Loading story…
Security operations centers (SOCs) are facing unprecedented challenges due to the overwhelming volume of alerts, the technical complexity of modern environments, and the need for rapid, precise responses to threats. Traditional solutions such as detection-as-code, deterministic response automation, and data lakes have helped address some of these issues, but scaling remains a persistent problem. The introduction of AI agents represents a significant shift in how security operations can be managed, offering the potential for intelligent, autonomous analysis that can keep pace with evolving threats and the scale of modern enterprises. AI agents are not only capable of automating routine tasks but also bring a new level of adaptability and decision-making to the SOC, potentially reducing human error and increasing the speed of incident response. However, the adoption of AI agents introduces new complexities, particularly in the realm of identity management. Unlike traditional machine identities, which are deterministic, or human users, who are non-deterministic but slow and easily identified, AI agents combine the speed and scale of machines with the unpredictability of human behavior. This hybrid nature challenges existing identity and access management (IAM) frameworks, requiring the development of new standards and practices. Okta, a leading identity provider, has recognized this challenge and is working on solutions such as the Cross App Access standard to enforce access restrictions on AI agents. The company emphasizes that every AI agent must have a human ultimately responsible for its actions, underscoring the need for accountability in automated systems. The rise of AI agents is driving a reevaluation of best practices in identity security, as organizations must now manage identities that do not fit neatly into existing categories. The unpredictability and autonomy of AI agents mean that traditional controls, such as passwords and periodic verification, may not be sufficient. Security teams must adapt their architectures, expectations, and foundational infrastructure to effectively integrate AI-powered operations. The scale and speed at which AI agents operate also increase the potential impact of any security incident, making robust identity and access controls even more critical. As AI agents become more prevalent in security operations, organizations must balance the benefits of automation and scalability with the risks associated with non-deterministic, autonomous systems. The evolution of SOCs toward AI-driven models is not just a technological shift but also a cultural and procedural one, requiring new approaches to risk management, accountability, and trust. Industry leaders are actively developing new frameworks and standards to address these challenges, recognizing that the future of security operations will be defined by the effective integration of AI agents into both technical and organizational processes. The transformation from traditional SIEM to AI-powered SOCs is underway, and the security community is responding with innovation in both technology and governance.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The rapid adoption of AI agents, bots, and other non-human identities (NHIs) is fundamentally reshaping the cybersecurity landscape, introducing new attack surfaces and operational challenges for enterprises. As organizations increasingly rely on automation and AI-driven processes, NHIs are being granted broad access to critical systems, often without the same oversight or security controls applied to human users. This shift has led to heightened risks such as over-permissioned accounts, static credentials, and insufficient monitoring, making NHIs attractive targets for cybercriminals seeking to exploit gaps in identity and access management (IAM). Security leaders are urged to implement zero-trust principles, least-privilege access, automated credential rotation, and robust secrets management to mitigate these risks and prevent privileged account compromise. The complexity of managing AI agents is further compounded by the need for effective governance and the challenge of balancing control with operational simplicity in security operations centers (SOCs). Experts emphasize that adversaries are increasingly "logging in, not breaking in," leveraging weaknesses in identity controls—especially those related to AI agents—to gain unauthorized access. The cybersecurity workforce must adapt, as AI-driven automation is expected to take over high-volume, repetitive tasks, requiring new skills in AI security and orchestration. Organizations are advised to treat every human, workload, and agent as a managed identity, enforce phishing-resistant multi-factor authentication, and continuously monitor for anomalous permission changes or session hijacking to stay ahead of evolving threats.
