Organizations should combine timely telemetry, controlled automation, human oversight, and adaptable reasoning models while limiting operational risk
Security teams are under growing pressure to detect, investigate, and contain attacks faster as automation improves on both sides of the conflict.
Recent threat research supports the broader concern that some attack timelines are shrinking sharply, but the practical response is not blind faith in autonomy: it is a clearer operating model for evidence, governance, and response.
Organisations should therefore focus less on chasing AI features and more on reducing delay in the parts of the security operations center (SOC) pipeline that matter most. In practice, that means improving context, tightening controls over automated action, and deciding where model-driven reasoning adds value without creating new operational risk.
Where the pressure is coming from
The recent “machine speed” attack on Hugging Face by AI models acting autonomously are a clear sign that security teams should review which detections, approvals, and containment actions still assume a slower attacker and whether existing workflows can keep pace in high-risk scenarios.
As Ken Chen, Geo Leader (APJ), ExtraHop put it, “An agent is only as good as what it can see.” That is a fair starting point, but in practice visibility is distributed across network, endpoint, identity, cloud, application, and threat-intelligence sources rather than concentrated in a single feed.
One useful way to think about a modern SOC is as three capabilities: current evidence, governed action, and model-assisted reasoning. The first requirement is timely, trustworthy context. Automated and semi-automated workflows perform best when telemetry is fresh, attributable, and assembled quickly enough to support investigation and response before the window for containment closes. Chen argues that real-time context should sit at the center of an AI-enabled SOC and strongly emphasizes network-derived evidence.
That claim has merit in part: network activity often remains useful when endpoint visibility is degraded, and independent threat research continues to document EDR evasion techniques that make complementary visibility important.
Still, network telemetry should not be treated as universal ground truth. Encryption, trusted cloud services, proxying, tunnelling, low-and-slow activity, and legitimate SaaS usage can all reduce what defenders can observe or confidently infer from traffic alone, which is why the strongest operating models combine network, endpoint, identity, and cloud evidence rather than elevating one source as sufficient by itself.
Governance before autonomy
The second requirement is a governance layer that decides what an automated system is allowed to read, change, execute, or block. Chen describes this as the “Harness” layer and asserts that it is the control plane that makes autonomous action governable.
That is a useful concept, but the important point is broader than the label. Any move towards greater automation should define permissions, human-approval thresholds, audit trails, rollback conditions, and failure handling before giving agents authority over production systems.
This matters because the main risk is not only a weak model. It is also over-privileged automation acting on incomplete evidence, unsafe tools, or poorly designed policies, especially in environments where containment actions can disrupt business operations or destroy forensic context.
What models should and should not do
The third requirement is a reasoning layer that can triage alerts, correlate evidence, summarize findings, propose actions, and, in limited cases, execute pre-approved responses. Chen’s view that the model layer should be interchangeable is sensible as a design goal because model capabilities, costs, and safety profiles are changing quickly.
However, portability is not automatic. In practice it depends on workflow design, interfaces, evaluation methods, latency, compliance constraints, and the quality of the surrounding control and data layers.
Security leaders should therefore resist two extremes: assuming human review must remain in every step, and assuming that autonomy should be expanded simply because it is technically possible. The better question is which tasks benefit from faster machine assistance and which still require human judgment because of legal, operational, or evidentiary consequences.
A practical operating guide
For most organizations, the right next step is not a wholesale leap into an “agentic SOC”. It is a staged review of where delay is introduced and where controlled automation can improve response quality without widening risk.
A practical checklist looks like this:
- Map the current investigation and containment path from first signal to response decision
- Identify which telemetry arrives too late, lacks attribution, or is not correlated across systems
- Separate low-risk automation, such as enrichment and deduplication, from high-impact enforcement actions
- Define approval thresholds, audit requirements, and rollback conditions before granting broader authority
- Test competing models and workflows against accuracy, latency, explainability, and operational safety
SOC teams preparing for faster attacks should prioritize timely, high-quality evidence, tightly governed automation, and the ability to evaluate or replace reasoning models as requirements change. Network telemetry can be an important part of that foundation, but its value depends on how well it complements endpoint, identity, cloud, and application data.
