A modern SOC, or modern security operations center, is a security team that builds AI and automation into its daily workflow. Agents triage routine alerts, correlate them across tools, and close them under human oversight, so analysts spend their hours investigating and hunting threats.
A legacy SOC still sends every alert to a person. For a team with a fixed headcount, that difference sets how much real investigation gets done.
A modern SOC uses AI and automation to handle part of the team's daily work within a defined workflow, with clear handoffs to analysts.
In the 2026 SANS SOC Survey, most SOCs reported using AI or ML tools in their day-to-day operations, but only a third had built them into a defined workflow. Analysts in the gap between those two numbers own AI tools and still work alerts by hand.
In a legacy SOC, alerts from identity platforms, EDR, and firewalls arrive as raw signals. An analyst enriches each one manually before deciding whether to act.
When alert volume outpaces the team, a backlog forms, and some alerts go uninvestigated. The team spends its days reacting to what fired, with little time left to hunt threats that never triggered an alert.
SANS also found that less than half of SOCs fully or partially monitor nontraditional assets such as OT, ICS, and IoT. For teams defending plants or connected devices, visibility matters most.
AI belongs in steps that take the most analyst hours and require the least judgment, such as enrichment, first-pass triage, and evidence gathering for an investigation.
In the SANS AI Survey 2026, Industrial Cyber reported a considerable rise in active AI use in cybersecurity. Only 27% of practitioners described their AI deployments as mature production environments, and 39% had automated incident response in use.
In its Cost of a Data Breach Report 2026, IBM puts the global average breach cost at USD 4.99 million. Organizations that use security AI and automation extensively saved USD 1.93 million compared with those that used none.
Triage comes first because the process sets where analyst hours go.
In a legacy queue, an analyst gives a failed-login alert from the identity platform the same manual enrichment as a real intrusion. Much of that effort ends with the analyst closing a false positive.
Triage agents take over that first pass. An agent pulls the alert, adds user and device context, compares the activity with a behavioral baseline, and assigns a confidence score.
When an alert matches benign behavior with high confidence, the agent closes it and records the evidence. Every other alert reaches an analyst already enriched.
The workflow mixes two kinds of steps. Fixed steps handle anything that must run the same way every time, and reasoning steps handle the judgment calls.
Our Agentic Packages apply this pattern through micro agents. A micro agent is a narrowly scoped AI agent with one bounded job and limited tool access.
We organized the SOC agents in our Agentic Packages like a SOC team. The SOC Level 1 Agent handles first-pass triage, while other agents handle root-cause analysis and forensic collection.
In our SOC alert triage guide, we walk through the triage workflow step by step.
Cross-stack correlation means agents compare signals from different tools before deciding what they mean.
Many teams add AI one product at a time, and AI built into a single-point tool can only read that tool's data.
A suspicious sign-in on the identity platform and an unusual outbound connection on the firewall then reach the queue as two unrelated, low-priority alerts. That happens even when one attacker causes both.
In the Tronox customer story, we compare AI that works only inside its own tool against agents that correlate signals from vulnerability scanners and XDR with identity, cloud, firewall, and threat log data.
In our Agentic Packages, coordinator agents split an investigation and route results between specialist agents. One agent's finding then shapes what the next agent checks.
Full investigation access means a SOC's tools can reach every log source an investigation might need, wherever the team stores that data.
In our May 2026 survey of 100 security leaders, the majority said their current tools cannot access all their log data for investigations. Many of them had seen at least one investigation stall because data was stuck in a system their tools couldn't reach.
Cost explains much of that gap. Many of those same leaders called the cost of keeping data live and searchable painful or a major budget concern. When ingestion pricing makes a source expensive, many teams stop sending it to the SIEM or shorten how long they keep it.
Teams make that call in a cost review. In practice, they choose which part of the environment goes unmonitored, and no one in the SOC formally owns that choice.
Our Context Layer uses search-in-place and real-time data federation to query logs where they already live. Its connectors read Amazon S3, Splunk, Elastic, and other existing stores without moving or copying data.
Teams keep every source and pull only the fields an investigation needs. When a source does need centralizing for speed or normalization, AI-assisted collectors connect most of an organization's log sources in under a day.
Governed autonomy means agents act within set limits while humans approve actions with real-world consequences. The platform records every step an agent takes.
But agents can hallucinate, so security leaders hesitate to let agents act on their own. A modern SOC team answers that concern with three controls.
Our Agentic Packages require human approval for critical actions and keep a verifiable audit trail of every action. A SOC Level 2 Agent checks the closures the Level 1 Agent makes.
Regulators set tight deadlines for incident reports under rules such as the SEC's cybersecurity disclosure rule and the EU's NIS2 directive. When a report comes due, the compliance team pulls each agent action, its timestamp, and the analyst who approved it from that audit trail.
Once agents handle routine triage and enrichment, analysts move to work that needs human judgment, such as threat hunting, complex investigations, and detection tuning.
In tiered terms, agents take over much of the Tier 1 queue. Some of the people who worked on it take on Tier 2 and Tier 3 problems.
Other Tier 1 analysts shift to reviewing agent work. They check a sample of closures and rewrite a playbook whenever an agent closes a case the team would have escalated.
SOC leaders can check this trait by tracking how many freed hours go to threat hunting and complex investigations.
Tronox is one of the world's largest producers of titanium products, with about 5,700 employees on six continents. Its SOC is led by Adam Chapman, Director of Cybersecurity.