Jun 29, 2026
Agentic AI is rapidly transforming the landscape of security operations centers (SOCs) by automating repetitive tasks and augmenting human analysts. David Norlin, CTO of Lumifi, highlights that agentic AI can enhance cybersecurity workflows, but stresses the importance of accountability, context, and human oversight to ensure safe deployment. The integration of agentic AI into SOCs introduces new efficiencies, such as the ability to catch threats that traditional tools might miss, but also brings novel risks that require careful management. Alon Jackson, CEO of Astrix Security, discusses the intersection of non-human identities, large language models (LLMs), generative AI, and agentic AI, emphasizing that these agents amplify existing identity security challenges. As organizations deploy more AI agents, the risk of credential compromise and unauthorized access increases, necessitating robust discovery, security, and governance mechanisms. Astrix advocates for an 'Agent Control Plane' to securely manage the lifecycle and permissions of agentic AI across the enterprise. Both experts agree that the exponential growth of AI agents will leave organizations struggling without modern platforms and tooling designed for this new paradigm. The need for secure agentic adoption is paralleled with previous technological waves, but with unique considerations due to the autonomous and scalable nature of AI agents. Organizations are advised to avoid past mistakes by proactively implementing controls, monitoring agent activity, and ensuring that AI-driven automation does not open new doors to attackers. The responsible deployment of agentic AI requires a balance between leveraging automation for efficiency and maintaining strict oversight to prevent abuse. As agentic AI becomes more prevalent, CISOs and security leaders must adapt their risk management frameworks to address these emerging threats. The conversation underscores that while agentic AI offers significant benefits, it also demands a new approach to identity, access, and operational security. Enterprises that fail to adapt may find themselves exposed to novel attack vectors and operational risks introduced by autonomous agents. The evolving landscape calls for continuous education, updated policies, and investment in technologies that can provide visibility and control over both human and non-human actors in the SOC. Ultimately, the secure adoption of agentic AI will be a defining challenge for cybersecurity teams in the coming years, requiring collaboration between technical, operational, and leadership stakeholders.
Jun 29, 2026
Enterprises are rapidly adopting agentic AI technologies to automate and enhance both security operations and business-to-business (B2B) workflows, fundamentally transforming traditional IT and security architectures. Security Operations Centers (SOCs) are experiencing unprecedented alert volumes, with large organizations managing thousands of alerts daily, leading to significant alert fatigue and missed incidents. To address these challenges, organizations are shifting from legacy, manual SOC models to AI-augmented SOCs, where analysts oversee and validate AI-driven decisions rather than manually triaging every alert. This transition requires a mindset shift, as leaders must learn to trust AI systems to assist analysts without fully replacing human judgment. The adoption of AI in SOCs is accelerating, with 88% of organizations planning to evaluate or deploy AI-driven SOC platforms within the next year. However, the proliferation of AI-powered SOC automation introduces new risks, making it essential for security leaders to carefully assess architectures, implementation models, and phased adoption strategies. In parallel, agentic AI is revolutionizing SaaS and partner ecosystems by enabling autonomous, self-orchestrating integrations that move beyond traditional, human-mediated application networks. This shift is driving a critical pivot in enterprise technology, as routine, rules-based digital tasks become candidates for full automation by intelligent agents. As these autonomous AI agents automate complex B2B workflows, robust security and governance frameworks become paramount. Security experts emphasize the need to integrate AI agents with existing enterprise governance platforms, ensuring alignment with established security practices such as Role-Based Access Control (RBAC) and organizational policy management. The introduction of AI firewalls and guardrails—context-aware frameworks that verify both the inputs and outputs of AI agents—provides a foundational layer of security, ensuring that automated actions remain compliant with enterprise policies. Verifiable workflows are crucial, particularly in B2B environments, to maintain operational coherence and prevent unauthorized or unintended actions by autonomous agents. The convergence of these trends highlights the dual imperative for organizations: to harness the efficiency and scalability of agentic AI while implementing rigorous security controls and governance mechanisms. As AI becomes integral to both security operations and business workflows, the ability to measure real impact, manage risks, and select the right platforms will define organizational resilience. Security teams and platform architects must stay informed about evolving best practices for securing AI and large language models (LLMs) within their environments. Ultimately, the successful adoption of agentic AI in the enterprise hinges on balancing innovation with robust, context-aware security and governance.
Jun 29, 2026