An agentic SOC, a security operations centre where AI agents do most of the investigation work, is now handling the bulk of cases at Arctic Wolf, according to the company’s 2026 Agentic Security Operations Report, released on 27 October 2026. Arctic Wolf says agentic AI now resolves 60% of security investigations in its own operations, while investigations handled by humans alone have fallen from 81% to just 2% in about a year.
What the agentic SOC report covers
Arctic Wolf, a cybersecurity and AI company based in Eden Prairie, Minnesota, built its Aurora Agentic SOC to work at machine speed as attackers increasingly use AI and automation. The report draws on data from more than 11,000 organisations in more than 100 countries.
All figures describe how work is divided inside Arctic Wolf’s own SOC, not across the security industry. The company says its Aurora Superintelligence Platform processes more than 10 trillion security events a week, runs more than 200,000 investigations weekly and has resolved more than three million security cases since launching in March 2026.
How work shifted between AI and humans
According to Arctic Wolf, the split of investigations changed sharply over roughly one year:
- Human-only investigations fell from 81% to 2% of the caseload.
- Agentic AI now resolves 60% of investigations on its own.
- AI-human collaboration grew from less than 1% to 38% of investigations.
“Attackers are already operating at machine speed, and organizations can no longer rely on AI-only or human-only security operations to keep pace,” said Dan Schiappa, President of Technology and Services at Arctic Wolf. He described a model where AI handles the volume and humans provide oversight.
Speed and noise in the agentic SOC
The report says monthly investigation volume rose 21% over the past year, while alert volume fell 19%. The average time from an alert-generating event to an actionable ticket dropped 36%.
Arctic Wolf says its system opens just 13 investigations for every billion observations it processes and raises one alert for every 175.6 million observations. The share of high and critical severity tickets stayed steady even as overall alerts declined, which the company presents as less noise without lost visibility.
In its analysis of customer data, Arctic Wolf says customers using its Aurora Managed Detection and Response service with endpoint coverage saw seven times fewer events escalate to investigation than customers using endpoint detection and response alone. It also claims about a 12 times cost advantage over building and running an agentic SOC in-house.
Trust and human oversight
The report names trust as the biggest barrier to using AI in security operations. Arctic Wolf’s answer is a patent-pending “Swarm of Experts”, a network of specialised AI agents that carry out and check work across major SOC functions. An “AI Trust Engine” governs agent behaviour, letting agents act on their own only when confidence is high.
Agents are designed to escalate cases that are uncertain, novel or outside their validated experience to a human analyst instead of acting on them. Each human decision then becomes a learning signal that widens what the agents can resolve.
Reading the numbers carefully
These are Arctic Wolf’s own figures about its own operations and products, and the release does not mention any independent audit. The cost and escalation comparisons come from the company’s analysis of its customer data.
As a writer, I feel the drop from 81% to 2% human-only work is the striking number, but it measures how one vendor reorganised its own workflow. It does not show whether AI decisions were more accurate, which is the question security teams will care about most.
FAQ
What is an agentic SOC?
It is a security operations centre where AI agents carry out much of the investigation work on their own, with human analysts handling escalated, uncertain or novel cases.
What share of investigations does AI resolve at Arctic Wolf?
Arctic Wolf says agentic AI resolves 60% of investigations autonomously, AI-human collaboration covers 38% and human-only work is 2%.
Are these figures independent?
No. They come from Arctic Wolf’s own 2026 report on its own SOC, drawing on data from more than 11,000 organisations.