Microsoft's 'agentic SOC' keeps the human — and changes the job to setting the thresholds

Microsoft's 'agentic SOC' model for security operations keeps a human in the loop but changes what they do: the human validates agent-led investigations, handles the ambiguous cases, and sets the confidence thresholds under which an agent may act without asking. It is the industry's answer to putting AI in security work — not 'let the AI run free,' but 'the agent does the investigation, the human owns the judgment.'

What it means Even for a one- or two-person team the pattern holds: automate the mechanical, reserve human judgment for the irreversible, and set explicit thresholds for what an agent may do unattended.