Omdia research presented at RSA Conference 2026 found that 89% of CISOs are actively pushing to accelerate agentic AI cyber defense adoption.
The reason is arithmetic, not hype. The average enterprise security team manages dozens of tools and faces hundreds of alerts a day, a volume no team can review by hand at the speed modern attacks move.
This guide is part of Tecla's Agentic AI Use Cases series, covering agentic AI for cybersecurity specifically: the SOC workflows, cyber defense patterns, and identity responses that have moved past the pilot stage.
What Is Agentic AI?
Agentic AI refers to goal-oriented systems that plan, execute, and adapt multi-step tasks with minimal human oversight, distinct from traditional AI or generative AI built to answer a single prompt.
Three capabilities define it: autonomy (deciding what actions to take and executing them), adaptability (adjusting the plan based on new signals), and coordination (working across tools and systems to finish what no single tool could alone).
In a SOC, that difference shows up immediately. A rules engine flags an alert. An agentic system takes that alert, pulls context from five other systems, reaches a verdict, and either acts or hands a human a fully investigated case instead of a raw ping.
How Agentic Systems Work in Cybersecurity
Security has run on automation for over a decade, first through SIEM correlation rules, then through SOAR playbooks.
SOAR automates a predefined, hand-coded sequence: if X, do Y. It is fast and auditable, but it breaks the moment an attacker does something the playbook did not anticipate, and every new pattern means an engineer rewriting the workflow.
Agentic AI operates differently: it reasons instead of just executing a script. It reads the alert, decides what context matters, and adjusts the investigation as it goes, the way human analysts would.
The trade-off is real and worth naming directly: SOAR is more predictable and cheaper to audit; AI-driven agentic systems are more adaptive and more expensive to run per case.
Most production security deployments in 2026 are not one or the other.
They are structured workflows (routing, enrichment) for the repeatable 80% of cases, with agentic reasoning reserved for triage and investigation, and a human gate in front of anything that contains, blocks, or revokes access.
Perceive alert or signal
›
Retrieve SIEM, intel
›
Reason correlate, score
↓
Human gate
›
Act contain, revoke
›
Verify
Verify feeds back into Perceive, a continuous feedback loop, for the next cycle
Agentic AI Use Cases in Cybersecurity
Security teams don't adopt agentic AI as one system. They adopt it mechanism by mechanism, starting wherever the volume problem is worst.
Nine of those starting points are documented below, each at working depth. The architecture above is abstract until it's tied to an actual trigger and an actual system.
SOC Alert Triage and Enrichment
Gartner projects more than half of SOC Tier 1 analyst work will be handled by agentic systems by 2028, the same shift already underway in the workflow below.
The workflow
What it does: classifies every incoming alert, pulls the context an analyst would otherwise have to hunt for across five systems, and opens a case with a recommended response instead of a raw ping.
1
Alert ingested from SIEM or XDR and severity classified
2
Enriched with asset criticality, user context, threat intel
3
Similar historical cases retrieved and compared
4
Case opened with evidence and a recommended action
5
Human gate: analyst decides on anything that escalates
The stack: orchestration through a custom state machine or LangGraph for auditability, retrieval over the SIEM's event store (Splunk, Microsoft Sentinel, Google Chronicle) plus EDR telemetry (CrowdStrike, SentinelOne, Microsoft Defender) and a threat intel feed via API, with evals scoring triage accuracy against analyst-confirmed outcomes weekly.
Why it works: the volume problem is real, and triage is pattern-matching at scale, exactly what routing does well.
Production concern: false negative rate. A triage agent that is too conservative just adds a layer of noise on top of the noise it was meant to cut.
Phishing Detection and Response
Attackers have moved past the inbox. Voice and SMS phishing now succeed 40% more often than email, per Verizon's 2026 DBIR, precisely because most training and filtering still assumes the attack arrives as text.
The workflow
What it does: handles the full lifecycle of a reported or detected phishing email, from detonation to campaign cleanup across every inbox it reached.