Chapman's team didn't rip out Devo, but kept it as the SIEM and layered Strike48 agents on top. Devo still collects and stores the logs, while the agents do the work that used to eat analysts' days: triaging alerts, correlating related events, and closing out Level 1 cases, the heavy lifting nobody wants to do. Humans get involved when an action carries real risk and a team member needs to sign off before anything happens.
That's the model in general. Strike48 sits on top of whatever SIEM a team already runs, whether that's Devo, Splunk, or Elastic. Search-in-place and real-time data federation give agents access to every log source without moving data, and they act on what they find. That combination works as an agentic orchestration layer for the SOC, with one practical result: the team gets an extra layer of hands without a migration project.
Devo gave Tronox analysts fast, deep access to security data, but analysts still interpreted it and made every decision manually.
Alerts from identity platforms, EDR, firewalls, and threat logs built a steady backlog, and many went uninvestigated. Analysts memorized complex queries and built each investigation from scratch, enriching and resolving every raw alert themselves.
The team needed more capacity without adding headcount, so it set out to automate first-pass triage and deeper investigation.
The team started out skeptical that agents could close cases. Tronox encoded its own playbooks as prompts and workflows, so agents worked cases the way its analysts already did. Agents tied each decision to evidence, behavioral baselines, and confidence scores that an analyst could inspect. The team came to treat the agents as apprentices handed the manual.
The rollout started with a small set of Level 1 cases. After agents closed just under half of cases on their own in a single week, the team trusted their work and widened what agents could do. Tronox reached autonomous Level 1 operations within months.
Analysts still decide complex cases. Agents pre-investigate them by building baselines, correlating users with devices, and surfacing anomalies, and the analyst receives each case as an evidence-based report. The team checks quality at two levels. Level 2 agents verify Level 1 closures, and the workflow pulls closed cases at random for re-analysis.
According to the Tronox customer story, AI closed over three-quarters of Tronox's security cases in one month with no analyst involvement. The team got back over 670 hours of analyst time that month, roughly four full-time analysts.
"By automating repetitive triage and enrichment and eliminating rubbish, Strike48 frees our analyst resources to focus on higher-impact work that requires a human," said Adam Chapman, Director of Cybersecurity at Tronox, in the Tronox customer story.
We cover the governance model behind these results in our piece on agentic SOC autonomy.
In our guide to AI-native SOC requirements, we outline the platform foundations a SOC needs before agents can work this way.
Standard metrics for a modern SOC include MTTD, MTTR, false positive rate, dwell time, automated closure rate, and log coverage.
Security leaders want agents on Level 1 work but hesitate to let agents run it alone. In the May 2026 survey, 84% of security leaders agreed AI agents should do Level 1 SOC work, while only 22% were ready to fully automate it. Approval gates, closure reviews, and audit trails help a SOC team earn enough trust to close that gap.
Storage costs push teams to drop log sources. Each source a cost review removes is a source no agent or analyst can search in a later investigation. Querying excluded sources where they live keeps them reachable without the ingestion bill.
Hiring rarely fills the capacity gap. In the 2026 SANS SOC Survey, only 32% of practitioners said management pays close attention to SOC hiring and retention, compared with 59% of cyber leaders who believe management is engaged. A team that can't count on new headcount has to free hours from the analysts it already has.
Agents need reliable inputs before they run cases alone. An agent works from the log sources it can reach and the playbooks the team encodes. If a source is missing or a playbook skips a step analysts take, the agent closes cases on incomplete evidence. The sequence below starts with measurement for that reason.
Teams start by measuring, then automate one narrow slice of Level 1 work and expand from there. A practical sequence looks like this.
We lay out this sequence in detail in our SOC modernization roadmap.
In our autonomous SOC maturity path, we show how teams expand autonomy stage by stage as they gain confidence in agent work.
Strike48 is the agentic orchestration platform for security and IT. It runs on top of the SIEM a team already uses and is trusted by dozens of customers across the Global 2000.
A traditional SOC sends every alert to an analyst, while a modern SOC uses AI agents to triage, correlate, and close routine alerts under human oversight. In a modern SOC, analysts spend their time on complex investigations and threat hunting instead of the alert backlog.
Yes, the terms are mostly used interchangeably. Both describe a SOC that builds AI and automation into a defined workflow, rather than one that owns AI tools but still works alerts by hand. The SANS 2026 SOC Survey found that only 36% of SOCs have done that.
No. Agents take over much of the routine Level 1 triage, but people still decide complex cases and approve actions with real consequences, such as isolating an endpoint.
At Tronox, agents closed over 75% of cases in one month, and analysts still handled complex cases with the evidence already gathered.
No. Agents can run as a layer on top of the SIEM a team already uses, whether that’s Devo, Splunk, or Elastic. Tronox kept Devo as its SIEM and layered Strike48 agents on top, with no migration project.
A modern SOC uses the same core tools as any SOC: SIEM, EDR, XDR, NDR, SOAR, identity and access management, vulnerability scanners, threat intelligence, cloud security, and case management. On top of those, it adds an agent layer that correlates signals across all of them.
Start by measuring false positive hours and unreachable log sources. Then automate a small set of Level 1 case types, using your own playbooks. Set human approval gates for critical actions, verify agent closures through review or sampling, and widen agent scope only once closure quality holds up.
