Sekoia says AI agents will handle SOC triage, freeing analysts for critical thinking

Sekoia’s leadership argues that artificial intelligence agents are permanently changing how security operations centers function, moving from simple assistance to active investigation partners.

How it unfolded

• Sekoia published research detailing the shift toward Integrated Security Operations Centers, or ISOC, as a new industry standard.
• David Bizeul, Sekoia’s Chief Solution Officer, explained that AI agents can now perform triage and investigation tasks at speeds humans cannot match.
• The analysis highlights that Gartner introduced the ISOC category to challenge traditional Security Information and Event Management models.

Who is affected

Security teams managing large volumes of data alerts are the primary beneficiaries of this shift. According to Sekoia, these teams can reduce alert fatigue by delegating repetitive tasks to AI agents. Human analysts remain essential but their role changes significantly. They no longer compete with machines on speed or data volume. Instead, they focus on areas requiring deep contextual understanding and skepticism. The goal is a hybrid workforce where agents handle initial processing while humans provide judgment and oversight.

What happens next

Analysts will work at a higher strategic level rather than performing manual data sorting. Sekoia states that applying AI to the right workflow parts removes painful tasks analysts have handled for years. Humans will act as mentors to the AI agents, teaching them new reasoning patterns and challenging investigation results. This requires analysts to identify new threat actor behaviors and hidden environmental signals, then feed those insights back into the system. The future SOC relies on this continuous feedback loop between human intuition and machine efficiency.

The background in plain language

Security operations centers monitor digital networks for threats. Traditionally, they used separate tools for log collection, threat intelligence, and response coordination. The new ISOC model integrates these functions into one platform. AI agents are automated software programs that can analyze data and perform tasks without constant human input. Teams usually start by letting these agents handle routine alerts. This allows human staff to focus on complex decisions. Check whether your current tools can share data freely. Ensure your team understands how to verify automated findings. This approach reduces the burden on staff while maintaining security oversight.

What to do and how to stay safe: Sekoia

• Review your current security toolchain to identify fragmented processes that could be integrated into a single platform.
• Define specific repetitive tasks, such as initial alert triage, that can be safely delegated to automated systems.
• Establish protocols for human analysts to verify and challenge the conclusions generated by AI agents.
• Train staff to focus on critical thinking and mentorship of automated systems rather than manual data entry.

Step-by-step guide: Injection attacks examples: how prompt leaks break AI systems

General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the ISOC category?

Gartner introduced the Integrated Security Operations Center category to challenge traditional SIEM models by integrating multiple cybersecurity capabilities into one platform.

How do AI agents help security teams?

According to Sekoia, AI agents can investigate at greater speed and take on repetitive tasks across large volumes of data, helping teams reduce alert fatigue.

What is the new role of human analysts?

Human analysts will focus on critical thinking, skepticism, and mentoring AI agents by providing new reasoning approaches and challenging investigation results.