EP278 The Agentic SOC: Are We Measuring Time Saved or Risk Reduced?

Security. Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. We're coming to you from Cloud Next 2026. We're in the PwC space. Your hosts here are myself, Tim Peacock, and Anton Chuvakin. We're joined today by Matt Grigson, a principal at PwC UK. Is that right? You're UK-based?

US.

US. Oh, US-based.

You can tell from my accent.

I'm from US. Pulled me on that one. Anton, you have the first question, I think.

I do.

And it's next. There are all sorts of announcements about agentic defense, agentic SOC. And I kind of want to start like a very softball question. In your opinion, what's the state of the art of agentic SOC? Or what have you seen? And I think Tim wanted to ask, what's the most agentic SOC you've seen? So don't answer that one maybe, but I feel like it's a good way to phrase it.

Yeah, so I think some of the announcements we've seen today, they're exciting. We are going to get to a— I think we're starting to see how this agentic SOC is going to become a reality. I think right now, well, I'm seeing sort of 2 ways of how agentic's being used and AI in general rather than just agentic. I think we've got a component of AI as a copilot type of scenario where analysts can ask through a chat interface questions about what are my detections, what are my alerts, things like that, get some trend reports. And that's being enabled through a Gemini platform tied to an MCP server of a SecOps platform. So that's the Copilot-type model I'm seeing. And then on the second side, I'd say this is still in a lot of organizations in pilot mode or just starting to think about how we get into production. And that's more about where in my SOAR pipelines and workflows, where do I plug in the agentic piece?

Mm-hmm.

Now, for some clients, that might be an LLM making a decision after being passed through my deterministic pipelines, the context of threat intel and the host and the identity. I think in those other cases, it may well be trying to think through, okay, how do we do containment? How do we get the agent to take action? And I think organizations are still trying to feel through how do we get comfort before we allow that fully autonomous vision that I think we're all looking forward to and think we need to get towards.

I think full auto including remediation Is rare. I'll just be like, rare. Yeah.

Like, are you vying for understatement award today?

I'm vying for the understatement of the year prize. This time I want to get it after all. But it is the full auto to confirmation, full auto to hand off to a team of humans to resolve. I mean, even in the SOAR days, there was full auto workflow sometimes. I remember again from my analyst days, phishing email response would sometimes go full auto to immediate email deletion. So full auto. Has worked in security in certain contained boxes.

Yes.

So we just make the boxes bigger and make the environments more amenable to full lockdown.

This is what I call the agentic Overton window.

Ooh.

This is the window of possible acceptable agentic response behavior. And I think our mission as an industry and as a software vendor who builds agentic things, my mission is to increase the size of the agentic Overton window over the next 3 years. So I want to talk about agentic and the upsides of it. And I'm not very smart, so I like to ask a very simple question. What gets better when we become agentic? For a SOC team, for a SOC leader, for a CISO, for a board, whichever of those 4 levels you want to talk about, what gets better in an agentic SOC?

I think depending on which way you're viewing this, if you're the board, I think your risk is going to get reduced by the use of an agentic SOC. I think your time to response, time to remediate is going to really increase. And if we can do that in a way—

The time would shrink, I would assume, right?

Shrink, yeah.

Sorry.

The goodness of the metric would increase. The metric itself would increase. The outcome is what we're looking for, right? And I think that's where we can get to. I think as we see, you know, a lot of evolutions in how the models are working and the changes in the threat landscape, that means we're going to see maybe more zero days possibly, which means—

Possibly.

I mean, certainly. Certainly.

Yeah. That means clients are going to have incidents. We're going to have threat actors who are AI-enabled that can move through an environment very, very quickly, lateral movement, privilege escalation. So we are going to need that agentic piece to fit in to take remediation actions on our behalf.