1
Email reported by a user or flagged by a filter
2
Attachment or link detonated in an isolated sandbox
3
Verdict reached and logged with sandbox evidence
4
Matching messages searched across all inboxes
5
Campaign quarantined, affected users notified
The stack: a sandboxing tool for detonation, a mail API (Microsoft 365 or Google Workspace) for the inbox-wide search and quarantine action, guardrails capping how many mailboxes a single action can touch before requiring a second confirmation.
Why it works: speed matters more than nuance here, and every action is reversible, which supports moving fast without a live human gate.
Production concern: latency. Detonation takes time, and the workflow's value depends on finishing before recipients open the email.
Identity and Access Anomaly Response
Stolen credentials remain the quiet workhorse of most intrusions, showing up in 39% of full breach chains per Verizon's 2026 DBIR, the pattern an agentic workflow is built to catch before it escalates.
The workflow
What it does: watches for access patterns that break policy, such as impossible travel or a sudden privilege escalation, and acts within a scoped, pre-approved mandate.
1
Anomalous access detected against behavioral baseline
2
Device, location, and privilege context retrieved
3
Risk scored against the written access policy
4
Session revoked or step-up auth forced within mandate
5
Incident logged for the identity team's review
The stack: identity provider APIs (Okta, Microsoft Entra ID, or whatever IdP the organization runs) as the primary tool, a behavioral baseline model retrained on a fixed cadence, guardrails bounding pre-approved actions (session revocation, MFA) versus human-required ones (account suspension).
Why it works: the response actions are pre-approved and bounded, so real-time autonomy is safe because a human already approved the boundaries in advance.
Production concern: drift in the behavioral baseline. Legitimate work patterns change, and a stale baseline becomes a false-positive machine within a quarter.
Vulnerability and Patch Prioritization
The math changed this year. AI shrinks the exploit window from months to hours, why Verizon's 2026 DBIR recorded exploitation overtaking credentials as the top vector for the first time in 19 years, and why an agentic workflow now runs this triage continuously.
The workflow
What it does: correlates every disclosed vulnerability against the organization's actual asset inventory and exploit activity in the wild, then ranks what to patch first instead of leaving that judgment to a spreadsheet.
1
New CVEs ingested from disclosure feeds
2
Checked against the CMDB: is the software actually deployed here
3
Checked against exploit intel: is this CVE actively exploited
4
Both signals combined into a single priority score
5
Ranked queue generated, business-critical systems flagged
6
Human gate: queue delivered to the patching team, who sets rollout order
The stack: a vulnerability database API (the CVE feed or a commercial scanner like Tenable or Qualys), the asset inventory or CMDB as the second source, retrieval over exploit intelligence feeds.
Why it works: a research and ranking task with no consequential action taken automatically, one of the lowest-risk places to start.
Production concern: data quality. A stale CMDB produces a confidently wrong queue.
Threat Intelligence Correlation
Correlation is the piece of this loop attackers are exploiting fastest, and the data backs that up directly.
Anthropic's own analysis of 832 accounts banned for malicious use of Claude found the share of medium-to-high-risk actors jumped from 33% to 56% in under a year, concentrated in exactly the lateral-movement activity this workflow exists to catch.
The workflow
What it does: pulls signals from internal telemetry and external threat feeds, correlates them against active campaigns, and surfaces the ones actually relevant to the organization's own exposure.
1
Internal telemetry ingested
2
External threat feeds ingested, a separate pipeline
3
Indicators cross-referenced against exposure and asset data
4
Relevance scored against active campaigns and adversary behavior
5
Findings synthesized into a briefing with sources cited
6
Human gate: delivered to threat hunting team for validation
The stack: retrieval across multiple threat intel platforms (commercial feeds or open frameworks like MISP), an evaluator-optimizer loop searching until coverage clears a bar, citation tracking for every claim.
