An agentic MDR governance framework answers five questions before an AI agent touches production alerts: what identity the agent holds, what it can read, what it logs, which actions require a human, and what gets it shut off.
Most buyers ask none of them.
Why the SOC said yes so fast
The workload numbers made this an easy sell. An IDC survey commissioned by FireEye, covering 300 US SOC respondents and 50 MSSPs, found that more than one-third of security managers and analysts ignore threat alerts when the queue is full. False positive rates ran 45% inside internal SOCs and 53% at MSSPs. And Microsoft's own documentation estimates each user-reported phishing email "may require up to 30 minutes of manual triage."
Stack those together and a triage agent doesn't need to be brilliant. It needs to beat an ignored queue.
Which is exactly why governance lags. When the alternative is alerts nobody reads, procurement moves fast and access review moves slow. The hard questions arrive after the purchase order.
Who ships what, and how much it does alone
One note before the tour. Every performance figure below is a vendor claim; no independent benchmark of these agents exists.
Microsoft's Phishing Triage Agent in Defender is the furthest along in public documentation, and it's GA for email triage. Per Microsoft's docs, it classifies user-reported phishing "without requiring step-by-step human input or code," self-assigns alerts, resolves false alarms on its own, and leaves true positives open for humans. The same machinery has since been extended into a Security Alert Triage Agent covering identity and cloud alerts, currently in preview, which Microsoft says "saves security analysts more than 200 hours every month." A claim, not a benchmark. Still a revealing one.
CrowdStrike's Charlotte AI Detection Triage advertises verdicts "with over 98% accuracy" and more than 40 hours of manual work eliminated per week, both CrowdStrike's own numbers, trained on triage decisions from its Falcon Complete MDR operation. The company's framing is "bounded autonomy": customers define guardrails for when automated action happens. SentinelOne's Purple AI Athena runs auto-triage and auto-investigation over whatever SIEM or data lake you already have, and it includes a promotion gate worth copying — the agent delivers a summary of what it did, then prompts a human before a one-time response becomes a standing automation. Palo Alto's Cortex AgentiX, embedded in XSIAM and trained on what the company says is over 1.2 billion playbook executions, claims up to 98% MTTR reduction and requires, in its own words, "human-in-the-loop approval for impactful actions."
Then the specialists. Dropzone AI investigates every incoming alert, typically within ten minutes by its own claim, and publishes a graduated-autonomy model: analysts approve closures at first, then shift to supervising as confidence builds. Prophet Security's agent investigates end to end and hands humans a determination, a severity rating, remediation steps, and a compiled timeline, with response staying a human call. Radiant Security runs a fleet of triage and investigation agents where response executes on a human click. On the SOAR-heritage side, Torq's Socrates fronts a multi-agent system the company says can resolve 95% of Tier-1 alerts without human involvement, the most aggressive autonomy claim on this list, while Tines has kept its center of gravity in human-built workflows with AI layered on top.
Last verified: September 5, 2026.
| Vendor / agent | Runs alone | Documented human gate | Identity and audit story |
|---|---|---|---|
| Microsoft Phishing Triage Agent (GA) | Full triage of user-reported phish; auto-resolves false positives | Analysts reclassify verdicts; feedback recorded for audit; pause and remove controls | Entra Agent ID; decision trees logged in Purview |
| CrowdStrike Charlotte AI | Detection triage verdicts (98% accuracy, vendor claim) | Customer-defined guardrails on when automated action occurs | Not publicly itemized |
| SentinelOne Purple AI Athena | Auto-triage and auto-investigation over third-party SIEMs | Human confirms before a task becomes a standing automation | Not publicly itemized |
| Palo Alto Cortex AgentiX | Plans and executes playbook actions in XSIAM | Approval required for "impactful actions"; role-based access controls | "Full auditability" claimed per action |
| Dropzone AI | Investigates every alert; auto-closes benign work after graduation | Graduated autonomy: approve closures first, supervise later | Full audit trail claimed |
| Prophet Security | End-to-end investigation with verdict, severity, timeline | Response decisions surfaced to humans | Not publicly itemized |
| Radiant Security | Autonomous triage and investigation across use cases | Response executes on a human click | Not publicly itemized |
| Torq Socrates | Multi-agent resolution of Tier-1 alerts (95%, vendor claim) | Configurable; not publicly itemized | Not publicly itemized |
Microsoft accidentally published the benchmark
Read the Phishing Triage Agent setup documentation as a governance artifact and it's the best one any vendor has shipped. The agent gets its own identity through Microsoft Entra Agent ID, created "specifically for AI agents," rather than borrowing a shared service account. Its permission set is named and narrow: read security data basics, manage alerts, read email metadata, and read "Emails associated with alerts" only — scoped to alert-linked mail, not the mailbox. And every decision is, in Microsoft's words, "transparently documented as a decision tree within Defender and recorded in Microsoft Purview audit logs for traceability and compliance." Even the analyst feedback that retrains the agent gets logged.
