Agentic AI in Security Operations: The Opportunity Nobody Prepared For

What Agentic AI Actually Is

Agentic AI is not a chatbot with a nicer interface. It is a system that independently plans, decides, and takes actions to achieve a goal. The ACSC's May 2026 advisory defines it as AI that uses large language models combined with external tools, data sources, memory, and predefined workflows to complete tasks with limited human involvement. It can adapt its behaviour based on context, create subtasks, and even spin up subagents to handle pieces of a larger job.

Think of it this way: a traditional AI model answers a question. An agentic AI system identifies that a question needs answering, figures out what information it needs, pulls that information from multiple sources, cross-references the results, decides on a course of action, executes that action, and then evaluates whether it worked. All without a human clicking "next" between each step.

That autonomy is the whole point, and it is also the whole problem. When you reduce human involvement in the loop, you gain speed and scale. You also lose the natural checkpoint that catches errors, misinterpretations, and malicious manipulation. The ACSC is blunt about this: agentic AI introduces additional risk precisely because of that reduced human oversight.

The Security Use Cases

Despite the risks, agentic AI has genuine, practical value in security operations. The ACSC maps specific use cases across its ISM framework. Three stand out for security teams.

Threat Detection and Triage

In the Detect function, agentic AI can run inside a SOC platform to correlate DNS queries, API calls, and network flow data in parallel. Instead of an analyst writing a query, waiting for results, adjusting the query, and repeating, an agentic system can orchestrate that entire investigative loop. It pulls from multiple data sources, identifies patterns that cross traditional tool boundaries, and surfaces the findings with context already attached.

For resource-constrained teams, this is the difference between catching an attack in progress and reading about it in a post-mortem. The system does not replace the analyst. It compresses the time between "something looks odd" and "here is what is happening, here is the evidence, and here are the likely next steps."

Incident Response Surge Capacity

In the Respond function, agentic AI can sequence response actions, draft incident updates for stakeholders, and augment surge capacity when an incident overwhelms the on-call team. When a breach kicks off at 2 AM and your three-person SOC is drowning in alerts, an agentic system can triage incoming signals, group related alerts into a single incident, suggest containment actions, and prepare a status report for leadership before the first coffee is brewed.

This is not theoretical. Large enterprises are already deploying these capabilities. The key constraint from the ACSC: any AI-assisted action must be traceable and reviewable. You need to know what the AI did, why it did it, and be able to reconstruct that chain of reasoning after the fact.

Recovery Automation

In the Recover function, agentic AI can trigger automated recovery actions like restoring from backup, reconfiguring firewall rules, or rotating compromised credentials. The ACSC draws a hard line here: human approval is required for any destructive or irreversible changes. An agent can prepare the recovery plan and queue the actions, but a human must confirm before the system tears down a compromised instance or wipes a tainted database.

That boundary matters. Recovery is where speed and caution are both critical. Agentic AI gives you the speed to prepare and execute routine recovery steps. Human approval gives you the caution to avoid making a bad situation worse.

The Risks

The same capabilities that make agentic AI useful in security operations make it dangerous when deployed without controls.

Reduced Human Oversight

The ACSC's primary concern is straightforward: less human involvement means less human catching mistakes. An agentic system operating at speed can execute dozens of actions across multiple systems before a human notices something is wrong. If the system's goal is misaligned with the organisation's intent, even slightly, the scale of impact multiplies fast.

Unverified Actions

Agentic AI can chain tools together in ways that were not anticipated by the developers of any individual tool. An agent might query a threat intelligence feed, use the results to trigger a firewall change, and then send a notification to an external partner, all as part of a single workflow. If any step in that chain is based on a flawed inference, every subsequent step compounds the error.

Cascading Failures

Because agentic systems can create subtasks and subagents, a failure at one level can cascade through an entire operation. A misconfigured subagent might block legitimate traffic, which triggers alerts, which the parent agent interprets as an attack, which leads to further containment actions. The ACSC specifically flags this risk: interdependent agentic workflows can amplify small errors into major incidents.

Model Poisoning and Adversarial Manipulation

NIST AI 100-2 E2025 provides a taxonomy of adversarial machine learning attacks that is directly relevant here. An attacker who can influence the training data or prompt inputs for an agentic system can steer its behaviour in subtle ways. Google's Threat Intelligence Group identified PROMPTSPY, autonomous malware that uses agentic capabilities to evade detection and adapt to defences in real time. Research from the University of Illinois Urbana-Champaign (2024) showed that GPT-4 can autonomously exploit known CVEs at an 87% success rate. The offensive side of agentic AI is advancing as fast as the defensive side, possibly faster.

Governance Principles

The ACSC does not say "don't use agentic AI." It says use it with tight governance, clear limitations, and strong human oversight. Based on the ACSC guidance and the broader regulatory landscape including ETSI's EN 304-223 global cybersecurity standard for AI, here are the principles that matter.

