Moving agentic AI from pilot to production comes with considerable challenges.
"This is not a set-it-and-forget-it technology," says Benjamin Spencer,
product director at cybersecurity services provider Optiv. "The people who are doing this have to be able to implement it effectively, and they have to know the pitfalls, and then they have to implement it so that it is scalable."
Many enterprises aren't doing any of that. One of the primary reasons those we interviewed see enterprises fail to move agentic AI into production is that they bootstrap models onto existing workflows without addressing the underlying data architecture.
“Flooding a model with a large, poorly structured database and expecting reliable analysis does not work at scale and produces cost overruns or accuracy problems as context degrades,” Spencer says.
Getting that data architecture and workflows right is essential. Agents do not reason well about environments they can't read accurately, and most security operations teams give those agents questionable inputs to work with.
The gap between what an AI agent thinks is true about an environment and what is actually true in that environment is one way data hygiene becomes a security issue. Stephen Morrow, chief solution officer at AirMDR, illustrated this with a client that was running three separate human resources (HR) systems, two of which contained incorrect geography data. The client knew about the issue. "We don't keep those up to date," they informed Morrow's team.
Related:
Bill Brenner
, and CYBR.SEC.Media
, and CYBR.SEC.Media
Morrow's team responded with a single agentic instruction: when investigating a case and fetching HR data, ignore the two out-of-date systems and always prefer the updated database; if that one is unpopulated, do this instead. One line changed the model's output across every case that touched HR data. That shows how agentic AI can reason through variable, real-world messiness that scripts can’t.
However, such adjustments are only possible when an organization actually has data that resembles its environment. Morrow calls this kind of environmental context "facts." And building and maintaining organizational facts is a continuous process, as mergers and acquisitions, tool stack changes, and personnel shifts all create drift between what the agent believes about the environment and the environment itself. Without discipline to keep those facts current, the agent's output degrades in ways that are hard to see until a bad outcome occurs.
Workflow design is another area where organizations underinvest before investing in agentic AI security operations. The instinct when deploying agentic AI is to automate investigations first, and then work on everything else, including case management, remediation workflows, chain-of-custody logging, integration with existing tooling, and more. However, Morrow stressed that areas such as case management and chain of custody must be completed first.
If there’s no case management system in place when the agent starts an investigation, investigated cases have nowhere to be managed. The agent completes triage and enrichment, reaches a conclusion, and has nowhere to manage it centrally. And if chain-of-custody workflows aren’t in place, the moment the agent takes its first action in a real investigation, that action is potentially evidence. If logging captures what the agent did and why isn’t separated ahead of time, the evidentiary record is corruptible.
And remediation automation, while it uses the same underlying engine as investigation automation, requires explicit playbook review before it runs rather than being automatically generated by the agent. Remediation can’t be automated because if a remediation action goes bad, such as the wrong host being isolated or legitimate traffic being blocked, the consequences of an operational outage, business disruption, or security gap created can be high.
Restricting high‑impact actions is essential. Non‑deterministic systems, even highly capable ones, should not be able to unilaterally act on high-stakes responses such as isolating domain controllers, revoking large sets of permissions, or pushing production configuration changes. “Should anyone really trust a non-deterministic system to go out there and isolate a domain controller?” he asked.
Separate credentials, strict policies, approvals, and explicit human‑in‑the‑loop checks should control those operations. In practice, that means agents can analyze, prioritize, and recommend, but not execute, destructive or business‑critical changes on their own. This limits negative impact, preserves trust in the system, and aligns AI‑driven automation with the same least‑privilege principles applied to humans and traditional software services.
Additionally, Spencer argued, specialized agents are critical in agentic AI systems because they mirror how effective human teams operate: through clear roles, bounded responsibilities, and focused expertise. Instead of building a single “god‑agent” that tries to know and do everything, teams create smaller agents that each handle a well‑defined task such as threat‑intel enrichment, alert triage, or log correlation. This segmentation makes systems easier to design, understand, test, and monitor. It also lets teams optimize each agent’s access to data, tools, and APIs so it sees only what it needs. This should improve reliability and security. Also, when something does go wrong, it’s much simpler to isolate which agent or workflow failed than to debug an opaque, monolithic AI.
The efficiency gains are undeniable when deployed correctly. And investments in agentic AI for security operations seem to have significantly dampened investments in SOAR. While SOAR has been a $2 billion market for years, the AI-amplified security market is expected to go from $49 billion now to roughly $204 billion by 2023.
But security teams must make sure their program has the fundamentals in place. That includes a clean tool stack with telemetry flowing from endpoint, network, and identity systems; asset management sufficient to know what normal looks like; facts and investigation notes built to reflect the actual environment rather than the assumed one; and case management and chain-of-custody logging architected before the first agent ran.
The teams that can check these boxes are now automating their detection engineering and are gaining efficiencies that were previously out of reach: 90% of alerts fully investigated within five minutes, fully correlated and enriched, according to Morrow's production benchmark at AIR MDR; consistent investigation quality that does not degrade on the hundredth alert of a shift; and the ability to measure and close detection coverage gaps continuously.
