Agent Washing in the SOC: When automation gets a new label
Almost nine out of ten security teams report a significant increase in the volume of alerts over the past year, with just under half seeing an increase of more than 25 per cent. Three in four security managers now cite alert fatigue as one of their biggest operational problems, whilst almost as many report burnout and chronic staff shortages within their teams (Pulse of the AI SOC Report 2025).
It is precisely in this situation that virtually every vendor promises the same solution: an AI agent that processes alerts independently, detects threats on its own and automatically initiates responses. 87 per cent of organisations are already testing such tools or using them in production. However, only 9 per cent of security teams say they truly trust the results produced by this AI (ibid). Between these two figures lies the question that every IT decision-maker currently has to grapple with: How much of what is sold as an agent stands up to closer scrutiny?
The analyst firm Gartner has coined its own term to describe the suspicion that the answer is often sobering: ‘Agent Washing’ – the rebranding of existing automation as a standalone agent, without any change to the underlying technology (Gartner definition, summarised by D3 Security). The reason for this is obvious: without an AI connection, investor capital is currently hardly flowing at all, and an AI label is easier to sell than a robust proof of concept.
One word, two completely different technologies
The word ‘agent’ can mean very different things from a technical perspective, and it is precisely this difference that determines the actual operational risk.
One variant is an assistant: a security team describes in natural language what should happen and receives a ready-made workflow or playbook in return. Before any of this takes effect in the production environment, a human checks and approves the proposal. The other variant makes decisions and acts fully automatically – for example, it isolates an endpoint as soon as it detects a threat, without anyone having to give prior approval. Both variants are currently referred to as ‘agents’. Only one of them can cause real damage without human intervention.
A simple real-world example illustrates just how real this risk is: An agent deems a clue found on the internet sufficient to classify a file as malicious and deletes it automatically. Only afterwards does it emerge that the file was part of a business-critical application. The application server is gone; operations have ground to a halt. Automation that acts autonomously usually saves time. However, it can also cause more damage in seconds than a team can rectify in hours.
The percentages currently being used in marketing
98 per cent decision accuracy. 100 per cent automated triage. 95 per cent of cases processed autonomously. Figures like these currently appear in almost every product announcement, and they come, almost without exception, from the manufacturer itself. We therefore recommend that IT decision-makers always ask to see such metrics displayed live in their own reports during discussions with vendors, rather than accepting them at face value.
Even if the figure is correct, it says little about the costs: Greater automation usually also means higher token and software costs, which can partly eat into the savings made on staff costs. Gartner also confirms that caution is warranted in its own ‘Hype Cycle for Security Operations 2025’: AI SOC agents and cybersecurity AI assistants are currently both at the ‘Peak of Inflated Expectations’ – the manufacturers’ claims exceed the evidence for sustainable, measurable improvements (summarised by Cynet).
Seven questions Gartner recommends buyers ask
How can the difference between genuine progress and false claims be clearly demonstrated during discussions with vendors? To this end, Gartner analysts published their own questionnaire in March 2026 (BleepingComputer, summary of the Gartner report):
Is the vendor solving an existing problem within their own SOC, or are they selling a feature that nobody has asked for?
How is success measured – solely by the number of alerts handled, or by hard metrics such as detection, investigation and response times?
Will the provider still be in the market in two years’ time, given its customer base, funding and pricing model?
Does the agent make your own analysts better, or does it simply keep them occupied with different tasks?
Where exactly are the limits of autonomy? Is there an approval process before action is taken, or is notification only provided after the event?
Can the agent be natively integrated into existing SIEM, EDR, SOAR and identity systems?
Is it possible to trace exactly what the agent has done – which queries, which records, which decisions?
Anyone who receives concrete answers to these seven questions during discussions with the supplier will have a significantly better basis for their purchasing decision than any glossy presentation.
Liability and regulation are catching up
The question of responsibility is also becoming more relevant from a legal perspective. Just how costly a fault in an automated system can be is illustrated by the CrowdStrike outage in July 2024, when a faulty update paralysed air traffic, hospitals and emergency services worldwide. Liability was limited in the standard contract to the licence fees paid. Affected companies could therefore, at best, expect a refund, regardless of the actual damage (Yahoo Tech, assessment by a cybersecurity lawyer). Anyone who grants an agent the power to make autonomous decisions should therefore not only assess the agent’s capabilities, but also examine the liability clauses in the contract.
Regulatory requirements are also becoming stricter: from 2 August 2026, the transparency obligations set out in Article 50 of the EU AI Act will apply. AI systems that interact directly with humans must identify themselves as such (Overview of the EU AI Act Explorer). So anyone who gives their agent a human name will, in future, have to think more carefully about whether the effort involved in labelling it is worth it.
What this means for the next purchasing decision
For IT decision-makers, this essentially means: An agent only earns trust through verifiable results in its own environment, not through the percentage figure on the first slide. Equally important is the question of one’s own maturity: those who do not yet operate a SOC have so far derived little benefit from highly automated agent platforms. The real leverage only comes with appropriate scaling.
It is precisely these questions that Michael Döhmen and Andreas Papadaniil explore in depth in the latest episode of the Cybersecurity Basement podcast.