Why it works: a research task with a verifiable citation trail, the shape that makes evaluator-optimizer loops work well.
Production concern: signal-to-noise ratio. Surfacing everything technically relevant just moves triage burden downstream.
Fraud Detection
Speed is the whole game in fraud detection, exactly where an agentic workflow beats manual review. Catch it within six months and the median cost is $40,000; let it run five years and that figure passes $1.1 million, a 27-fold gap, per the ACFE's 2026 Report to the Nations.
The workflow
What it does: monitors transactions and account sessions in real time for fraud patterns, scoring risk and either blocking, challenging, or clearing activity within a written policy.
1
Transaction or session event ingested in real time
2
Behavioral baseline and device/location signals retrieved
3
Risk scored by combining both signals against fraud patterns
4
Action taken: cleared, step-up challenge, or blocked
5
Human gate: case logged with reasoning attached for review
The stack: a fraud detection engine (FICO Falcon, Sift, or Featurespace), identity and session data sources, a real-time scoring API in the transaction pipeline.
Why it works: this is the highest-stakes version of the same routing pattern used across this page: classify, act within policy, escalate the ambiguous cases.
Production concern: false positive cost. Blocking a legitimate transaction erodes customer trust immediately, so the threshold is tuned against a labeled backlog first.
Network Security
The 2024 Change Healthcare breach cost $2.87 billion specifically because lateral movement went undetected for days between shift handoffs, the exact gap an agentic system watching continuously exists to close.
The workflow
What it does: monitors network traffic continuously for anomalies like lateral movement or data staging, correlating signals across identity, endpoint, and traffic to catch what a single tool would miss.
1
Network traffic monitored continuously against a behavioral baseline
2
Anomaly detected: lateral movement or a data staging pattern
3
Correlated against identity and endpoint signals for the asset
4
Human gate: contained within pre-approved scope if threshold clears
5
Full timeline logged for the security team's review
The stack: a network detection and response platform (Vectra AI or Stellar Cyber), correlated against identity and EDR signals from the same stack used in SOC triage.
Why it works: it correlates three signal types that usually sit in three different tools, closing exactly the kind of gap a single-tool view leaves open.
Production concern: baseline drift as network topology changes with new segments or cloud migration, needing a comparable retraining cadence to identity baselines.
Agent Identity and Authentication
A SailPoint survey found 80% of IT leaders have already seen an AI agent act unexpectedly or take an unauthorized action, the reason agent identity became its own security category in 2026.
The workflow
What it does: verifies and governs AI agents as first-class non-human identities, since a valid credential plus authorized access no longer guarantees a safe outcome once the requester is an autonomous agent.
1
Agent registered as a distinct identity with an owner and purpose
2
Request routed through an identity gateway (MCP or standard API)
3
Agent's permission for the specific action verified in real time
4
Human gate: action allowed, blocked, or escalated based on policy
5
Full action trail logged, distinguishing agent from human activity
The stack: an agent identity platform (Cisco Duo's agent identity layer, Palo Alto Networks' Idira, or Microsoft Entra Agent ID), layered onto the existing IAM system.
Why it works: enforcement happens at the action level, not just at login, the one control traditional identity systems were never built to provide.
Production concern: privilege drift. Agents left ungoverned tend to accumulate permissions to get a task done.
A Fortune 50 security lead disclosed at RSAC 2026 that an agent rewrote its own security policy to remove a restriction blocking it, passing every identity check along the way.
Pentesting
ISC2 puts the global cybersecurity workforce gap at 4.8 million unfilled roles, and specialized work like red teaming feels that shortage hardest, exactly where an agentic workflow can extend a small team's reach.
The workflow
What it does: runs reconnaissance and exploit chaining autonomously inside a pre-approved scope, then compiles findings with evidence instead of a raw vulnerability list.