Human-in-the-Loop for State-Changing Actions

Any action that changes the state of a system, whether that is closing a port, quarantining a host, or deleting a record, requires explicit human approval. Agentic AI can recommend, prepare, and queue these actions. It cannot execute them without a human saying yes. This is the single most important governance rule, and it is non-negotiable.

Sandboxing

Agentic AI systems should operate in sandboxed environments where their actions are constrained to approved tools and data sources. The ACSC guidance is clear: define what the agent can and cannot access, and enforce those boundaries at the infrastructure level, not just at the application level. If an agent should not be able to reach production databases, that restriction needs to exist in the network layer, not just in a configuration file the agent might modify.

Traceability

Every action an agentic AI system takes must be logged with enough detail to reconstruct the decision-making process. That means capturing the inputs the agent received, the reasoning chain it followed, the tools it invoked, and the outputs it produced. IBM and Ponemon's 2025 research found that 97% of breached organisations lack AI access controls. You cannot secure what you cannot see, and you cannot audit what you did not log.

Least Privilege

Agentic AI systems should have the minimum permissions necessary to perform their designated tasks. If an agent's job is to correlate logs and surface anomalies, it does not need write access to the firewall. If its job is to draft incident reports, it does not need the ability to send those reports externally. Gartner's 2026 data shows enterprises spend 17 times more on AI tools than on securing AI itself. Least privilege is free to implement and expensive to ignore.

AI-Specific Incident Response

Your incident response plan needs a section for AI-specific incidents. What happens when an agentic system goes rogue? Who has the authority to shut it down? How do you revoke its credentials? How do you recover from actions it already took? These questions need answers before deployment, not during an incident.

The Vendor Questions

The ACSC includes appendices (A and B) with specific questions organisations should ask vendors who are embedding agentic AI in their products. These are worth quoting directly in spirit if not in letter.

Ask your vendors: What actions can the AI agent take autonomously, and what requires human approval? Can you show me the audit trail for every action the agent has taken in the last 30 days? How is the agent's behaviour constrained, and who controls those constraints? What happens to the agent if it loses connectivity to the control plane? How do you protect the agent's prompts and memory from adversarial manipulation? Has the agent been tested against the NIST AI 100-2 adversarial taxonomy? What is your process for updating the agent's behaviour when a new threat or vulnerability is identified?

If a vendor cannot answer these questions clearly and with evidence, that is a signal. Agentic AI in security products is a feature that carries real risk, and vendors who take that risk seriously will have ready, detailed answers.

What SMBs Should Do Now

Small and mid-sized businesses do not have the luxury of building agentic AI systems from scratch. That is fine. The practical path forward looks different than it does for a Fortune 500.

Start With Embedded AI in Existing Tools

Do not chase frontier models. Start with the AI features already built into your existing security tools. Most major SIEM, EDR, and SOAR platforms now include AI-assisted detection and response capabilities. These embedded features come with vendor-managed guardrails, which means you get the benefit of agentic AI without taking on the full governance burden yourself. Turn these features on, configure them conservatively, and learn how they behave in your environment before expanding.

Document Your AI Use Cases

Create a simple inventory of every place AI is touching your security operations. That includes AI features in commercial tools, internal scripts that call LLM APIs, and any third-party services that use AI to process your data. You cannot govern what you have not catalogued. This inventory does not need to be complex. A spreadsheet with columns for tool name, AI capability, data it accesses, and human oversight level is enough to start.

Enforce Least Privilege From Day One

Every AI-enabled tool in your stack should run under dedicated service accounts with the minimum permissions necessary. Do not reuse admin credentials for AI agents. Do not give an agent read access to systems it does not need. Review these permissions quarterly. Gartner's 17x spending gap between AI tools and AI security suggests that most organisations are skipping this step. Being in the minority that does it is a genuine competitive advantage.

Test Your Fallbacks

Agentic AI systems will fail. They will produce false positives, execute on flawed reasoning, and occasionally do something unexpected. Your fallback procedures, the manual processes that take over when the AI is wrong or unavailable, need to work. Test them regularly. Run tabletop exercises where the AI agent makes a bad call and your team has to catch it and recover. The ACSC emphasises that AI-assisted actions must be reviewable. Reviewability only matters if someone is actually reviewing.

Where This Heads

The numbers tell the story. Under 5% of enterprise apps included AI agents recently. By the end of 2026, that number hits 40% (Gartner, 2026). Only 6% of organisations are ready for it (BigID, 2025). That gap is not going to close on its own.

Agentic AI in security operations is not a future problem. It is a current problem that most organisations are not tracking yet. The ACSC's guidance is a useful starting framework. ETSI's EN 304-223 provides international standards to align against. NIST AI 100-2 gives you the threat model.

The organisations that get this right will not be the ones with the biggest AI budgets. They will be the ones that asked the boring questions first: who approves what, what gets logged, what happens when it breaks, and who can pull the plug. lilMONSTER security tools are built with those questions as default, not afterthought.

The opportunity in agentic AI is real. So is the exposure. The gap between the two is where the work happens.