# How agentic investigation changes SOC staffing and analyst roles

DevFeed: [How agentic investigation changes SOC staffing and analyst roles](<https://devfeed.tech/articles/the-soc-just-gained-a-capability-it-never-had-80125.md>)

Original publisher: [Read original article](<https://www.sentinelone.com/blog/the-soc-just-gained-a-capability-it-never-had/>)

Author: Matt Berry

Published: 2026-09-11T00:00:00Z

Content type: opinion

Language: en

Sources: [SentinelOne](<https://devfeed.tech/sources/sentinelone.md>)

Topics: [Agentic SOC](<https://devfeed.tech/topics/agentic-soc.md>), [Security Operations Center](<https://devfeed.tech/topics/security-operations-center.md>), [alert triage](<https://devfeed.tech/topics/alert-triage.md>), [human in the loop agent](<https://devfeed.tech/topics/human-in-the-loop-agent.md>)

Tags: [agent](<https://devfeed.tech/tags/agent.md>), [agentic](<https://devfeed.tech/tags/agentic.md>), [agentic-ai](<https://devfeed.tech/tags/agentic-ai.md>), [agentic-investigation](<https://devfeed.tech/tags/agentic-investigation.md>), [agentic-workflows](<https://devfeed.tech/tags/agentic-workflows.md>), [ai](<https://devfeed.tech/tags/ai.md>), [automation](<https://devfeed.tech/tags/automation.md>), [company](<https://devfeed.tech/tags/company.md>), [development](<https://devfeed.tech/tags/development.md>), [on-call](<https://devfeed.tech/tags/on-call.md>), [soc](<https://devfeed.tech/tags/soc.md>)

## AI overview

The article argues that agentic investigation can handle low-priority alerts that security teams lack the staff to investigate, while analysts focus on judgment, ambiguous cases and directing AI agents. It presents a three-layer security operations model: always-on AI investigation, human operators, and managed security experts available for incidents that exceed an organization's capabilities. The article emphasizes governance and human oversight, and describes SentinelOne products as the platform behind this approach.

## Source excerpt

Agentic investigation is the shift your SOC could never staff. Here is how the always-on AI, the evolved analyst, and the expert on call now fit together.