AI and AI agents continue to make inroads into security operations centers (SOCs), bringing automation and speed to what are critical components for enterprises and MSSPs in an increasingly complex cybersecurity environment.
Growing numbers of security vendors are offering AI-powered SOCs to address a range of challenges, from the rapidly expanding number of alerts to a lack of personnel. As
Jon Hencinski, head of security operations at
Prophet Security,
wrote late last year, “security operations face a fundamental math problem: the attack surface expands exponentially while headcount remains linear. SOC Directors cannot hire their way out of this deficit. ... This capacity failure creates the operational necessity for the AI SOC.”
A 2025
study by the
Cloud Security Alliance backed up the AI push with numbers, noting that AI-assisted SOC analysts completed investigations 45% to 61% faster than human analysts and did so with 22% to 29% higher accuracy.
Securonix is the latest vendor to go in this direction. The company this week announced a partnership with cloud giant
Amazon Web Services (AWS) that has resulted in two AI-driven security offerings. The first is Sam, an AI SOC analyst that the company said grows an SOC’s capacity without having to add people. It automates Tier 1 and 2 tasks, from triaging alerts to investigations, correlation, and response preparation.
Sam and the Agentic Mesh
Sam runs within the new Securonix Agentic Mesh, an orchestration layer used to coordinate specialized AI agents through threat detection, investigation, response, and reporting, according to the company. The mesh ensures shared context, enforces enterprises’ policies, and makes sure that every AI-assisted can be explained, audited, and reversed, if needed. It was built using Amazon’s Bedrock AgentCore, a managed platform used to build, deploy, and operate agents at scale.
Simon Hunt, chief product officer at Securonix, echoed Hencinski’s comments about the structural problems facing SOCs – too few analysts, rising numbers of alerts, and telemetry scattered among multiple environments – that can’t be remedied by simply by adding more tools. In a
blog post, Hunt also said that while AI can address such challenges, many organizations – justifiably – don’t trust AI used in production in SOCs.
Given that, Securonix executives took a different approach, he said. They asked, “how do we modernize the SOC in a way that scales analyst capacity, governs AI by design, and proves value in terms security leaders and boards actually care about? The answer is the Productivity-Based Agentic SOC.”
A Shift in Focus for AI
The emphasis for the SOC moves away from cost models based on the volume of data and consumption and to analyst productivity and outcome-driven data economics, both of which can be measured.
“Instead of licensing AI as opaque features, they measure the work AI performs on behalf of analysts,” Hunt wrote.
He told MSSP Alert that AI is moving from assistance to execution. Where traditional AI helps analyst search faster or summarize findings, agentic AI can plan, coordinate, and complete multi-step work across the threat lifecycle and is framed by boundaries and oversight. It’s the direction Securonix is taking with SAM and Agentic Mesh.
“Sam is designed to do real SOC work: triage, investigation support, correlation, and guided response,” Hunt said. “Agentic Mesh is how we govern and scale that work across tools and workflows. It brings structure, policy, and explainability so AI actions remain controlled and auditable.”
The Cloud's Critical Role
He said the vendor’s partnership with AWS is crucial because “this shift requires enterprise-grade cloud foundations. Scale, security, and reliability are not optional when AI becomes part of operations. Our work with AWS supports the cloud-native platform underneath these capabilities and helps organizations run AI-driven security operations with confidence.”
Compliance also is an issue Sam addresses by helping security teams answer questions more quickly. It can pull relevant context, show activity tied to controls, and accelerate investigation that support audit preparation.
All of this is important for MSSPs that are supporting client SOCs or providing managed offerings through SOC-as-a-service, a fast-growing market that is expected to grow from $7.37 billion last year to
$14.66 billion by 2030.
AI as 'Capacity Multiplier' for MSSPs
Hunt said MSSPs and other services providers should see AI as a “capacity multiplier,” but it needs to be governed. To make it work, MSSPs need clear policy boundaries – such as what actions AI can recommend and what it can execute – strong data discipline, and measurement. Providers need to be able to show clients what work AI performance, the outcomes it improved, and the risks that were reduced.
“AI without measurable value becomes noise,” Hunt said.
Those requirements can come with Sam and Agent Mesh, he added. Sam can increase analyst throughput and consistency for tenants, including for repeatable but time-consuming tasks like triage and investigation. Agentic Mesh provides the necessary controls and auditability for multi-tenant environments. “The value for MSSPs is straightforward,” Hunt said. “More work completed per analyst, faster response, more consistent quality, and clearer proof of value to clients. That is how AI becomes a business advantage, not just a feature.”
