Guide · Updated · 7 min read

What is agentic security? A definition, and what to ask a vendor.

Agentic security is a security operation run by an AI agent that plans and carries out the work itself: it reads every alert, decides what to investigate, gathers the evidence, reaches a verdict it can cite, and proposes or executes the response, inside a policy the organisation sets. It differs from an AI assistant, which answers the questions a person asks, and from automation, which follows playbooks a person wrote in advance.

See it on your own estate: the free scan Compare it with MDR, SIEM and MSSP

Three things make a security product agentic.

The word is used loosely. Any product with a chat box now calls itself agentic. These are the three tests that separate an agent that runs the operation from an assistant that talks about it.

  1. it owns the loop

    Nobody has to ask

    An agent starts work when the alert fires, at two in the morning as readily as at ten. It decides which queries to run, which systems to read, when the evidence is enough, and when it is not. An assistant waits for a person to type a question; an agent is already three steps in when the person arrives.

    every alert · no sampling · no queue
  2. it decides inside a policy

    Autonomy you dial, not hope

    What the agent may do on its own is written down per kind of action and enforced by the platform, not by the model's good manners. Propose by default; execute without a human only where the policy says so; everything through one approval gate. A product that can act but cannot be bounded is not safe to call agentic.

    propose by default · one gate · audited
  3. it shows its evidence

    Every claim cited, every action costed

    A verdict without the evidence that produced it is a guess with a confident voice. An agent names what it read, links to it, and records what the investigation cost. If you cannot click through from the verdict to the raw event, you are being asked to trust, not to verify.

    citations · hard budgets · tamper-evident ledger

How agentic security differs from the two things it is confused with.

The three are not rivals. Most agentic platforms contain an assistant and plenty of automation. The difference is who decides what happens next.

AI assistantAutomation (playbooks)Agentic security
Who starts the workA person asks a questionA trigger a person configuredThe alert itself; the agent plans the investigation
Who decides the next stepThe person, after reading the answerThe playbook's author, in advanceThe agent, from the evidence, inside the policy
Handles the unexpectedOnly if asked about itFails or stalls when the case leaves the scriptReasons about it, cites what it found, asks a person when it cannot settle it
Acts on the estateNo, or only by instructionYes, exactly as scriptedProposes; executes only where the policy allows, through an approval gate
Evidence for the conclusionDepends on the promptNone: it did not conclude anythingRequired: every verdict cites what it read
Good forQuestions, summaries, draftingEnrichment, routine notifications, fixed responsesRunning triage, investigation, hunting and response end to end

What an agent does across a security function.

An agent that only triages alerts is a triage tool. Agentic security covers the whole job the function exists to do.

detect & respond

Every alert, investigated

Triage, scope, verify, verdict, contain, close at the source. The work that drowns teams, done on every alert rather than the ones a shift gets to.

hunt

Hypotheses, not just alerts

Continuous hunting across every product for what fired no alert: a malicious finding becomes a case, an exposure goes into the risk register.

posture

Misconfigurations, with the fix

How accounts, cloud and domains are configured, scored and re-scored, with one goal per failed check and the steps to close it.

compliance

Evidence, already written down

A maintained picture of controls and coverage against the frameworks an auditor asks about, drawn from what the platform can actually see.

intel

Weighed against your estate

Threat intelligence matters when it meets a system you own. The agent reads intelligence against the inventory, not in the abstract.

stewardship

Your tools, kept clean

Noisy rules tuned at the source, gaps in coverage closed, upstream consoles maintained. The agent gives back to the stack you already own.

Eight questions to ask any vendor that says "agentic".

  1. What can it do without a human, and where is that written?

    The answer should be a policy per kind of action, enforced by the platform, that you can read and change. "The model knows not to" is not an answer.

  2. Can I click from a verdict to the evidence?

    Every claim should carry a citation to the event, the record or the document it rests on. Ask to see a false positive it caught, and how it explained the catch.

  3. What does one investigation cost, and what stops it running away?

    You want a figure, a per-run cap, a per-day cap, and what happens when the cap is hit (it should halt, visibly, not quietly overrun).

  4. Does it work across every product, or one at a time?

    An attack crosses identity, mail, endpoint and cloud. Ask whether events from different products are normalised to one shape, so one investigation and one detection cover all of them.

  5. Where does my data live, and does it train anything?

    The region should be yours to choose and fixed once chosen, with what leaves it written down. Your data should train nothing outside your tenant.

  6. What does it do when a lookup could decide instead of a model?

    A good agent never asks a model to judge what a database join can settle: an IP's reputation, whether two logins are impossible travel. Deterministic first, model second, is the mark of a platform that has met real alerts.

  7. Can I see the full audit trail, and can it be altered?

    Every query, decision and action should land in a ledger you can verify. Ask how an edit would show.

  8. How is it measured, and on what?

    Ask for figures measured on real alerts and incidents, with the caveats stated. A number without its conditions is marketing.

When agentic security is not the answer.

no telemetry yet

Nothing to read

An agent investigates what it can see. If the estate produces no sign-in, mail, endpoint or cloud telemetry yet, start with the configuration: a posture scan needs no logs at all, and tells you what to turn on.

a named human on every ticket

Regulation or contract says so

Some regulated environments require a named analyst to own each case. An agent still does the investigation, but the operating model is "agent proposes, analyst decides" on everything, and you should size the team for that.

a quiet, staffed 24×7 SOC

If it is not drowning, fine

A mature round-the-clock team with low alert volume and good tooling gains less. The gain is largest where alerts outrun people: small teams, growing estates, providers with many clients.

Asked about agentic security.

Is "agentic security" the same as an "AI SOC" or an "autonomous SOC"?
Vendors use the three terms for overlapping ideas. "AI SOC" usually means an AI layer inside a security operations centre (SOC), often triage only. "Autonomous SOC" stresses acting without a human. "Agentic security" is the broader claim: an agent that runs the operation across detection, response, hunting, posture and compliance, under a policy. Judge the product by the three tests above, not the label.
Does an agent replace the security team?
No. It does the work that drowns teams, triaging and investigating every alert and hunting around the clock, and hands the people a clear picture instead of a queue. The team reviews verdicts, approves actions and makes the calls that need judgement. A business with no security team can run one with the agent carrying the load, while staying in control through the policy.
How do I know the agent is right?
Because it shows its evidence, and because a good platform checks itself: a second review that hunts for holes in the verdict, and a blinded re-read that derives the verdict again from the raw evidence alone, before anything executes. Then a human approval gate for anything the policy has not delegated. Trust is earned per case, from the record, not asked for up front.
How is this governed in practice?
Four mechanisms, all enforced by the platform rather than the model: propose by default with autonomy raised per action type; a citation on every claim; hard budgets per run and per day; and a tamper-evident audit ledger of every query, decision and action. The security page describes how Cyvantic does each.

Read about it, or read your own estate. The scan is free.

The quickest way to understand agentic security is to watch it on your own configuration. The posture scan is read-only, collects no logs, and gives you a score in minutes with the fixes in order. No charge, no sales call required, no credit card.

We email you the link to start, and at most one reminder. Nothing else, ever. Or start now without the email. Privacy.