> ## Content Index
> Fetch the complete content index at: https://www.cybrsecmedia.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# CISA’s ‘Tale of Two SOCs’ Shows Why AI Guardrails Need Humans in the Loop
- URL: https://www.cybrsecmedia.com/cisas-tale-of-two-socs-shows-why-ai-guardrails-need-humans-in-the-loop/
- Published: 2026-08-27T12:15:51.000Z
- Updated: 2026-08-27T12:22:35.000Z
- Description: CISA’s “Tale of Two SOCs” red team research shows why SOC automation, AI guardrails and human authority to contain attacks must evolve together.
- Author: Bill Brenner
- Tags: AI SOC, SOC, CISA, Article

Earlier this week, [George V. Hulme ](https://www.linkedin.com/in/georgehulme/?ref=cybrsecmedia.com)raised a question that is becoming increasingly urgent as agentic AI moves deeper into security operations centers: What should an AI agent actually be allowed to do?

In his CYBR.SEC.Media analysis, Hulme examined the controls organizations need around autonomous security agents — what data they can access, which systems they can touch, when they can act independently and where a human needs to approve the next move. 

**Article here:** 

[SOC AI Guardrails: Control What Agents Can Touch and DoAgentic AI is closing the SOC automation gap that SOAR never did, whether the guardrails around it are explicit enough to stop a breach, survive a regulatory audit or a court case is a different question.![](https://storage.ghost.io/c/ab/67/ab676516-71e3-473d-8f73-9e0692f5aaee/content/images/icon/CYBR.SEC.Media-Logo-copy-a6b873ac-ad81-484c-80b6-31873f3f6684.jpg)CYBR.SEC.MediaGeorge V. Hulme![](https://storage.ghost.io/c/ab/67/ab676516-71e3-473d-8f73-9e0692f5aaee/content/images/thumbnail/2a218920-81db-474d-bba8-fe2b6579f0aa-b3b5840c-de56-452d-afa2-7daa94f1107c.png)](https://www.cybrsecmedia.com/soc-ai-guardrails-how-to-define-what-agents-can-touch-and-do/)

CISA just supplied a compelling real-world backdrop for that debate.

In an Aug. 25 advisory titled [“A Tale of Two SOCs: Insights From Two Red Team Assessments,”](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-237a?ref=cybrsecmedia.com) the agency described simultaneous red team exercises against two critical infrastructure organizations. CISA used similar tradecraft against both. Its operators ultimately achieved full domain compromise and accessed sensitive business systems and cloud resources in both environments.

[Subscribe to the CYBR.SEC.Media newsletter](#/portal/signup/free)

But what happened along the way could hardly have been more different.

One SOC essentially watched the attack sail past. The other detected the initial compromise, isolated affected systems and forced CISA's red team to change how it conducted the rest of the exercise.

That difference matters on its own. Put it alongside the industry's rush toward autonomous SOC operations, however, and the lesson gets bigger.

The future of the SOC isn't simply about whether AI can detect an attack. It's about whether the entire security operation — human and machine — can turn detection into the right action quickly enough to matter.

## Same Attack, Very Different SOCs

CISA's two targets were a Government Services and Facilities Sector organization, identified as Organization A, and a Water and Wastewater Systems Sector organization, Organization B.

Both were compromised.

Organization A failed to detect or contain CISA's activity as the red team moved through the environment. Organization B reacted quickly to the initial compromise attempts, quarantined affected systems and disrupted the red team's ability to continue operating normally.

Security programs have traditionally put enormous emphasis on preventing compromise. But CISA's exercise starts from a less comfortable premise: assume the attacker gets in.

Now what?

At Organization A, alert noise was part of the problem. CISA found that false positives and routine alerts overwhelmed defenders, allowing meaningful signals to disappear into the flood. Organizational silos and unclear responsibilities compounded the problem by making effective incident response harder.

Organization B demonstrated the opposite.

When suspicious activity appeared, people investigated it. Systems were isolated. The red team's freedom of movement shrank.

That's what a SOC is supposed to do.

And it's exactly the workflow enterprises are now preparing to augment with AI agents.

## AI Can Solve the Alert Problem — and Create Another One

There is an obvious argument for agentic AI here.

Organization A suffered from one of the oldest problems in security operations: too much telemetry and too little human capacity to separate meaningful activity from background noise.

AI agents can potentially chew through enormous volumes of alerts, correlate activity across systems, enrich incidents and elevate the handful of events that actually deserve an analyst's attention.

Once an AI agent can recognize the attack, the next question becomes much more consequential:What are you willing to let it do about it?

Hulme's reporting showed how security organizations are already wrestling with that line. Some are creating tightly scoped personas defining what an agent can access and do. Others require human approval for higher-consequence actions such as containment. The underlying principle is that autonomy should increase only as the consequences of getting the decision wrong remain acceptable and the organization's confidence in the agent grows.

