Security teams now hand investigations to AI agents. The software takes an alert and decides whether anything is wrong. It mostly gets it right, but the trouble starts when it decides nothing is wrong while an attack is still underway. The cause is usually missing evidence, logs the agent never saw. Researchers call that confident wrong answer an AI hallucination in threat detection, though the term undersells the damage, since a hallucinated all-clear ends the one investigation that mattered.
This guide shows how it happens, how to audit for it, and what to ask vendors.
When an agent states a conclusion confidently but that conclusion reflects pattern-matching disconnected from the actual state of the environment, that is a hallucination. A standard false positive is a different failure, and the distinction is worth pinning down.
Hallucination has two shapes. The escalation nobody can reproduce, a fabricated threat, is the obvious one. The quiet one is a clean-looking investigation that closes with no threat found while attacker activity continues, and the absence of findings reflects missing data. Accuracy and repeatability are also separate concerns worth keeping distinct, since a model can be perfectly deterministic and still be wrong every time. Bridewell's practical framework evaluates them separately. This guide diagnoses the accuracy failure.
An agent's stated confidence tells you nothing about the completeness of the data it reasoned over. A high-confidence conclusion drawn across a fully instrumented environment and a high-confidence conclusion drawn across a partially instrumented one look identical in the output. The reasoning process generates the confidence and has no view of how complete the pipeline feeding it is. That independence is why hallucination in security operations starts as a data visibility problem, well before model choice enters the picture. Benchmark hallucination rates measured on public datasets tell you almost nothing about how an agent will behave in your environment.
When a log source was never ingested, or a routing rule moved it out of the active tier before an agent could query it, the agent reasons as though that source does not exist. It has no mechanism for representing an unknown unknown, so it returns a clean investigation and stays silent about the identity provider logs for that window being unavailable. A human analyst in the same position would write that gap down. The two outputs carry identical confidence, so the failure is hard to catch. The CardinalOps 5th Annual SIEM Report, compiled in Vectra's security monitoring research, puts SIEM-only coverage of MITRE ATT&CK techniques at roughly 21%. That is the honest scale of how much attacker behavior the SIEM tier alone tends to miss before any agent is layered on top of it.
A log source can be technically present but nearly useless for reasoning. The parsing might be inconsistent, or the contextual fields an agent needs to score what it found were never attached. Identity resolution, asset criticality, and network or geographic context are the fields that turn a raw authentication event into a judgment about whether that authentication matters. Strip them and the agent has just enough signal to reach a wrong conclusion and state it with confidence, which is operationally worse than having no signal at all. Format changes upstream degrade every downstream field an agent depends on. A parser built for a fixed schema at ingestion time becomes a liability the first time that schema drifts.
Kaspersky's analysis of autonomous SOC challenges makes the point plainly. Agents are more sensitive to data gaps than human analysts are. A Tier 2 analyst who cannot find the EDR telemetry for a host writes "unclear, needs follow-up" in the case notes. Human reasoning has a native representation for missing evidence. An agent given the same partial picture usually produces a definitive answer. It arrives at that wrong answer in the time a human would have spent writing the gap down.
The mechanism creating those coverage gaps right now is cost control, and it is a reasonable practice. Teams filter high-volume, low-value events (sign-outs, health checks, debug metadata) out of the active SIEM tier to keep ingestion spend defensible. Both Monad and DataBahn document this as standard detection engineering practice. The same data usually gets archived faithfully to cold storage for retention obligations. Compliance retention and AI reasoning availability are separate requirements, though. An agent that cannot query the cold tier during an investigation reasons exactly as if that data had never been collected, no matter how faithfully the archive satisfies the auditor.
At the SIEM coverage levels CardinalOps documents, the majority of attacker behavior generates no detection signal from the SIEM tier alone. That sets the practical ceiling on what any agent reasoning over SIEM data alone can find. The dwell time and breach cost figures from IBM and Ponemon research, also compiled by Vectra, matter here for a specific operational reason. A false-negative hallucination extends dwell time by definition, because a clean investigation closes the case and stops the clock on human review while the activity continues.
Ingested and AI-reasoning-ready describe two different states, and most pipeline documentation only tracks the first one. Four questions separate them in your own environment. You can answer all four this week without a vendor in the room.
The audit has a vendor-facing version.
Strike48's 2026 survey of security leaders puts numbers on how open this gap remains. 84% report their current tools cannot access all the log data they need for investigations. 65% have had at least one investigation stall because data was trapped in a system their tools could not reach. And 64% flag three or more trust concerns with AI agents simultaneously. Those findings describe one problem viewed twice. Teams distrust agents in large part because the data underneath them is unreachable.
Strike48's federated search queries log sources where they already live, across S3, Splunk, Elastic, and existing data lakes. That gives agents a single searchable view of the environment without a migration project. Search-in-place is what makes the archived-tier question answerable. A source that stays where it is remains queryable at investigation time and never waits on rehydration. On the enrichment side, Strike48 auto-generates parsers for new log sources and lets agents read semi-structured logs directly when no parsed fields exist yet. That is how coverage stays current as formats change. A platform that queries logs where they already live is architecturally distinct from one that layers agents over an inherited SIEM and inherits its blind spots along with it. Our SIEM augmentation and AI SOC agents pages carry the platform-level detail this section summarizes. If you want the agent-containment side of the story (micro-agents and tool constraints), you will find that architecture in our post on solving for AI hallucinations in cybersecurity.
Monad's detection engineering guidance walks through filtering routine Okta sign-out events out of the active SIEM tier. The change cuts meaningful ingestion volume and spend with no apparent detection loss. The logic is sound, since sign-out events rarely drive a detection rule.
They do carry session boundaries, which is the kind of context an agent uses to reconstruct whether a token was reused after a legitimate session closed. The filtering decision that saves the budget also determines what an agent can reason over during an investigation eighteen months later. Most SOCs already run some version of this rule set, so the gap it produces is sitting in production environments today.
Better prompting and stronger model selection reduce hallucination at the margins. They leave the underlying risk intact. A well-prompted model reasoning across a partially covered, inconsistently normalized environment still gives you confident answers about the portion it cannot see. Those answers will be wrong. Data-layer evaluation belongs alongside model-layer evaluation in the same review cycle.
Coverage completeness, normalization quality, and field-level enrichment are the three measurable properties of the underlying log data that drive most of it. When a source is missing, or arrives inconsistently parsed and stripped of identity and asset context, the agent fills the gap with statistical pattern-matching. Model architecture contributes as a secondary factor.
A false positive comes from an over-tuned detection rule firing on real but benign activity, where the telemetry was accurate. A hallucination is a confidently stated conclusion disconnected from the environment's actual state, produced in the reasoning layer. Hallucinations also appear as false negatives, which false positives never do.
No. Better prompting helps with conclusions the agent already has some visibility into, and stronger model selection does the same. Neither compensates for data that is missing or unreachable. No amount of prompt engineering makes an agent aware of a log source it cannot query. An agent that cannot represent the gap will fill it.
Start with the pipeline audit. It covers whether archived and filtered sources are queryable by agents at investigation time, whether normalization runs before or after cost-driven routing, and whether enrichment is consistent across sources. Those three answers map directly onto where hallucination risk concentrates.
Two matter most. Make every log source reachable at query time through federated search or search-in-place architecture, so cold-tier data stays investigable during a live case. Then apply field-level enrichment consistently across all sources, using auto-generated parsers where new sources would otherwise sit unparsed, so enrichment never concentrates in a few well-instrumented systems.