As a very quick point. So before people blame us for proliferating hype, I feel like occasionally people get triggered, newly triggered by the whole AI-enabled attacker. But there is very hard, measurable reality behind what we meant. If somebody has a little zero-day factory where they crank the handle of a model and zero-day comes out and they need one tomorrow and they crank a handle and it comes out, it is very much an AI-enabled attacker. And it's very different from the person who needs to research for 6 months to get a really hardcore zero-day.

Or to spend a quarter million dollars.

Or to spend a quarter million dollars to buy one.

Which they might do turning the crank in that zero-day factory, depending on how those— True.

So in this case, we are genuinely— we are talking about something very genuine. This is not an excuse, as somebody joked, oh, it was a sophisticated attacker. And now we can say, oh, it was an AI-enabled attacker. What can you do? Like, that's actually already happening. I have seen from my— but this is something very precise, grounded in facts that it is— that changes the downstream stuff.

Yeah. In a lot of cases, though, when we talk about AI-enabled attackers, they're still using kind of like well-known and documented like attack paths, right? They are still dumping LSASS, and we have ways of detecting that. So I think we have, there's a lot of doom right now, right? You know, we're in meltdown almost over some of the, wherever this is going. But I think there is some hope in the sense that we have the opportunity to detect these paths once the initial access has been obtained.

Yeah.

And we can use that, and that agentic SOC piece I think will come through for us.

I was this close to saying, yes, there is good doom and bad doom. And of course, that line does not land. So what I really want to say is there is scary hype, but there's also scary reality behind some of this. Like we talked about the recent event about the patching speed being behind and all that. But it's the reality of it leads me to think what would be the role of humans. And as I sometimes say, imagine that we are in 2030 SOC or 2030 detection and response.

Which is only 4 years away, let's face it.

Which is, by the way, Tim wisely reminded it, it's not some kind of remote future where we fly Actually, maybe we will. No, it's quite close. But what do humans do in that—

Can I give you a brief aside? I sometimes do this. I love words. The word doom didn't originally just mean bad things. It just meant outcome. And so doom actually used to be good or bad.

I could have done the good doom thing.

You could have good doom 800 years ago. So please tell us about the good doom and the bad doom 4 years from now, not 800 years ago.

So what did the human do?

Yeah.

What's the doom of the human?

I think the human is going to be— well, we still have humans, thankfully.

Right. I'm aware of that.

But I think there's a lot of— there's some of the marketing we see right now is tier 1 is going away. I think tier 1 is going to be reimagined how we're going to use these analysts and how that operates. I think it's more of an agent supervisor type role when agents have taken action to maybe contain hosts and contain identities. Well, We still want a human to review that. We want to review what actions agents have taken. They are taking actions at great speed. So there's a sort of an agent supervisor role.

Mm-hmm.

I think there's more of a role around detection engineering and automation, trying to build that out. So it's less of a triage-type role. It's more of the supervision, automation engineering, and really staying close to the threat landscape as well and how that evolves. So that we are building those detections and those automations and making sure we've got the agents able to respond to that evolution of the threat landscape.

I'm going to have something really odd to do. So we are 3 of us. We've dealt with this domain for quite some time. Some are, you know, have gray hairs and all that. But deep in our hearts, it's 2030. Does it mean that there are no SOCs when humans do alert triage manually?

No, no way.

I'm sorry I'm asking this because I honestly don't know what I would answer. Really?

You think they will all adapt in the next 4 years?

People use mainframes and PHP.

Exactly. Yeah. That's why I think there will still be humans doing tier 1 in 4 years.

Yeah.

I think there will be humans doing tier 1 in 10 years.

Like we were talking about doomsday and now I'm actually depressed. Doomsday did not do it, but this bit did.

I think we all want a revolution in how we do this, but it's probably going to evolve.

Yeah.

Right. That's how it's going to do. And we still have organizations out there who still don't have phishing-resistant MFA, still not patching. Like we have a lot of problems in the industry that we've not tackled. And the idea that we're just going to click a button and then we've got an agentic SOC that solves all that. We still have to do the hard security work to get some of the benefits of the agentic SOC.

