Arctic Wolf has reported a shift towards artificial intelligence-led security investigations, with AI now resolving 60% of cases without human intervention across its security operations centre.
The cybersecurity company's 2026 Agentic Security Operations Report draws on data from more than 11,000 organisations in over 100 countries. It found that investigations handled exclusively by human analysts fell from 81% of cases about a year ago to 2%. Investigations combining AI and human oversight increased from less than 1% to 38%.
The findings reflect changes in how security operations teams handle growing investigation workloads and respond to threats that can develop at machine speed.
AI adoption
Arctic Wolf's Aurora Agentic Security Operations Centre (SOC) uses AI agents to investigate security events, while human analysts oversee cases that require additional judgement or verification.
The company said its platform processes more than 10 trillion security events each week and conducts over 200,000 investigations weekly. Since launching in March 2026, the operation has resolved more than three million security cases.
The report also highlights the increasing need for automated investigation workflows as organisations face vulnerabilities and threats that require rapid assessment. Security teams may have only hours to establish their exposure, prioritise remediation and investigate potential compromises.
"The reality of today's threat landscape is that attackers are already operating at machine speed, and organisations can no longer rely on AI-only or human-only security operations to keep pace," said Dan Schiappa, President of Technology and Services, Arctic Wolf. "Arctic Wolf built a new operating model where AI handles the volume, humans provide oversight, and both work together to deliver better outcomes. That's how we help organisations turn AI into a force multiplier for their security teams rather than just another tool."
Alert volumes
Monthly investigation volumes increased by 21% over the past year, while overall alert volumes declined by 19%, according to the report.
The company said its SOC opens 13 investigations for every billion observations processed and surfaces one alert for every 175.6 million observations. The figures indicate that most telemetry does not result in an investigation requiring further attention.
Despite the reduction in alert volumes, the proportion of high- and critical-severity tickets remained steady. Arctic Wolf said this allowed security teams to reduce the volume of noise without losing visibility into significant threats.
The average time between an alert-generating event and the creation of an actionable ticket also fell by 36%. The reduction shortens the time required to move from detecting a potential security issue to providing information that teams can act on.
Human oversight
The report identifies trust as a significant barrier to adopting AI in security operations. Organisations need confidence that automated decisions are accurate, explainable and appropriate to their business environments.
Arctic Wolf uses its Swarm of Experts, a network of specialised AI agents, to perform and validate work across security operations functions. Its AI Trust Engine governs agent behaviour and determines when cases can be handled autonomously.
Cases that are uncertain, unfamiliar or outside an agent's validated experience are escalated to a security analyst. Human decisions then provide feedback that can help the system handle similar investigations with greater confidence in the future.
The approach is intended to limit the risk of AI systems making decisions when they lack sufficient evidence. It also allows analysts to concentrate on cases that require additional investigation rather than reviewing every alert.
Regional monitoring
The report's findings have implications for security teams operating across different time zones, where threats can emerge outside normal business hours.
In the Asia-Pacific region, 42% of alerts arrive outside local business hours, according to the additional regional findings. Arctic Wolf's Aurora SOC investigates alerts around the clock, applying the same investigative approach to cases received during the day and overnight.
The regional data also highlights the importance of verifying AI-generated conclusions. In one APAC case, a third-party consultancy's AI tool concluded that a customer had been compromised. Arctic Wolf's incident response team subsequently found no breach.
The example illustrates the need for escalation and independent verification when automated systems reach conclusions that could prompt incident response measures.
Operational costs
Arctic Wolf's analysis of customer data found that customers using its Aurora Managed Detection and Response service with endpoint coverage experienced seven times fewer events escalating to investigation than customers using endpoint detection and response alone.
The company also reported an approximately 12-fold cost advantage compared with building and operating an agentic SOC in-house.
The figures relate to Arctic Wolf's analysis of its customer data and its comparison with in-house operations. They reflect the company's assessment of how automated investigation and managed security services affect investigative workloads and operating costs.