The new cyber defenders: Why companies are betting on Agentic AI
As AI-powered cyberattacks become faster, smarter and harder to detect, enterprises are deploying autonomous AI agents to help security teams identify, investigate and respond to threats at machine speed.
- Aug 6, 2026,
- Updated Aug 6, 2026 3:56 PM IST
Cybercriminals are increasingly using agentic AI to launch sophisticated attacks that can bypass traditional security measures and exploit human error. In response, enterprises are embracing AI-powered security operations centres (SOCs) that combine autonomous threat detection with human oversight.
An Indian bank recently disclosed that a compromised employee email account led to nearly 1 terabyte of customer data being leaked on the dark web, underscoring how human error remains a major cybersecurity vulnerability. Around the same time, cybersecurity firm Sophos' State of Ransomware report found that more than 80% of ransomware attacks in India began with compromised identities, while malicious emails and phishing were responsible for over half of such incidents.
Although enterprises have significantly strengthened their cybersecurity infrastructure over the years, security breaches continue to rise. Increasingly, attackers are targeting people rather than technology, using artificial intelligence to automate and personalise attacks at unprecedented speed.
Agentic AI refers to artificial intelligence systems capable of acting autonomously to achieve defined objectives rather than simply responding to prompts. Cybercriminals are already leveraging these systems to orchestrate phishing campaigns, automate reconnaissance and execute attacks that are more convincing and difficult to detect than conventional cyber threats.
Rise of the Agentic SOC
The growing sophistication of AI-enabled attacks is pushing enterprises to rethink how they defend themselves.
"The uncomfortable truth in today's AI-driven cybersecurity landscape is that human defenders simply cannot keep pace with the ever-expanding threat surface and pace of attacks. The traditional security operations centre is broken by design," said Swapna Bapat, Vice President & Managing Director, India & SAARC, Palo Alto Networks.
A Security Operations Centre (SOC) serves as the central hub where organisations monitor networks, analyse threats and coordinate incident response. However, security analysts often sift through thousands of alerts daily, manually correlating information from multiple tools before responding to incidents.
Experts believe agentic AI can significantly reduce this burden by automating repetitive, data-intensive tasks.
"An agentic SOC is perhaps the best manifestation of using AI for security," said Sandeep Agarwal, CTO, Security, Cisco India & South.
According to Agarwal, AI agents are particularly useful in high-pressure SOC environments where analysts receive enormous volumes of telemetry from networks, endpoints, cloud infrastructure and applications. Instead of manually searching for threats hidden in massive datasets, AI can rapidly identify suspicious activity and prioritise genuine risks.
The technology also addresses a growing talent shortage. Industry estimates put the global cybersecurity workforce gap at 4.8 million unfilled positions, making automation increasingly essential.
According to the Palo Alto Networks 2026 Identity Security Landscape Report, machine identities now outnumber human identities 111:1 in Indian enterprises.
"Every one of those identities is a potential attack vector. No human team can monitor that at scale. Agentic AI isn't a nice-to-have; for Indian enterprises navigating both the DPDP Act and an increasingly hostile threat environment, it's the only way to defend at the speed attackers now move," Bapat said.
Humans Still Make the Final Call
Despite rapid advances in AI, experts emphasise that autonomous agents are designed to augment—not replace—human security teams.
AI agents are increasingly being deployed for Tier-1 alert triage, log analysis, anomaly detection and preliminary investigations, enabling analysts to focus on more complex threats.
"With human oversight, you can dramatically accelerate responses to routine alerts and free security professionals to handle more sophisticated incidents," said Chester Wisniewski, Director, Global Field CISO, Sophos.
He added that AI agents can analyse massive volumes of security logs, detect anomalies in real time and present actionable insights for human review.
"Agentic SOCs will see the best of both worlds: the scale of computer analysis with the critical judgement of human oversight," Wisniewski said.
Cisco's Agarwal recommends a phased adoption strategy with clear safeguards. While low-risk activities can be fully automated, higher-risk decisions—such as responding to incidents affecting business-critical systems—should remain under human supervision.
"The high-risk tasks, such as those involving business-critical systems or cyber incident remediation, are where you need a human in the loop. Humans should verify, approve or modify the proposed action before execution," he said.
As cyber threats continue to evolve, enterprises increasingly see agentic AI not as a replacement for cybersecurity professionals but as a force multiplier—one that enables human teams to respond faster, scale more effectively and stay ahead in an increasingly AI-driven threat landscape.