Anton, what do you always say is the strongest force in the IT universe?

IT inertia. That was my main lesson after 8 years at Gartner is that IT inertia is the strongest force in the universe.

So 4 years from now.

But I'm listening to this time it's different crowd that says because we have AI intelligence, models. There is a pretty strong— and we are going way too far afield, but it's kind of important— They're one of our questions. That it's the, the this time is different crowd is very strong and very loud and not only on Twitter. So I hear them and some of them have PhDs in computer science. Some of them are AI scientists and I can't just dismiss them. So I constantly have second thoughts about my point about IT inertia. So I honestly hoped you would say that by 2030, Nobody does alert cache by hand. I'm sorry, I'm channeling my not me internally because I kind of thought by 2030—

This is unusually optimistic for you.

It is really unusually optimistic. You're right.

Huh.

I mean, I wonder what it means.

I don't know which Anton flew to Vegas last night, but it's not the Anton I usually know. So I want to ask a question about helping clients modernize their SOCs. Yeah, we did an amazing episode last year with Manisha at a bank where she worked with PwC for that modernization. You're helping people do this day in and day out. How do you know when somebody's ready for agents? What's the, like, you must be this mature to ride the agent ride?

I think there's a few different components that come together to get the most out of an agentic type SOC. And you can start from nothing and you will have some success at agents. But for me, that success, you know, could be greater if you had some prerequisites, right? Yeah, what are the prerequisites? And more of a sustainable agentic SOC as well. I think first of all, it's having a data platform where we have the data in there about our hosts, our identities, so that we can do the enrichment that we need. I think we need our core services integrated into a platform that allows us to very quickly take actions in firewalls, take actions in IDPs.

By the way, you said platform. You didn't say platforms or many tools. This is a really good point. So you hint at centralization rather than decentralization. Yes, absolutely.

And for me, like, if we think about the, when we apply the agent in the SOC, I still see value in alerts being triggered that executes a playbook that takes deterministic actions, does the enrichment, does the threat intelligence lookups, all that good stuff. Then it engages the agent piece. And if you've got good processes about how you investigate that you can sort of prompt the agents on and give them that, I think that's the key to success.

So having good, properly deployed and implemented SOAR in your mind is a success criteria for AI SOC. This is probably something that's worth discussing. I don't want to say, no, you're wrong. I agree with you. But I'm afraid people would show up with pitchforks and say— Yeah.

And there's certainly a view that, you know, once an alert triggers, you can execute an agent and it will work, right?

But money.

The tokens.

Tokens.

Sorry, not capacity.

We use this euphemistic term tokens, but we really mean money.

Yeah.

Monetary tokens, listeners.

The cost of that. And then if you think about, like, let's say that agent does not execute the way you want to and then your human needs to come back in, your human is going to start back from the beginning at the alert. You actually want the human to be able to very quickly go in and inspect. And if you've already got that enrichment that it's executed and it all in one place, that single pane of glass, there's still value in having that, I think.

So you two made a really interesting point in your conversation over lunch about speed. Could you share with our audience your perspective on AI speed versus deterministic SOAR operation speed? What was the argument you made there?

Well, we were talking about how if we work on the basis that we're going to have more zero days that will lead to incidents at clients and that they gain initial access, there will still need to be privilege escalation, lateral movement, all those activities. Those are going to be AI-assisted likely. That means we're going to move very, very quickly. Some of those behaviors and techniques are going to be noisy that we can respond to very, very quickly using deterministic pipelines. And I think that's going to be a quicker way of operating in a lot of cases than applying the agents. I think agents have absolutely got a role to play, but we need to evaluate where do we apply the agent in those techniques.

I think the interesting thing in here, listeners, is there's some kind of hierarchy of Humans are very slow, agents are quick, but deterministic streaming detection pipelines or deterministic streaming response pipelines can be very, very, very fast and not constrained by tokens.

