{"id":26209,"date":"2026-09-21T15:15:58","date_gmt":"2026-09-21T23:15:58","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2026\/09\/21\/working-with-agentic-ai-a-secops-survival-guide\/"},"modified":"2026-09-21T15:15:58","modified_gmt":"2026-09-21T23:15:58","slug":"working-with-agentic-ai-a-secops-survival-guide","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2026\/09\/21\/working-with-agentic-ai-a-secops-survival-guide\/","title":{"rendered":"Working with agentic AI: A SecOps survival guide"},"content":{"rendered":"
\n
\n

Listen to the AI hype machine enough and you will believe that the security operations center of tomorrow will be staffed by a couple of button-pushers, with AI doing all the heavy lifting. Agentic workflows in everything from triage to vulnerability research will wipe out the need for many well-established roles. SOCs will be where cyber careers go to die.\u00a0<\/p>\n

Not so fast, say many cybersecurity veterans. They believe there\u2019s going to be more than enough work to go around \u2014 and that cyber expertise will be more relevant than ever.\u00a0<\/p>\n

The veterans do agree that change is coming, though. CISOs and security leaders will want to build teams and fill talent pipelines with pros who are tuned to work collaboratively with agentic tools, treating them like junior employees. Org charts will be redesigned, role progression redefined, and training requirements radically adjusted, with an emphasis on AI know-how.<\/p>\n

Here\u2019s how your SecOps team can embrace agentic AI \u2014 and survive.<\/p>\n

[ See webinar: <\/strong>How to Build High-Fidelity Threat Intel Feeds for Agentic AI<\/strong><\/a> ]<\/strong><\/p>\n

AI will reshape in-demand skills<\/h2>\n

AI fluency will be a core cybersecurity professional skill, said Diana Kelley, CISO at Noma Security.\u00a0<\/p>\n

\u201cThe best way to future-proof a cybersecurity career right now is to actively learn these systems, understand how they fail, and develop the skills to safely and effectively use and govern them.\u201d<\/em>
\u2014<\/em>Diana Kelley<\/em><\/span><\/a><\/p>\n

Jimmy Astle knows firsthand what agentic AI is going to mean for SecOps in the coming years. Now at the AI agent startup Onebee, Astle was until recently the head of machine learning at Red Canary, where he championed adopting AI agents. Red Canary had no agents in three years ago and today runs 75% of the SOC with agents. \u201cI would say it\u2019ll be two years, tops, before all of investigation and response is just completely automated,\u201d he said.<\/p>\n

While this is going to eliminate the need for Tier 1 triage and response roles, Astle thinks it won\u2019t precipitate security job collapse.\u00a0<\/p>\n

\u201cI don\u2019t care how smart these models are, you need human ingenuity and critical thinking at both the beginning and the end of whatever an agent is doing.\u201d<\/em>
\u2014Jimmy Astle<\/em><\/p>\n

Greg Notch, CTO of Expel Security, said capable security pros will still be needed, though the day-to-day job is going to change, shifting from what he called \u201cbespoke nerdy disassembly\u201d to the herding of agents.\u00a0<\/p>\n

\u201cIf you\u2019re focused on the outcome and understanding that AI is going to make you better at your job, you\u2019re going to be okay.”<\/em>
\u2014<\/em>Greg Notch<\/em><\/span><\/a><\/p>\n

CISOs and SOC leaders are going to be looking for security pros with a systems engineering mindset, Astle said. It will be essential to understand how systems interact and to be able to break it all down into the distinct steps that are the building blocks of a workflow. Those steps directly translate into effective instructions for agents to follow.<\/p>\n

Astle explained that chained processes usually are loaded with burdensome work in the middle that eats up a lot of time but requires little expertise or ingenuity. SOC analysts should be automating those parts of a process, doing what is called \u201cmiddle-to-middle automation.\u201d<\/p>\n

\u201cYou want to figure out \u2026 what is the busy work that doesn\u2019t take human creativity, critical thinking, judgment, and just hand that off to the agent. That way you\u2019re not sitting in front of a screen clicking the same things over and over and over again.\u201d<\/em>
\u2014Jimmy Astle<\/em><\/p>\n

Shimon Tolts, co-founder and CEO of Copperhelm, said the core work of SecOps will shift from execution to verification, adding that analysts who continue to spend their days manually triaging alerts will be automated out of relevance because agents are stuff faster and cheaper.\u00a0<\/p>\n

