Sekoia outlines AI agent roles in new ISOC security model

Sekoia released a report detailing how artificial intelligence agents are entering security operations centers to manage high-volume data and repetitive tasks. The analysis highlights the shift toward Integrated Security Operations Centers, a category defined by Gartner that aims to consolidate cybersecurity capabilities into single platforms rather than disjointed toolsets.

What is the ISOC model?

Gartner established the ISOC category to address the limitations of traditional Security Information and Event Management systems. While SIEMs have existed for nearly two decades, they often require teams to connect separate tools. ISOC solutions integrate core SIEM functions, such as data ingestion and normalization, with Cyber Threat Intelligence and Security Orchestration, Automation and Response in one environment.

How do AI agents fit in?

AI agents support various stages of the SOC workflow, including triage, investigation, and detection engineering. These agents can process large amounts of context and computing power faster than human analysts. According to Sekoia’s Chief Solution Officer David Bizeul, the goal is to have agents work either autonomously or alongside existing teams to improve overall operational efficiency.

What is the human role now?

Human analysts will work at a higher level by focusing on critical thinking and skepticism. They cannot compete with AI on speed, but they can challenge investigation results and identify new threat actor behaviors. Analysts act as mentors to the AI agents, bringing new approaches and hidden environmental insights that the agents may miss, ensuring a collaborative dynamic.

What are the operational benefits?

Applying AI agents to specific SOC workflows removes painful, repetitive tasks that analysts have handled for years. This allows teams to investigate faster and reduce alert fatigue. The model enables human experts to dedicate more time to judgment-heavy decisions while agents manage the volume of data and initial response steps.

Questions to ask your suppliers

Teams usually verify whether vendor platforms support integrated workflows or rely on point solutions. Check if the supplier explains how AI agents assist with triage without replacing human oversight. Determine who inside the organization needs to validate agent outputs before escalation. Ensure the supplier provides clear documentation on how human analysts can mentor and correct AI reasoning within their specific operational context.

Background: AI agents

AI agents are software systems that perceive their environment, make decisions, and execute actions to achieve specific goals. They move beyond generating text to performing tasks like coding, scheduling, or data analysis. You must treat them as active participants in your network, not passive tools.

Read the full guide: AI Agents Examples: How Autonomous Software Changes Security

What to do and how to stay safe: Sekoia

• Review current SOC workflows to identify repetitive tasks suitable for automation.
• Evaluate whether your current SIEM supports integrated CTI and SOAR capabilities.
• Train analysts on critical thinking skills to effectively oversee AI agent outputs.
• Monitor vendor roadmaps for ISOC compliance and AI agent integration features.

Step-by-step guide: AI Usage Policies at Work: How to Prevent Data Leakage

General security guidance from the TechSec Feed newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is Gartner's ISOC category?

ISOC stands for Integrated Security Operations Center Solutions, a new category designed to challenge traditional SIEM models by combining multiple cybersecurity capabilities into one platform.

How do AI agents help SOCs?

AI agents help by investigating at greater speed, handling repetitive tasks, and supporting triage, investigation, and detection engineering within the SOC workflow.

Do AI agents replace human analysts?

No, human analysts work at a higher level, focusing on critical thinking, skepticism, and mentoring the AI agents, while agents handle speed and volume.