And this is literally the slide we have at the Narasei show was like the AI box was kind of in the middle and deterministic automation was something that you ideally want to move some stuff to, even if you start with AI. And a lot of people were very triggered. They said, no, no, no, we want AI to be the ultimate But ultimately, if you use AI to create deterministic automation and it works, this is important, it is cheaper, faster, and better.

Are you, Anton, implying that AI is not the end-all be-all and it's another tool that we should be intelligent about how we use? That's a radical thought around here.

No, that's a radical thought. So I'll be a little careful with the radical thoughts at this point. But the less radical part of this is that some of the stuff costs money, or as you pointed out, tokens.

Tokens.

Yeah.

Have you described an architecture where an LLM is in a chain towards the later end of the pipeline? And I met people, maybe not quite crazy people, but very enthusiastic, optimistic people who want to shift it left towards raw data.

And we had a guest who was doing that. We had a guest last season who was piping cloud audit events into their LLM. Do you remember that guest?

I do. And mostly he survived to tell the tale.

Yeah. Yeah. So you should ask our present guest the next question though, because we've gotten very far afield.

What was the question?

The logic behind LLM being later in the chain, because of cost and accuracy reasons.

If you think about when an alert triggers and we have those pipelines, some of those pipelines may just lead to auto-close or auto-remediate. We don't need an LLM for that.

No brain needed. We flowchart.

We don't have to apply AI to absolutely everything we do. ways of detecting certain types of threats and we have high confidence in those that we can take that action immediately.

Yes.

Regardless.

This stuff works. This stuff has worked and this stuff can work and it does work.

But not everybody's got that.

It didn't stop working.

Thank you. Exactly. Yeah. And not everybody has got that in place. Not everybody has built out these SOAR playbooks that take those actions.

Right. There are people still living below that line of security maturity capability.

I work with organizations where they have alerts and then analyst jumps into the alert and then starts doing the manual threat intel lookups. They're in all sorts of different portals looking things up. Like, that's a great opportunity to build out that SOAR workflow first and then figure out where can I apply the agent in there to take the human out of the loop and more on top and looking at the sort of the supervisory role.

That makes sense. And I want to shift in a somewhat odd direction. Again, it is from the prepared list, but oddly enough, on the flight today, I guess, I was reading a book about AI. And in the book, the author was complaining about how people anthropomorphize AI and brought the usual hesitation. And then he suddenly says, but actually, when I work in my company, whatever, I prefer to think of AI as a teammate. And I know I just rambled about not anthropomorphizing, but I noticed that practically, if I think of AI as a teammate, I just get better results. And this to me was really interesting. And it brought up in the SOC AI teammate? Like if you have an agent, machine, robot, something that's a LLM or modern AI brain, would you think of this person as kind of a teammate? And you can say, hey, why did you do this? Why did you block access? Or would you think of him, of it, sorry, now I'm anthropomorphizing. Would you think of it as kind of a machine workload or robot? And does it matter?

Ooh, does it matter?

It doesn't matter is important.

Yes. Because I do like the concept of a teammate who is sort of an agent. And I think that goes back to what I said earlier, that what I'm seeing is you have that teammate type of AI in the SOC, and then you've got the AI within the pipelines and the workflows. And I think if you can have that AI agent that is almost like a copilot with you, that is clued up into your threat intelligence platforms, it is clued up into your security operations stack, I think that is a good way of asking questions, getting answers, and almost like a teammate. Hey, can you check this quick?

Can you check this?

Tasks today. that take up a lot of time and you've got to delegate them. Like, that I think is a legitimate role and something that is achievable right now.

Yes.

Whereas some of the more the workflow things, I feel like we need to get a little bit further down the path on like better governance and better sort of like understanding and criteria of what we want it to do, opposed to the Copilot piece.

I like it.

As a funny aside, I asked a group of security leaders at our customer advisory board on Monday, How are you preparing for these incredibly productive yet very naive teammates to join your security teams?