CISA's exercise makes that issue tangible. Imagine an AI agent had identified the same activity at Organization B. Should it alert an analyst? Almost certainly. Should it enrich the alert, correlate endpoint and identity telemetry and determine which other systems may be affected? Probably. Should it quarantine the endpoint automatically?

Now we're getting somewhere interesting.

## The Guardrail Paradox

Security teams are going to face a difficult balancing act.

Make AI guardrails too permissive and an agent can take a technically logical action with enormous unintended business consequences. An incorrect containment decision could disconnect critical infrastructure, disable an essential service, lock out legitimate administrators or disrupt production.

But make the guardrails too restrictive and organizations risk recreating Organization A with better technology.

The AI detects something important, enriches it beautifully, assigns an accurate confidence score, generates a perfect incident summary — and then waits while a human works through an approval chain.

Meanwhile, the attacker keeps moving.

That is why the most important AI security question may eventually become less about human-in-the-loop versus autonomous AI and more about determining precisely where the human belongs in the loop.

Not every action carries the same risk.

An agent collecting additional telemetry is not the same as an agent disabling an identity. Disabling an ordinary user account is not the same as disabling a privileged service account. Quarantining an employee laptop is not the same as severing connectivity to a production server or an OT system.

Organizations therefore need tiers of autonomous authority tied to potential blast radius.

Low-risk, highly reversible actions may increasingly happen automatically. Higher-consequence actions should require stronger confidence thresholds, additional validation or human authorization.

That's not merely an AI governance exercise. CISA's findings suggest it is becoming an incident-response requirement.

## Authority Matters as Much as Detection

There is another lesson buried in CISA's research that applies equally to humans and AI agents: Detection isn't enough.

CISA specifically warned that organizational silos, unclear responsibilities and limited defender authority can impede incident response. Its recommendations include breaking down those silos and empowering network defenders.

That problem doesn't disappear when organizations deploy AI. It gets encoded.

If an organization's analysts don't know whether they are authorized to isolate a critical system, putting an AI agent in front of them doesn't resolve the ambiguity. Somebody still has to decide what authority exists.

The difference is that organizations now have to express those decisions in machine-enforceable policy:

- This agent may isolate these endpoints.
- This agent may disable these identities.
- This action requires analyst approval.
- This system may never be touched autonomously.
- This action requires two independent signals before execution.
- This environment requires escalation to an incident commander.

Those are the AI guardrails Hulme described earlier this week. CISA's research demonstrates why they can't remain theoretical governance documents. They have to become part of the operating architecture of the SOC.

## Cloud Identity Makes the Stakes Even Higher

CISA also found weaknesses shared by both organizations.

Cloud environments were underestimated. The organizations lacked sufficient protections around workload identities and processes for responding to cloud compromise. CISA specifically recommended Conditional Access policies for workload identities, monitoring excessive or unused permissions and maintaining procedures for detecting, remediating and revoking compromised access and refresh tokens.

That becomes particularly important in an agentic SOC.

AI agents themselves increasingly operate as powerful non-human identities. They need credentials, API access and permissions across security tools to perform useful work.

An agent capable of investigating endpoint, identity, email, cloud and network telemetry may consequently have extraordinary visibility — and potentially extraordinary authority.

The same least-privilege principles organizations apply to human administrators therefore need to apply to the agents assisting them. An AI agent shouldn't receive broad permissions simply because broad permissions make automation easier.

Its identity should be scoped. Its actions should be logged. Its privileges should be limited to what its role requires. Its behavior should be continuously monitored. And consequential actions should have explicit escalation thresholds.

Otherwise, the tool designed to reduce the attacker's blast radius becomes part of the blast radius itself.

## The Real Lesson From CISA's Two SOCs

It would be easy to read CISA's advisory as another reminder to tune alerts, improve incident response and clean up cloud permissions.

All of that is true.

But the timing makes the research more important.

Security operations are entering a period in which the entity triaging the next alert may not be a person. The entity correlating endpoint and identity activity may not be a person. And increasingly, the entity deciding what should happen next may not be a person either.

CISA's two SOCs show what happens when detection and response are disconnected. Agentic AI promises to close that gap dramatically. The challenge is making sure organizations don't solve one problem by creating another.

The winning SOC won't necessarily be the one with the most autonomous AI. Nor will it be the one that requires a human to approve everything.

It will be the one that has decided, before the attack starts, what humans and machines are each authorized to do — and can turn the right detection into the right action before an attacker gets the chance to move again.

[ ![HOU.SEC.CON CTA](https://s3.us-east-1.amazonaws.com/assets.cybersecmedia.com/HSC+CTA.jpg) ](https://houstonseccon.com/?ref=cybrsecmedia.com)