For Unparalleled coverage of India's Businesses and Economy – Subscribe to Business Today Magazine
Cybercriminals are increasingly using agentic AI to launch sophisticated attacks that can bypass traditional security measures and exploit human error. In response, enterprises are embracing AI-powered security operations centres (SOCs) that combine autonomous threat detection with human oversight.
An Indian bank recently disclosed that a compromised employee email account led to nearly 1 terabyte of customer data being leaked on the dark web, underscoring how human error remains a major cybersecurity vulnerability. Around the same time, cybersecurity firm Sophos' State of Ransomware report found that more than 80% of ransomware attacks in India began with compromised identities, while malicious emails and phishing were responsible for over half of such incidents.
Although enterprises have significantly strengthened their cybersecurity infrastructure over the years, security breaches continue to rise. Increasingly, attackers are targeting people rather than technology, using artificial intelligence to automate and personalise attacks at unprecedented speed.
Agentic AI refers to artificial intelligence systems capable of acting autonomously to achieve defined objectives rather than simply responding to prompts. Cybercriminals are already leveraging these systems to orchestrate phishing campaigns, automate reconnaissance and execute attacks that are more convincing and difficult to detect than conventional cyber threats.
Rise of the Agentic SOC
The growing sophistication of AI-enabled attacks is pushing enterprises to rethink how they defend themselves.
"The uncomfortable truth in today's AI-driven cybersecurity landscape is that human defenders simply cannot keep pace with the ever-expanding threat surface and pace of attacks. The traditional security operations centre is broken by design," said Swapna Bapat, Vice President & Managing Director, India & SAARC, Palo Alto Networks.
A Security Operations Centre (SOC) serves as the central hub where organisations monitor networks, analyse threats and coordinate incident response. However, security analysts often sift through thousands of alerts daily, manually correlating information from multiple tools before responding to incidents.
Experts believe agentic AI can significantly reduce this burden by automating repetitive, data-intensive tasks.
"An agentic SOC is perhaps the best manifestation of using AI for security," said Sandeep Agarwal, CTO, Security, Cisco India & South.
According to Agarwal, AI agents are particularly useful in high-pressure SOC environments where analysts receive enormous volumes of telemetry from networks, endpoints, cloud infrastructure and applications. Instead of manually searching for threats hidden in massive datasets, AI can rapidly identify suspicious activity and prioritise genuine risks.
The technology also addresses a growing talent shortage. Industry estimates put the global cybersecurity workforce gap at 4.8 million unfilled positions, making automation increasingly essential.
According to the Palo Alto Networks 2026 Identity Security Landscape Report, machine identities now outnumber human identities 111:1 in Indian enterprises.
"Every one of those identities is a potential attack vector. No human team can monitor that at scale. Agentic AI isn't a nice-to-have; for Indian enterprises navigating both the DPDP Act and an increasingly hostile threat environment, it's the only way to defend at the speed attackers now move," Bapat said.
Humans Still Make the Final Call
Despite rapid advances in AI, experts emphasise that autonomous agents are designed to augment—not replace—human security teams.
AI agents are increasingly being deployed for Tier-1 alert triage, log analysis, anomaly detection and preliminary investigations, enabling analysts to focus on more complex threats.
"With human oversight, you can dramatically accelerate responses to routine alerts and free security professionals to handle more sophisticated incidents," said Chester Wisniewski, Director, Global Field CISO, Sophos.
He added that AI agents can analyse massive volumes of security logs, detect anomalies in real time and present actionable insights for human review.
"Agentic SOCs will see the best of both worlds: the scale of computer analysis with the critical judgement of human oversight," Wisniewski said.
Cisco's Agarwal recommends a phased adoption strategy with clear safeguards. While low-risk activities can be fully automated, higher-risk decisions—such as responding to incidents affecting business-critical systems—should remain under human supervision.
"The high-risk tasks, such as those involving business-critical systems or cyber incident remediation, are where you need a human in the loop. Humans should verify, approve or modify the proposed action before execution," he said.
As cyber threats continue to evolve, enterprises increasingly see agentic AI not as a replacement for cybersecurity professionals but as a force multiplier—one that enables human teams to respond faster, scale more effectively and stay ahead in an increasingly AI-driven threat landscape.
For Unparalleled coverage of India's Businesses and Economy – Subscribe to Business Today Magazine