Right.

And one of my colleagues immediately says, Tim, don't worry about it, we do fine with you. So shout out to Wendy for a very good joke at my expense. I want to ask a question about hallucinations. Should we be, as an industry, more worried about AI hallucinations or human fatigue in our socks of tomorrow?

Which is going to be worse? Well, think DNA. Context is still sock DNA, not philosophically in general.

Yeah, not in general. Literally for the problem of responding to alerts, are we more worried about hallucination or fatigue?

I think it's more on the— and maybe hallucination is the wrong term. I'm not seeing as much hallucination in some of the newer models as we previously were. What I am seeing is more in very noisy environments where there's a lot of telemetry, the AI gets the wrong end of the stick.

Say more.

Where it's seen certain activity and that is normal in that customer's environment. Whereas, and it's concluded it must be malicious. It doesn't have the broader context to understand actually.

That's called a false positive last time I checked.

Well, yeah, but from an agentic piece, like we seem to feel like we can just throw anything at it and it'll just magically come up with The correct consensus. Yeah. So I feel like that's sort of more the concern. And if you think about where we're applying the LLMs, if the goal is to have more autonomy with them, what decisions will be made based on that sort of false positive or whatever it is? So for me, I feel it's more of the hallucination style versus the human fatigue.

And one follow-up to that is, where are we on humans getting fatigued of AI? How's that going so far?

It's Google Next. We're all happy to see AI.

We're not allowed to talk about AI fatigue here?

No, we're allowed, but like—

Okay.

I don't think we are quite there yet.

We're not there yet.

I'm not trying to put words in your mouth, but I mean, we're scratching the surface in some cases.

There seems to be evolutions in what's happening in the industry every hour. It's really exciting. I think we've got a real good shot at solving some real big security problems that we've had. You know, we've gone through very, very large breaches over the last few years. And we always say this time it's different. We've really got to get on top of this. But I feel like with some of these emerging models, we really do have to execute on some of the defense-in-depth plans that we've had. AI is gonna play a huge role in that. It's not the only role. Like we have to execute on some of the fundamental security practices that we've been talking about for a long time.

Yeah. I mean, to remember the Heather episode, right? And I think her other public speaking, Heather Atkins from Google, she has a very well-grounded opinion that with these machines, with these tools, we can produce only secure code in certain buckets. And again, I'm not an AppSec person, so don't trust me, but Heather is. And so I feel like the AI fatigue is not a thing. I mean, if we achieve even some of the same results.

Fair enough.

Maybe you got some kind of positive marketing Anton today. So I don't know why.

Yeah, I'm really worried about what's in your water supply.

Yeah. We should start thinking about closing. We should get to the point. But I think that the value argument is still there. Like, what gets better, you already asked, but like, Like the time savings come up as typical clients who want to save time or maybe their team is overworked or doesn't do enough.

Yeah.

Like, how are you thinking about it? Because ultimately what I want to say is people are obsessing about MTTD and MTTR and occasionally that leaves them in a really odd place, which maybe isn't very productive. Like, I have nothing against measuring this, but I have some things against judging people But what are the metrics we can use for the agentic SOC? Isn't it a perennial theme? We had it in many episodes. Yeah. Yeah.

Agentic SOC metrics, please.

Yeah. So I think the metrics we have today are still going to be really important. I think we also want to be thinking about the number of human touches on cases. What, you know, how automated is our detections and our response playbooks? I think the one that's going to be really key is mean time to respond. Like, you've got to get that number down.

Respond.

Just because at the speed at which we think, we assume threat actors will be using AI within client networks.

What about the cost? I mean, not the cost of tokens. I'm going somewhere more interesting. Like, we may live in a world where deterministic automation is 1 cent per shot, AI is $10 per shot, and human is $100 per shot. So you can assemble a system which achieves absolutely best outcome, at a minimal price. If you have 3 tools, one of them costs a tiny amount, one of them costs average amount, and one of them is highly costly, like inviting a top tier.