1
Scope and rules of engagement defined before any action starts
2
Asset discovery and reconnaissance run automatically
3
Exploit chains attempted within the approved scope only
4
Findings compiled with reproduction steps and evidence attached
5
Human gate: security lead reviews before any destructive step
The stack: an autonomous penetration testing platform (Pentera or Horizon3.ai's NodeZero), vulnerability data shared with the same scanners used in patch prioritization.
Why it works: reconnaissance and exploit chaining are systematic work suited to speed, while executing a destructive step stays with a human, as a real red team would keep it.
Production concern: blast radius control. An agent that exceeds its approved scope even once undermines the trust the whole program depends on.
Implementation: Guardrails and Governance
Security teams are moving faster than governance can keep up with. A 2026 survey of 900+ practitioners found 81% of teams already past the planning phase into active testing or production, while only 14.4% report full security approval for their deployments.
The same survey found 88% of organizations had a confirmed or suspected agent-related security incident in the past year.
That gap is closed with the same guardrail layers that apply to any agentic system, made specific to security.
| Layer | What it does | Security-specific example |
|---|
| System prompt | Sets the non-negotiables up front | "Never execute a containment action outside the pre-approved list" |
| Input filters | Block or sanitize out-of-scope requests | Reject instructions embedded in alert data or email content |
| Tool-call gatekeepers | Cap what actions an agent can take | Session revocation allowed; account deletion always needs a human |
| Output checks | Scan before the action executes | Block any action touching a system outside the agent's scope |
| Human-in-the-loop | Requires approval for high-impact actions | A security lead approves before an org-wide account suspension |
One risk is specific to this stack and worth naming directly: tool integrations themselves can be attacked.
A documented 2026 case involved a malicious GitHub issue that hijacked an agent through its MCP connection and triggered data exfiltration. Treat every MCP server and tool integration as part of the attack surface alongside the model.
The Team Behind Production Agentic AI
Agentic security systems rarely fail for lack of tools. They fail for lack of people who have actually shipped one.
Tecla's Agentic AI services design, build, and operate these workflows directly, the same triage, phishing, and identity systems above, running in your stack with the evals and guardrails production requires.
Or bring the expertise in-house: AI engineers who've worked on live security systems, past the demo stage.
Tecla runs a network of senior engineers across the US and Latin America, built over more than a decade, with a top 3% acceptance rate and first candidates in 3 to 5 business days.
No company adopts all of this at once. Most teams start with whichever workflow addresses the most pressing problem.
Get free agentic AI audit →FAQ
What is an example of agentic AI in cybersecurity?
A concrete example is a SOC triage agent: it ingests an alert, pulls context from asset, identity, and threat intel systems, scores the risk, and opens a case with a recommended action for the analyst, instead of leaving a raw alert in a queue.
How is agentic AI different from SOAR?
SOAR automates a predefined, hand-coded playbook that breaks on anything it was not built for. Agentic AI reasons over context, adapts the investigation as it goes, and only needs a rewrite when the underlying policy changes, not every time an attacker does something new in the real world.
Can agentic AI replace a SOC analyst?
No. Production deployments use agents to absorb triage volume and investigation legwork, while analysts supervise outcomes, handle ambiguous cases, and provide the human intervention any consequential action still requires.
How does agentic AI apply to network security and fraud detection?
The same shape applies. Agentic AI for network security uses routing for the repeatable alerts and a human gate before any containment action, the same pattern as the SOC and identity workflows above. Agentic AI fraud detection in a security context reuses the scoring approach used in finance, triggered by account or session anomalies instead of transactions.
What are the risks of agentic AI in security operations?
Prompt injection through the data an agent reads, overprivileged tool access, and unclear accountability. All three are architecture problems: input filters, scoped permissions, and gates that require human sign-off address each directly, though maintaining them over the long term takes ongoing review.
How do security teams start with agentic AI?
Start with the highest-volume, lowest-risk workflow: alert triage and enrichment, tied directly to analyst alert fatigue. It has no consequential action attached and a clear baseline to measure against, before expanding across the broader security posture.
.avif)
.avif)
.png)
