The Agentic SOC: Defending With, and Against, Autonomous AI

An agentic SOC uses AI agents to triage alerts, investigate threats, and take response actions. Once those agents can make decisions and use tools, we need to be clear about whose instructions they follow, where their authority stops, and how we verify the results.

In this SANS Institute webcast, I explore how an attacker can hijack an AI agent’s intent and turn its legitimate access against the defender. That includes indirect prompt injection, where instructions embedded in content such as a tool response redirect the agent’s behavior.

I built two cinematic demos around the same scripted incident. In the first, an attacker steers an agent into isolating the wrong system. We then replay the scenario with evidence checks and a policy boundary that blocks the dangerous action while allowing a narrowly scoped response.

We also look at least agency: extending least privilege to limit what an agent can decide and do. Which actions can we safely delegate? Which need human approval? What evidence tells us the response actually worked?

These are the security architecture questions we work through in SEC530. Trust boundaries, visibility, and verification matter more than ever when we delegate decisions to agents. Think Red, Act Blue.