Zscaler launches Agentic SOC to put AI in charge of security operations
Zscaler unveiled Agentic SOC on Sept. 9, a security operations platform that uses frontier AI models from OpenAI and Anthropic to detect, investigate, and block threats without waiting for human analysts. The U.S. cloud security company said AI-powered attacks now move at speeds that traditional security operations centers cannot match, making a redesign necessary for organizations that want to keep pace.
The platform combines security information and event management (SIEM), which collects logs and detects threats, with security orchestration, automation and response (SOAR), which handles identified threats. Zscaler then adds AI agents that can independently assess situations and act throughout the process.
Why one AI model isn't enough
Zscaler partnered with multiple frontier AI labs, including Anthropic and OpenAI, based on its view that a single model or approach has limitations in delivering accurate agentic AI operations. The company feeds its AI agents real-time security data collected from networks, along with its own threat intelligence.
The platform can also integrate with customers' existing security tools to analyze threat information and automatically block lateral movement by attackers across systems. This means the AI agents don't replace the entire security stack - they sit on top of it and coordinate responses.
What the AI agents actually do
Agentic SOC assigns AI agents to perform decisions and responses traditionally handled by security analysts. The agents identify genuine threats among large volumes of security alerts, investigate attack paths and root causes, and determine whether a threat is present. They can then automatically take necessary actions, such as isolating compromised users or blocking attackers' command-and-control (C2) communications.
"Agentic SOC represents a fundamental reimagining of security operations," said Deepen Desai, Zscaler's vice president of cybersecurity. "It is designed to proactively reduce exposure and contain threats at machine speed."
Forrester Research principal analyst Allie Mellen put the shift in context: "AI attacks operate with a speed, scale and adaptability that are markedly different from humans, fundamentally changing the threat landscape. Defenders need to focus on fundamentals such as zero-trust principles, data loss prevention and access restrictions."
This aligns with the broader movement toward AI Agents & Automation in security operations, where machine-speed response is becoming a baseline requirement rather than a differentiator.
Why this matters for operations teams
For operations professionals, Agentic SOC changes the division of labor in security work. Instead of triaging alerts, your team's role shifts toward configuring agent parameters, auditing automated decisions, and managing exceptions. The platform handles the volume; humans handle the judgment calls that fall outside defined parameters. Teams evaluating this technology should start by mapping their current alert-to-response workflow and identifying which steps consume the most analyst hours. Those are the steps AI agents will take over first.
Security operations teams that want to build internal expertise before adopting platforms like Agentic SOC can start with structured training such as AI for Cybersecurity Analysts, which covers the fundamentals of AI-driven threat detection and response workflows.
Your membership also unlocks:
