The Next Cybersecurity Analyst May Be an AI Agent
For years, cybersecurity teams have been using automation to help monitor networks, scan systems, and respond to threats. But something bigger is starting to happen.
The next cybersecurity analyst working inside a Security Operations Center may not be a person sitting behind six monitors. It could be an AI agent working alongside the human security team.
Now, let me be clear. I am not saying AI is about to replace every cybersecurity analyst. We are not there, and the research does not prove that. What is happening is that AI agents are beginning to take over some of the repetitive work that normally lands on a Tier 1 analyst’s desk.
This is more than a chatbot answering a cybersecurity question. An AI agent can be given a goal, examine information from different security tools, decide what steps to take, use those tools, and return with a finding or recommended action.
That is where this starts getting off the chain.
From answering questions to taking action
A regular AI assistant waits for someone to ask it a question. An AI agent can continue working through a task with less step-by-step direction.
Let’s say a suspicious email is reported inside a company. A security analyst would normally have to examine the sender, email headers, links, attachments, domain reputation, previous alerts, and activity connected to the user’s account.
An AI security agent can be set up to perform many of those same steps. It can collect the evidence, compare it with threat intelligence, decide whether the email looks malicious, explain how it reached that conclusion, and recommend what the analyst should do next.
That is not some future concept sitting in a research lab.
Microsoft’s Phishing Triage Agent already uses large language model-based analysis to review user-reported emails and classify them as threats or false alarms. Microsoft says the system applies contextual reasoning instead of relying only on static rules. It also provides an explanation for its decision so the security team can review the evidence. Microsoft’s technical documentation describes this as autonomous triage without the analyst having to provide instructions for every step.
Google Security Operations is moving in the same direction. Its Triage Agent can investigate supported alerts, determine whether they appear to be true or false positives, build a timeline, summarize its findings, and suggest the next investigative steps. Google says its agentic security system can reduce an investigation that might normally take around 30 minutes to about 60 seconds in certain workflows. That is the company’s reported performance, not a guarantee that every investigation will be completed that quickly. Google Cloud’s Agentic SOC
The shift is already underway.
What work could an AI security agent handle?
A cybersecurity analyst does much more than stare at alerts. The job involves gathering evidence, looking for patterns, deciding what deserves attention, documenting incidents, and helping the organization respond.
AI agents are being developed to assist with work such as:
Sorting real alerts from false positives
Investigating suspicious emails
Connecting related alerts across users and devices
Searching logs for unusual activity
Summarizing an incident timeline
Checking threat intelligence
Finding gaps in identity and access policies
Prioritizing vulnerabilities
Recommending patches or configuration changes
Producing investigation reports
Hunting for similar activity elsewhere in the environment
Microsoft introduced security agents for phishing, data-loss prevention, insider-risk alerts, Conditional Access policies, vulnerability remediation, and threat-intelligence briefings. Some of these agents recommend an action while leaving the final approval to the security administrator. Microsoft Security
That human approval is important.
There is a huge difference between allowing an agent to summarize an alert and allowing it to disable an account, isolate a production server, block network traffic, or change a firewall policy. The higher the possible impact, the more human oversight should be required.
The proof goes beyond product announcements
Company demonstrations are interesting, but I like to see evidence that the technology can perform under tougher conditions.
The DARPA AI Cyber Challenge gave us some of that proof.
In the 2025 final competition, autonomous cyber reasoning systems analyzed more than 54 million lines of code. According to DARPA, those systems discovered 54 of the competition’s 63 synthetic vulnerabilities and patched 43 of them. They also found 18 real vulnerabilities that had not been planted for the contest and produced 11 patches for those real flaws.
The teams submitted patches in an average of 45 minutes. DARPA’s final results
That does not mean one AI model did everything by itself. These were complete cyber reasoning systems built by highly skilled teams. They combined AI models with scanners, fuzzing tools, code analysis, testing environments, and other cybersecurity technology.
Still, the results matter. They show that AI-powered systems can do more than explain what a vulnerability is. They can examine software, find a weakness, prove that the weakness exists, create a possible patch, and test the result.
That is starting to look like actual security work.
