Arctic Wolf has released its 2026 Agentic Security Operations Report, saying agentic AI now resolves 60% of security investigations in its security operations centre (SOC) model.
The company said the report draws on data from more than 11,000 organisations across more than 100 countries, and telemetry of more than 10 trillion security events each week.
Arctic Wolf said its internal investigation mix has shifted over the past year: human-only investigations declined from 81% to 2% of total caseload, while AI-human collaboration rose from less than 1% to 38%. The company described the change as a response to attacker speed and investigation volume that it says outpaces human-led security operations.
The report also points to operational metrics the company attributes to its Aurora Agentic SOC model. Arctic Wolf said monthly investigation volume increased 21% over the past year while alert volume declined 19%. It also said the average time from an alert-generating event to an actionable ticket fell 36%.
In APAC, the report states that 42% of alerts arrive outside local business hours and that the Aurora Agentic SOC investigates these alerts continuously. It also claims 60% of investigations are resolved by AI with no human intervention.
The report highlights a case in APAC where, according to the company, a third-party consultancy’s AI tool incorrectly declared a customer compromised, while Arctic Wolf’s incident response team later found no breach.
Dan Schiappa, president of technology and services at Arctic Wolf, said: “The reality of today’s threat landscape is that attackers are already operating at machine speed, and organisations can no longer rely on AI-only or human-only security operations to keep pace.”
Arctic Wolf said its Aurora Superintelligence Platform processes more than 10 trillion security events each week, and that since launching its agentic SOC in March 2026 it has conducted more than 200,000 investigations weekly and resolved more than three million security cases.
You can read the full report here.
