Incorporating AI agents into SOC workflows

This Red Canary blog explains how non-autonomous, SOP-driven AI agents with humans in the loop can streamline SOC investigations by automating context gathering and initial assessments, contrasting them with rigid traditional automation and less predictable autonomous agents; using a real-world Salesforce login anomaly, it reports investigation time reductions from 25–40 minutes to just over **3 minutes** and a **60 percent** faster customer notification rate, and it offers practical tooling options (OpenAI function calling, CrewAI, LangFlow, LangGraph, AutoGen, and Microsoft Security Copilot with a Red Canary plugin) for implementing agentic workflows.