One requirement in those docs deserves more attention than it gets. Microsoft instructs that the group monitoring the agent must hold "equal or higher permissions" than the agent itself. Sit with the ratchet in that sentence. Every scope you grant the agent, you now grant its human overseers too. A broadly-scoped agent quietly raises privilege across the whole team watching it, which is one more reason to keep agent scopes narrow from day one.
Note also where the audit trail lives: inside Purview, the same vendor stack the agent operates on. Tamper-evident to everyone except the platform itself. Hold that thought.
Five controls you can put in an RFP
One agent, one identity. Every autonomous agent authenticates as its own credentialed identity, never a shared service account, with short-lived scoped credentials instead of long-lived keys. If a vendor can't tell you what identity its agent runs as, everything downstream breaks: you can't log it distinctly, and you can't revoke it without collateral damage. Entra Agent ID is the working example; hold other vendors to it.
Least privilege, defended line by line. A SOC agent naturally wants everything — EDR telemetry, mailboxes, identity logs, and increasingly write access to containment. Grant task-scoped access instead. Microsoft's "emails associated with alerts" scope is the pattern: enough to do the job, nothing that makes the agent a prize. This is standard least-privilege discipline applied to a non-human identity, and our CISO playbook for production agents walks the mechanics.
Logged decisions, not just logged actions. An entry saying the agent closed alert 4471 is an action log. What you need is the reasoning chain that led there, Purview-style decision trees, plus a record of every piece of human feedback that shaped future behavior. The OWASP agentic Top 10 points the same direction: without reasoning traces, you cannot distinguish a bad verdict from a manipulated one.
Approval gates on anything that changes state. Closing a false positive can be autonomous. Quarantining a host, disabling an account, or revoking sessions gets a human click, at least until months of verdict history justify graduating specific actions. Dropzone's staged model and SentinelOne's promotion prompt are two public versions of the same idea. Make graduation an explicit decision with a date and an owner, not a drift.
Kill criteria, written before deployment. Pause thresholds defined in advance: false-positive confirmation rate degrading past a set floor, any action outside granted scope, permission drift, a verdict the agent cannot explain. Microsoft ships pause and remove controls. Your job is deciding, ahead of time, what triggers them and who pulls the lever. This slots into the broader enterprise agentic governance program rather than living as a SOC-only rule.
The incident that hasn't happened yet
No publicly verified case of an autonomous SOC agent causing damage exists as of this writing. We looked. What circulates instead are hypotheticals, like the auto-isolated database server taking an application down with it, drawn from SOAR practice literature that has long warned against automating containment without human gates.
Don't read that absence as safety. The governance argument was never about incidents; it's about access. A SOC agent is a non-human identity with read access to your most sensitive telemetry and, increasingly, write access to containment. SailPoint's warning about agent identities applies here with extra force: "Each unmonitored agent becomes a potential blind spot, an ungoverned identity with access to sensitive corporate data." An attacker who compromises your triage agent doesn't just see your alerts. They can close them.
That's the case for controls, made without a single scare story. When the first real incident report does get published, the difference between affected organizations will be who can produce their agent's decision log.
Who audits the auditor?
Gartner has a name for the layer this all points toward. Guardian agents, defined as AI "designed to support trustworthy and secure interactions with AI," which the firm predicts will account for 10 to 15% of agentic AI markets by 2030. It sorts them into three usage types: reviewers that check AI output, monitors that observe behavior, and protectors that block or redirect actions. We've unpacked the guardian agent category in full elsewhere.
The structural gap guardian agents answer is the one flagged above. Every audit trail described in this post lives inside the platform whose agent it documents. Purview logs Microsoft's agent. XSIAM logs Palo Alto's. There is no independent witness, and an audit log the audited platform controls is a weaker instrument than anyone selling it will admit.
That witness seat is where AccuroAI sits: an oversight layer that watches security agents at runtime and enforces policy at under 38ms p99, fast enough to never be the slow step in an investigation, with agent activity mapped to 8 compliance frameworks. The enforcement mechanics — tool gating, egress control, kill switches — are covered in our runtime security guide and on the AI agent security product page.
What security leaders ask us about this
Is agentic MDR just SOAR with new branding?
No. SOAR executes playbooks a human wrote in advance, with deterministic branching. Agentic systems choose their own investigative steps per alert, which is why Dropzone can advertise investigation without predefined playbooks. That flexibility is the value and the governance problem, in one feature.
Which vendor has the most mature governance story?
On public documentation, Microsoft, and it isn't close. Entra Agent ID, a named least-privilege permission set, the overseer-parity rule, and Purview-logged decision trees are all in the product docs. Other vendors may run equivalents internally. They haven't published them, and unpublished governance is hard to put in a contract.
Do these agents replace Tier-1 analysts?
The vendor numbers point that way, but every figure here is marketing. What's actually observable is that the work shifts from triage to verification: someone still reviews verdicts, files the feedback that trains the agent, and owns reclassification. A different job. Not an absent one.
What does a kill criterion look like in practice?
A written condition plus a named owner. For example: if the agent's confirmed-accuracy rate over a rolling week falls below the baseline your analysts established during supervised mode, the SOC lead pauses it, and re-enablement requires review of the divergent verdicts. "We can always turn it off" is not a kill criterion. A threshold with an owner is.