\u201cThe durable skill is supervising a fleet of agents and knowing when their conclusions are wrong. That is a judgment skill, not a tooling skill, and most current training still teaches button clicking.\u201d<\/em>
\u2014<\/em>Shimon Tolts<\/em><\/span><\/a><\/p>\n

A shallow talent pool<\/h2>\n

Building a team\u2019s judgment skills should be a top priority for forward-looking CISOs, but don\u2019t count on hiring AI-security rockstars; there still aren\u2019t very many of them, the SANS Institute\u2019’s Rob T. Lee wrote in a recent blog post<\/span><\/a>.<\/p>\n

\u201cYou cannot hire your way out of this because the talent pool does not exist yet. All of us are figuring it out at the same time.\u201d<\/em>
\u2014<\/em>Rob T. Lee<\/em><\/span><\/a><\/p>\n

Lee noted that the people already on your team know the business and how real-world incidents look within its environs.\u00a0<\/p>\n

Onebee\u2019s Astle said that while most Tier 1 roles will be redundant, those employees whose daily work is being automated are still of value. \u201cTake those Tier 1 and Tier 2 people and \u2026 get them AI-pilled so that they\u2019re your champions,\u201d he said.<\/p>\n

He said that those employees\u2019 tribal knowledge will make agent training more effective, and they could also be the resources needed to finally whittle down technical debt that\u2019s been lingering for years.\u00a0<\/p>\n

All-new roles are coming<\/h2>\n

Phil Steffora<\/span><\/a>, CSO and CIO at Arkose Labs, said he expects the use of agentic AI to usher in \u201cpurpose-built roles that have no clear analogs today.\u201d\u00a0<\/p>\n

One example, from Astle, is security automation engineer. He also suggested that SecOps pros could move into other security subspecialties such as governance.<\/p>\n

John Gallagher, vice president at Viakoo, has other ideas about how SOC roles will evolve.\u00a0<\/p>\n

\u201cThe future workforce will be smaller in some areas, far more specialized in others, and much more focused on resilience outcomes rather than simply generating detections.\u201d<\/em>
\u2014John Gallagher<\/em><\/p>\n

Steffora said organizations that start building competency around things such as AI fluency and experimentation will be ahead of the game.\u00a0<\/p>\n

He added that org charts need to be rethought from the ground up, accommodating things such as a new apprenticeship path now that Tier 1 analyst is about to go extinct.<\/p>\n

Next steps<\/h2>\n

With big changes in store and uncertainty mounting, CISOs might think they have to wait for a clearer picture. But they can take some team-building actions right away to uplevel agentic skills across their teams. The SANS Institute\u2019s Lee has a suggestion.<\/p>\n

\u201cPick two people who know your environment cold. Give them protected time this month to put AI tools against your own findings backlog and report back on where the tools broke. That is the rewrite starting, in miniature, on your team.\u201d<\/em>
\u2014Rob T. Lee<\/em><\/p>\n

Copperham\u2019s Tolts has similar advice.<\/p>\n

\u201cThe CISOs who win will treat agent output as a hypothesis to be disproven and build teams that get rewarded for disproving it. Stand an agent up against a real test environment and watch where it is confidently wrong. You\u2019ll learn more in a week than in any course.\u201d <\/em>
\u2014Shimon Tolts<\/em><\/p>\n

Calibrating future agentic-aided SecOps workflows will depend on doing that again and again, for hundreds of cycles, which will help teams build up the judgment skills that the next generation of the security workforce will desperately need.\u00a0<\/p>\n

Don’t miss RL board member Doug Levin and co-founder and chief software architect Tomislav Peri\u010din’s discussion about <\/em>developing a playbook for AI-driven software risk<\/em><\/a>.<\/em><\/p>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Listen to the AI hype machine enough and you will believe that the security operations center of tomorrow will be staffed by a couple of button-pushers, with AI doing all the heavy lifting. Agentic workflows in everything from triage to vulnerability research will wipe out the need for many well-established roles. SOCs will be where cyber careers go to die.Not so fast, say many cybersecurity veterans. They believe there\u2019s going to be more than enough work to go around \u2014 and that cyber expertise <\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[32775],"tags":[],"class_list":["post-26209","post","type-post","status-publish","format-standard","hentry","category-reversinglabs"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/26209","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=26209"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/26209\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=26209"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=26209"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=26209"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}