When Your AI Red Team Becomes Your SOC
Detection infers that something happened. Exploitation proves what is possible. We are pouring agents into the half that can only ever guess, and leaving the half that produces receipts to a quarterly pentest.
Detection infers that something happened. Exploitation proves what is possible. We are pouring agents into the half that can only ever guess, and leaving the half that produces receipts to a quarterly pentest.
Date: 2026-08-11 | Classification: TLP:CLEAR
Why this matters. Stop asking how to make detection faster. Ask which of your security functions can produce proof instead of inference, and put your agents there first.
The Operator's Take
Two claims turn up in nearly every public discussion of AI and security right now. Offensive AI is moving fast. Defence is behind, and always will be. The second one almost always arrives with a shrug, the way people talk about weather.
I do not think it is weather. I think it is a consequence of what we chose to automate, and I think it is reversible.
Every dollar going into agentic detection is being spent making a guess arrive faster. Meanwhile the one security function that produces actual proof, and which agents are genuinely good at, still runs twice a year and gets scheduled around holidays.
Detection is inference. Exploitation is proof.
Every detection control ever built is an inference engine. A log line is not an intrusion. It is a trace that something might have been one. Correlation is the machinery for turning weak traces into a guess with a confidence attached, and even done perfectly, the output is a probability about the past.
Exploitation produces the opposite kind of statement. When an agent takes a host, there is no inference step anywhere in the chain. The host was ownable. You are not estimating whether it could be done, and you are not waiting to see whether someone tries. You have the receipt.
That distinction decides what automation does to each of them. Point agents at inference and you get faster guesses at the same truth rate, which is not an improvement, it is a volume increase. Point them at proof and every single run either produces something checkable or produces nothing.
| Function | What it outputs | What more agents buy you |
|---|---|---|
| Log collection and correlation | A probability about the past | More alerts, same truth rate |
| Threat hunting | A hypothesis | More hypotheses, still unproven |
| Vulnerability scanning | A version string and a severity guess | More findings nobody has confirmed are reachable |
| Exploitation | A working proof of access | Coverage. Every run is checkable |
| Remediation verification | The exploit stops working, or it does not | A closed loop, for the first time |
What offensive defence actually looks like
Not a quarterly pentest. Not a scan with a nicer dashboard. A standing agent per asset.
Every host, every application, every new deployment gets its own exploit agent from the moment it exists, and that agent never stops. It does not wait for a scoping call or a statement of work. It reports what it actually achieved rather than what a severity score predicted. Remediation is driven by demonstrated exploitability, not by a CVSS number attached to a version string that may not even be reachable in your environment.
And then the part conventional vulnerability management has never had: after the fix, it proves the fix. The ticket closes when the exploit stops working, not when an engineer marks it done and moves on. We have spent twenty years closing security tickets on assertion. Nothing else in engineering works that way, and we would not tolerate it anywhere else.
Where this does not work, and saying so is the point
Continuous exploitation proves what is reachable and exploitable by your own agent, from where that agent starts. It says nothing at all about an insider using access they legitimately hold, stolen credentials used exactly as the real user would use them, a compromised update arriving through a channel you already trust, or somebody talking your service desk into a password reset.
None of those leave an exploitable finding to discover. They look like normal activity, because they are normal activity performed by the wrong person. That is precisely the ground detection exists to hold, and it is not going anywhere.
So this is not an argument for deleting the SOC. It is an argument that the SOC currently owns two jobs, is bad at one of them by construction, and should hand that one to something that can prove its answers.
Where that leaves detection
Detection stops being the primary control for the vulnerability-driven attack surface, and becomes the specialist control for the identity and trust surface. That is a smaller job and a much more interesting one, and it is a job where the false-positive tax is worth paying because there is no alternative signal.
Correlation, meanwhile, drifts closer to vulnerability management than to threat hunting. Once your own agents are continuously proving what is exposed, the residual worth watching is the set of gaps they could not reach. That is a far shorter list than the one your SIEM is producing today, and every item on it is there for a reason you can name.
The version of this I would put to anyone making that argument: defence looks permanently behind because the industry keeps pouring capability into the half of security that cannot produce proof. An agentic SOC makes the guess faster. It does not make it true. Offensive defence produces receipts, continuously, and a receipt is the only artefact that has ever survived contact with an executive asking whether we are actually exposed right now.
We are not behind because the attackers have better agents. We are behind because we pointed ours at the half that can only ever guess.