Splunk's John Morgan says AI agents reduce analyst burnout and speed threat response in SOC operations

AI Agents in Security Operations Cut Alert Noise, Speed Threat Response

Security operations centers are deploying AI agents to automate routine triage work, allowing analysts to focus on genuine threats rather than sorting through false alarms. John Morgan, senior vice president and general manager of security at Splunk, a Cisco company, said the shift addresses a fundamental problem: organizations face rising alert volumes from AI-driven attacks while analyst burnout continues.

AI agents handle repetitive tasks-determining whether alerts represent real threats, performing initial investigation, and recommending next steps-while humans retain decision-making authority. This arrangement frees analysts for high-value investigations instead of manual sorting.

How the Model Works

Organizations embed AI agents directly into security workflows to automate alert triage and surface credible threats faster. The agents don't replace human judgment; they prepare groundwork that analysts would otherwise complete manually.

"It's extremely important that we introduce these agents into the security operation workflow so they can automate the triaging, determine if something truly is a threat or not and do all the remedial groundwork that somebody would usually have to do that contributes to burnout," Morgan said.

The approach addresses a practical constraint: faster attacks compress dwell time, forcing operations teams to process more alerts with the same staff. AI agents reduce the time spent on false positives.

What Operations Teams Should Know

Human oversight remains central. Agents recommend actions and surface findings, but analysts make final decisions. This preserves accountability while distributing workload.

Exposure analytics-identifying and prioritizing risks before exploitation-works alongside agent-driven triage. Platform consolidation and data strategy also drive faster detection and response by reducing tool fragmentation.

For operations professionals, the shift means less time validating alerts and more time investigating threats that matter. Success depends on how well organizations design the handoff between automated triage and human analysis.

Learn more: AI Learning Path for Cybersecurity Analysts covers automation and threat detection workflows. AI Agents & Automation explores how these tools integrate into security operations.