The Agentic Soc Is Not A Chatbot

Walk into any enterprise SOC at 9 a.m. and look at the queue. There will be somewhere between four hundred and four thousand alerts that arrived overnight, and a rota of tier-1 analysts expected to clear them before the next wave lands. The mathematics has not worked for years. A mid-size enterprise generates tens of millions of security events a day; even after correlation and suppression, the alert volume that survives is an order of magnitude beyond what a human team can investigate properly. So teams do what any rational actor does under impossible load: they sample. They work the highs, skim the mediums, and let the lows age out.

The uncomfortable truth is that attackers know this. Post-incident reviews keep finding the same pattern — the intrusion was detected, an alert did fire, and it sat unworked in the queue for eleven days because it was a medium riding behind three hundred other mediums. The detection stack did its job. The operating model around it failed. Detection coverage without triage capacity is not coverage at all; it is a compliance artefact that produces evidence of negligence after the breach.

Enterprises have tried to buy their way out with headcount, offshore tiers, and suppression rules. Each fix decays. Headcount churns, offshore tiers escalate anything ambiguous, and every suppression rule is a small bet that the suppressed pattern will never matter. The queue always wins — unless something other than a human works it.

The average enterprise security stack now counts between forty-five and seventy-five tools. An analyst investigating a single suspicious login touches six of them: the SIEM for the alert, the identity provider for auth history, the EDR console for host state, the cloud console for API activity, the ticketing system for context, and a threat-intel portal for reputation. Each hop costs minutes, a login, and a mental context switch — and each tool speaks its own schema, so the analyst becomes a human ETL pipeline, joining datasets in their head at 2 a.m.

Vendors sell integration as the answer, but a webhook that copies an alert from one queue to another is not integration; it is duplication with extra latency. The join the analyst actually needs — this identity, across these five systems, over the last ninety days, compared against its own baseline — does not exist in any single console. It has to be rebuilt by hand for every investigation, which is why an investigation that should take ten minutes takes four hours.

The strategic cost is worse than the operational one. Because context lives in fragments, every conclusion is provisional. Analysts hedge, escalate, and re-investigate, and CISOs discover during incidents that their seventy tools produce seventy partial stories and no authoritative one.

Industry reports put median attacker dwell time somewhere between ten days and three weeks, depending on the year and the dataset. Consider what that number means: for two weeks, an active adversary moved through an environment that was instrumented, monitored, and staffed — and nothing connected the dots. Not because signals were absent, but because they arrived as disconnected alerts, each individually dismissible, spread across shifts and consoles and time zones.

Mean time to respond tells the same story from the other end. When an alert finally is worked, the clock has usually been running for hours. The alert waited in the queue, then waited for escalation, then waited for someone with cloud access, then waited for change approval to contain. Attackers operate in minutes; enterprise response is structured in handoffs, and every handoff is a queue.

The pattern that closes breaches fast is always the same: someone assembled the full chain — initial access, persistence, lateral movement — into one narrative early. Humans do this brilliantly but slowly, and only for the alerts they actually reach. The enterprises that cut dwell time from weeks to minutes are the ones that made chain assembly automatic instead of heroic.

Every enterprise security team now serves two masters: the attackers and the auditors. SOC 2, ISO 27001, PCI DSS, DORA, HIPAA — each framework wants proof that monitoring exists, that alerts are investigated, that incidents follow procedure, that access reviews happen. Assembling that proof is a quarterly scramble of screenshots, CSV exports, and reconstructed timelines, performed by the same senior people who are supposed to be hunting threats.

The dirty secret is that most of this evidence is theatre. A screenshot of a dashboard proves the dashboard existed on the day of the screenshot. It says nothing about whether the alert at 3 a.m. on a Sunday in February was actually worked, by whom, and on what basis. Auditors accept it because nothing better is usually available, and everyone in the room quietly knows it.

Regulators are tightening. DORA and the SEC disclosure rules ask for operational reality, not intent — how fast incidents were detected, classified, reported. That standard cannot be met retroactively with screenshots. It requires an operating model where every detection, verdict, and response action generates its own tamper-evident record as a by-product of doing the work, not as a separate documentation exercise.

Enterprises that give up on in-house coverage buy MDR, and most discover the same frustration within a year: the service is a black box. Alerts go in, closed tickets come out, and the reasoning in between is invisible. When the quarterly report says '14,000 alerts triaged, 12 escalated', there is no way to verify that the 13,988 closures were sound. You are asked to trust, without evidence, the same category of overloaded human analyst you were trying to escape — just employed by someone else.

The contract structure makes it worse. Response actions require a phone call and a change window. Data lives in the provider's tenant, so leaving means losing history. And when an incident does slip through, the post-mortem devolves into a liability negotiation between your counsel and theirs about what 'detected' means in schedule 3 of the SLA.

None of this means managed outcomes are the wrong goal — 24/7 coverage without building a night shift is exactly what most enterprises need. The failure is opacity. A managed detection function is only trustworthy if every verdict it renders arrives with its evidence attached: the questions asked, the answers found, the weights applied. Transparency is not a nice-to-have in MDR; it is the entire difference between a service and a liability shield.

The modern enterprise attack surface is not a network edge; it is a directory. Tens of thousands of human identities, and — increasingly — multiples more non-human ones: service accounts, API keys, CI runners, and now AI agents with standing credentials. Attackers noticed years ago that stealing a valid credential beats exploiting a vulnerability: no malware, no exploit signature, just a login that looks almost right. The majority of serious cloud incidents now begin with a compromised identity, not a compromised host.

Almost right is the operative phrase. A stolen credential logs in from a slightly wrong place, at a slightly wrong hour, and touches resources slightly outside its habit. Each signal alone is dismissible — which is exactly why rule-based detection drowns: the rules fire on travellers and contractors all day, and the SOC tunes them down until the real one sails through.

Catching identity abuse requires knowing each identity's normal — its hours, geographies, volumes, and peer group — and evaluating every anomaly against that baseline in context. That is a per-entity statistical problem multiplied by a hundred thousand entities, refreshed continuously. No human team maintains that. It has to be computed.