders are advised to invest in the infrastructure and processes necessary to support agentic operations, including the creation of hunt repositories and the integration of AI agents into existing workflows. This transformation is poised to redefine the capabilities and effectiveness of modern security operations centers.
Jun 29, 2026