Arctic Wolf’s latest annual agentic security operations report found that AI now fully resolves more than 60% of security investigations, as organizations turn to automation to manage growing workloads and increasingly sophisticated cyber threats.
Arctic Wolf reports fewer alerts and faster response
The Aurora Agentic SOC has escalated 13 investigations for every 1 billion observations ingested. According to the report, it’s the equivalent of watching nearly 32 years of security camera footage to catch one 13-second theft.
“At that ratio, precision isn’t optional, it’s existential,” the report notes. “Miss the signal and an attack goes unnoticed. Chase every anomaly and your reaction time slows before the real threat surfaces. That’s the problem Aurora Agentic SOC is built to handle, filtering at that scale so what reaches an analyst is worth their time, and nothing that matters gets lost in the noise.”
As AI delivers faster detection, average time to ticket fell 36%. Stronger guidance has led to better-informed decisions, helping customers move from alert to resolution faster.
Detection and threat response need to keep up with AI-enabled threats
According to the report, attacks have been executed faster than ever as threat actors have added AI and automation to a proven playbook.
Over 60% of investigations are automatically researched and resolved by agentic AI with no human intervention. Human-only investigations fell from roughly 81% of the caseload in the first full month after launch to 2% one year later, while AI-human partnership investigations grew to 38%.
Threat actors are now combining AI and automation to compress attack timelines, making it difficult for human-led operations to keep pace, so agents working at machine speed have to take the lead.
“Whether the defender is a human analyst or an AI agent, the requirement is the same: Understand what is happening, understand what matters about it, and know how to act on it within the specific business and operating context of the organization,” the report states.
“That is the standard we hold our own operations to. An Arctic Wolf alert explains what happened, what it means, and exactly what to do next. Where we have preapproval, it arrives with the response already taken.”
Machine-speed attacks need machine-speed SecOps
In executing their attacks, threat actors use AI and automation to find vulnerabilities, assemble novel attack chains, execute at machine speed, and target the AI assistants now embedded throughout the software stack.
The report notes that you can’t fight machine-speed threats with human-led operations alone, but you also cannot take humans out of the loop, as expertise, judgment, and accountability are what make an outcome trustworthy rather than merely fast.
Additional takeaways include:
- Speed: AI now fully resolves over 60% of investigations, while human-only investigations fell from 81% to 2% in a single year.
- Trust: Nearly 40% of investigations still involve an analyst’s expert judgment, either working alone or in partnership with AI, and agents escalate rather than guess when a case falls outside their validated experience.
- Scale: Monthly investigations grew 21% while alert volume fell 19%, with the share of serious findings holding steady.
- Value: The Aurora Agentic SOC delivers roughly a 12x cost advantage compared to building one internally.
- Urgency: With adversaries already adopting AI, organizations need to modernize SecOps sooner rather than later.
“Ask a CISO what’s actually kept agentic security out of reach, and it comes down to this: they can’t afford to build it, and even if they could, they’d struggle to trust it,” said Dan Schiappa, President of Technology and Services, Arctic Wolf.
What agentic security operations mean for MSPs
For MSPs, the report’s findings demonstrate the potential of agentic AI to manage growing security workloads, reduce alert fatigue, and help teams address threats more efficiently without a proportional increase in staffing demands.
The developments in the report present an opportunity for MSPs to use AI to handle routine investigations while reserving human expertise for complex threats, escalation, and response oversight.
Providers could also differentiate their managed security offerings by delivering faster investigations, clearer remediation guidance, and more efficient threat response as attackers increasingly use AI and automation.
However, providers will need to balance automation with trust and accountability. With nearly 40% of investigations still involving human judgment, MSPs have an opportunity to position themselves as security partners who combine AI-driven speed with expert oversight, clear escalation procedures, and actionable guidance to help customers navigate increasingly automated cyber threats.
WATCH MORE: Optiv has evolved its approach to helping customers with their security as AI and other emerging technologies open new opportunities and risks.