But AI agents are not ready to run the whole SOC
This is where I have to pump the brakes a little.
AI agents can be fast, but fast and correct are not always the same thing. An agent can misunderstand evidence, miss part of an attack, trust bad information, or recommend an action that creates another problem.
Research benchmarks also show a large gap between knowing cybersecurity facts and handling a complicated, changing attack. One 2025 cybersecurity benchmark found that leading systems performed much better on knowledge-based security questions than on multi-step attack-and-defense scenarios. In those more demanding environments, reported success rates fell into the 20%–40% range. CAIBench research
Another benchmark tested AI agents against real-world web application vulnerabilities. Its strongest evaluated agent framework resolved only up to 13% of the vulnerabilities. CVE-Bench research
That is a major reality check.
An AI agent may handle a familiar phishing investigation pretty well but struggle when an attacker changes tactics, hides inside normal network activity, or creates a situation the agent has never encountered.
AI agents can also become attack targets themselves. A malicious instruction hidden inside an email, webpage, document, or log entry could attempt to manipulate an agent. This is known as prompt injection. If that agent has access to sensitive data or powerful administrative tools, the risk becomes much more serious.
The agent needs its own security controls:
Limited permissions
Approved tools and data sources
Detailed activity logs
Human approval for high-impact actions
Testing before production deployment
A quick way to stop or disconnect it
Continuous review of its accuracy
Protection against prompt injection and data leakage
You cannot hand an AI agent the keys to the whole network and just hope it behaves. That would not be innovation. That would be poor access management wearing a shiny new outfit.
The analyst’s job is changing, not disappearing
My honest opinion is that the near-term future is not human analyst versus AI agent. It is the human analyst working with a team of specialized AI agents.
One agent may investigate phishing. Another may watch identities and access policies. Another may hunt through endpoint and network logs. Another may organize threat intelligence. The human analyst reviews their work, connects the bigger picture, handles unusual situations, and decides when the organization needs to act.
The AI agent brings speed, scale, and the ability to work continuously. The human analyst brings judgment, accountability, business knowledge, ethics, and the ability to recognize when something just does not feel right.
Cybersecurity is not only about finding bad files and strange IP addresses. Analysts must understand how the company operates. They need to know which systems are critical, what downtime would cost, whether an unusual action is actually normal for that business, and how a response could affect customers and employees.
An AI agent may detect suspicious activity on a server. A human has to understand whether shutting down that server could interrupt payroll, hospital operations, manufacturing, or payment processing.
Context matters.
What this means for people entering cybersecurity
If you are studying cybersecurity, this is not the time to give up because AI is coming. This is the time to learn how cybersecurity and AI work together.
Future analysts will need the traditional foundation:
Networking
Windows and Linux
Identity and access management
Cloud security
Logs and SIEM platforms
Incident response
Vulnerability management
Threat intelligence
Scripting and automation
But they will also need to understand how to supervise agents, verify their findings, control their permissions, test their recommendations, and recognize when the agent is confidently wrong.
Knowing how to ask an AI agent to investigate something will be useful. Knowing whether its answer makes technical sense will be even more valuable.
The strongest analyst may not be the person who manually works every alert. It may be the person who knows which tasks to delegate to an agent, which evidence to verify, and when to take back control.
My final thought
The next cybersecurity analyst may be an AI agent—but that agent will still need a good human analyst watching the operation.
We are moving from security tools that only send alerts to security agents that can investigate, reason, and recommend actions. The research shows real progress, especially in phishing triage, alert investigation, vulnerability discovery, and software patching. It also shows that these systems still struggle with complex, unpredictable, multi-step situations.
So I would not call the human cybersecurity analyst obsolete. I would call the role upgraded.
The future SOC may have fewer people buried under repetitive alerts and more people managing investigations, validating evidence, supervising AI agents, and concentrating on the threats that require real human judgment.
That is the part I am watching closely. I’m just chasing the tech inside and trying to see where the human fits before the technology makes that decision for us.
#ChasingTheTechInside #Cybersecurity #AIAgents #StayCurious #StayConnected
No comments:
Post a Comment