Architecting the Agentic SOC
James Woodward, Head of Technology, SEP2
Knowing that context is queen is only the first operational step; the true challenge for modern enterprise security is orchestrating that data at machine speed. This is where the shift from simple AI assistants to a true Agentic SOC framework delivers its value.
Instead of relying on a standalone chatbot handling static, manual queries, the next generation of our security infrastructure relies on specialised, autonomous AI engines working symmetrically within a unified case management ecosystem via the Model Context Protocol (MCP).
In this multi-agent paradigm, separate technical personas handle targeted phases of the lifecycle:
- Casey (The Alert Powerhouse): Deployed inside our custom multi-tenant UI, Casey automatically intercepts incoming alerts, pulls environmental context without manual playbooks, and runs a vector search across past case history and historic analyst notes to immediately surface facts.
- S.I.T.H. (Special Intelligence Threat Hunter): Operating passively in the background, S.I.T.H. continuously maps software bills of materials (SBOMs), learns threat vectors based on your specific client footprint, and generates on-demand coverage summaries to proactively suggest rule improvements.
Crucially, this model functions with an absolute human-in-the-loop methodology. Our engineers are not replaced by models, instead, they are elevated. By relying on verified vector data stores to handle documentation heavy lifting, human analysts are given back the most valuable resource in modern defence: uninterrupted time to make final critical remediation decisions, hunt threat actors, and fine-tune perimeters.
