Zscaler unveils Agentic SOC with AI agents

In a typical corporate SOC, alerts flow in from networks and endpoints, and humans work through them: pulling related logs, checking devices, users, and destinations, judging whether it is an attack, and then isolating infected machines or cutting off communication if it is. This involves multiple stages — detection, investigation, judgment, and response — and not every alert turns out to be a serious incident.

Zscaler's answer is to embed AI agents into each of those stages. The point it stresses is that the goal is not simply having AI analyze alerts; it is using AI agents to support the entire sequence and thereby speed up the response itself. That mirrors the broader shift in the security field, where AI's ability to find vulnerabilities, generate attack code, and build attack paths lets attackers compress work that used to be manual.

The stakes here hinge on whether the agents hold up across all four stages rather than just the analytical part — because if they do, the response side could move at a pace closer to the attacks. For SOC teams, the near-term question is how this overlaps with existing workflows and tooling, which is likely to shape adoption as much as the technical results.