Some clever consultant might even build an Excel model that lets you turn these knobs and work out, you know, a graph for all that.

That's something we're looking at is what is the cost to actually take an alert right the way through remediation? Yes, this is absolutely this that I wanted I think we automatically assume that we've got to use the latest and greatest models, whereas actually that's not the case. We've found really good success in models that were out a year ago. The flash models have a really important role to play, certainly within like event summarization. So I think when we start building these out and we've got these governance frameworks in place and we're getting the observability, we can really do a lot of backtesting to figure out what is the lowest cost model that gives me the best outcome.

That gives you the best outcome. Yeah.

Yeah.

So this is actually what I want to see a lot more of. And I think we have that and we've had it for a while. Like, we can judge the cost of a signal at Google. But I noticed that a lot of clients basically look at me with big round eyes and say, I don't understand, how can you do this? But we can do this. But I think I want other people to actually make this happen based on what you're describing. Like, this needs to be something that people say, oh yeah, yeah, this is like $10 alert and this is $0.02 and this is why we are handling this. Like, it needs to be normalized.

Yes, we need to have a lower alert budget.

I have these charts from our teams. I mean, they have like, this is $1.59 and this is actually backed by data.

Yes.

But it is, which is such an extreme outlier in this.

And there's going to be certain alert types that we probably can just run through deterministic pipelines and we don't really need the LLMs there. And actually in more high-risk scenarios where we do need to take immediate action, we are willing to spend that extra on Some of the latest models.

Yeah. High stakes. It's all humans met together for coffee for 4 hours and costs be damned. I mean, that's— yeah, that's there.

So I hate to do this because I think we're having so much fun. You'll have to come back on the show and spend more time talking about this. Have to ask our traditional closing questions. One, do you have recommended reading for our audience? And it could be anything out there except Anton's blog. And then 2, do you have a piece of advice to help people get ready for their agentic adoption journey?

Reading, I would suggest that people get on Twitter. There's a lot of great conversation there. Thank you.

No, don't encourage Anton's Twitter addiction. This is terrible.

But seriously, I follow some great people. And the algorithms that make these things highly addictive do bring out some amazing information about what's happening on the threat landscape, but also what's happening on the models, and also how people apply this. So I think that community has got some great people in it giving some great advice. And then how people can get involved and—

What should they do to get ready for this?

To get ready? Well, I think you should be getting involved and testing and developing your own agents. Like, it is remarkably easy to build an AI agent. It's remarkably easy to hook it up to an MCP server that you may already have or services that you own have already published and just seeing the art of the possible. Start small, ask it a question about the data that sits within these systems. And very quickly, I think you'll find the art of the possible is there. And then start thinking through, okay, well, how do we now embed this? And what do I need to get comfortable to let this run?

Well, listeners, if you're on SecOps, we've got the embedded MCP now. We've got that in chat. Lots of opportunity there. Thank you so much for joining us today. Anton, what was your anthropomorphizing book before we close? I want to know what that's about as well.

I'll put it in the notes. You'll put it in the show notes as well. Yeah, but it's just, it did change my thinking about this and it's kind of telling. So, I'll put it in the show notes.

Okay. Book coming in the show notes that changed Anton's thinking. Thank you so much for joining us today. And now we are at time. Thank you very much for listening and of course for subscribing. Please subscribe so you can get new episodes piping hot and if you love our content, Please drop us a review on your platform of choice.

You can find this podcast on YouTube, Apple Podcasts, Spotify, or wherever you get your podcasts. Also, you can find us on our website, cloud.withgoogle.com/cloudsecurity/podcast. You can argue with us on the Google Cloud Security Community site, googlecloudcommunity.com.

You can follow us on X, x.com/cloudsecpodcast. Tweet at us, email us, argue with us. And if we like or hate what we hear, we can invite you to the next episode. See you on the next episode of the Cloud Security A podcast by Google.

Security.