Artificial intelligence now autonomously resolves 60 per cent of security investigations handled by Arctic Wolf, highlighting how agentic AI is reshaping security operations across the sector.
The findings, published in the firm’s 2026 Agentic Security Operations Report, draw on data from more than 11,000 organisations across more than 100 countries.
The shift, the company said, has been substantial. About a year ago, human analysts handled 81 per cent of investigations without AI assistance.
Today, human-only investigations account for just 2 per cent of the company’s caseload, while collaboration between AI and human analysts has grown from less than 1 per cent to 38 per cent.
The company’s Aurora Agentic Security Operations Centre handles the bulk of the work, allowing human analysts to focus on cases requiring specialist expertise and oversight.
“The reality of today’s threat landscape is that attackers are already operating at machine speed, and organisations can no longer rely on AI-only or human-only security operations to keep pace,” Dan Schiappa (pictured), president of technology and services at Arctic Wolf, said in a statement.
“Arctic Wolf built a new operating model where AI handles the volume, humans provide oversight, and both work together to deliver better outcomes. That’s how we help organisations turn AI into a force multiplier for their security teams rather than just another tool.”
The report found monthly investigation volumes increased 21 per cent over the past year, while alert volumes fell 19 per cent. The average time between an alert-generating event and an actionable ticket also dropped by 36 per cent, giving defenders potentially more time to respond before attackers can act.
The company said its Aurora Superintelligence Platform processes more than 10 trillion security events each week and conducts more than 200,000 investigations weekly.
The approach relies on multiple specialised AI agents, which Arctic Wolf calls its Swarm of Experts, and an AI Trust Engine designed to govern their behaviour. Agents can act autonomously when confidence is high, but are designed to escalate uncertain, novel, or unfamiliar cases to human analysts.
Arctic Wolf also reported that its Aurora Managed Detection and Response customers with endpoint coverage experienced seven times fewer events escalating to investigation than customers using endpoint detection and response alone.
The company said this approach delivered an approximately 12-fold cost advantage compared with building and operating an agentic SOC in-house.
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
