As threat actors increasingly leverage AI and automation to move faster and scale their operations, Arctic Wolf built the Aurora Agentic SOC to operate at machine speed, shifting the majority of investigation work to AI while enabling human analysts to focus on the threats that require oversight and expertise.

Drawing on data from more than 11,000 organisations across more than 100 countries, the report provides a comprehensive view into agentic security operations at scale. According to the company, the findings show how security operations at Arctic Wolf have dramatically changed in just one year, redefining how work is divided between AI and human analysts.

Humans now account for only 2% of caseload

Approximately one year ago at Arctic Wolf, humans handled 81% of investigations without AI assistance. Today, human-only investigations account for only 2% of total caseload, while agentic AI resolves 60% of investigations autonomously and AI-human collaboration has expanded from less than 1% to 38% of investigations. This dramatic shift underscores the need for a new security operations paradigm. As investigation volume and attacker speed outpace what human-led operations can efficiently handle, organisations need agentic security operations that combine AI and human expertise to remain resilient in the age of AI.

Keeping up with the pace

The need for machine-speed security operations has become increasingly evident as organisations face fast-moving threats and critical vulnerabilities, such as PHP2Shell. Security teams often have hours, not days, to determine exposure, prioritise remediation, and investigate signs of compromise. The report shows that Arctic Wolf’s agentic AI is helping organisations meet those demands by automating investigation workflows while preserving human oversight for the decisions that matter most.

The report demonstrates how the Aurora Agentic SOC improves both speed and efficiency at scale. While monthly investigation volume increased 21% over the past year, alert volume declined 19%, reducing noise and analyst burden even as workloads grew. At the same time, the average time from an alert-generating event to an actionable ticket fell 36%, enabling faster response and shrinking the window available to attackers.

Attackers are working at machine speed

“The reality of today’s threat landscape is that attackers are already operating at machine speed, and organisations can no longer rely on AI-only or human-only security operations to keep pace,” said Dan Schiappa, President of Technology and Services at Arctic Wolf. “Arctic Wolf built a new operating model where AI handles the volume, humans provide oversight, and both work together to deliver better outcomes. That’s how we help organisations turn AI into a force multiplier for their security teams rather than just another tool.”

Powered by the Aurora Superintelligence Platform, which processes more than 10 trillion security events each week, Arctic Wolf operates the world’s largest commercial agentic SOC, conducting more than 200,000 investigations weekly and resolving more than three million security cases since launching in March 2026. The report underscores how Arctic Wolf’s investment in agent-led security operations with humans in-the-loop is delivering measurable results at scale.

Speed combined with trust

The report emphasises that in the age of AI, speed alone is not enough. Trust remains the biggest barrier to AI adoption in security operations, and Arctic Wolf is solving it. Organisations need confidence that AI-driven decisions are accurate, explainable, and aligned to their business context.

Arctic Wolf’s patent-pending Swarm of Experts is designed to help organisations build that confidence. This network of specialised AI agents within the Aurora Agentic SOC executes and validates work across major SOC functions. The AI Trust Engine governs agent behaviour, so agents may act autonomously when confidence is high. Agents are designed to escalate cases that are uncertain, novel, or outside their validated experience to a security analyst rather than acting on them. Each human decision becomes a new learning signal that expands what agents can resolve with confidence.

More visibility, less noise

Everyday business activity buries threat signals, making visibility more important than volume. The Aurora Agentic SOC opens just 13 investigations for every billion observations processed and surfaces one alert for every 175.6 million observations. While overall alert volume declined, the share of high- and critical-severity tickets remained steady, so security teams see less noise without sacrificing visibility into meaningful threats.

Those efficiencies translate into real-world outcomes. In the company's analysis of customer data, Arctic Wolf customers using Aurora Managed Detection and Response (MDR) with endpoint coverage saw seven times fewer events escalate to investigation than customers using endpoint detection and response alone, while realising an approximately 12x cost advantage compared with building and operating an agentic SOC in-house.