Arctic Wolf CEO Nick Schneider told CRN that the company’s analysis indicates roughly 75% of the roles needed to run a security operations center (SOC) at a bare minimum could become “almost entirely agentic.” The figure is a vendor-attributed estimate, not an independently validated industry benchmark, and it does not mean that 75% of cybersecurity jobs are already automated.
What Schneider actually said
In questions at the 2026 XChange Best of Breed Conference in Atlanta, reported by CRN on October 12, 2026, Schneider described an internal analysis of the staffing needed to operate a SOC. His wording was specific: “We’ve done some analysis on what you would need, at bare minimum, to be able to operate a SOC. And you can get about 75 percent of the roles to be almost entirely agentic.”
As an Amazon Associate I earn from qualifying purchases.
He added that the remaining human contribution would center on “some level of trust and interaction.” That framing concerns roles in a minimum operating model, not the entire cybersecurity workforce, every SOC task, or a promise that customers can immediately remove three-quarters of their staff.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What “almost entirely agentic” means
An agentic SOC uses software agents to carry out multistep security work rather than merely provide alerts or suggestions. Depending on the operating model, agents could investigate events, correlate telemetry, apply detection logic, recommend or execute responses, and hand off exceptions. Schneider’s statement does not identify which roles or tasks were counted, how much human review each would retain, or what level of autonomy qualifies as “almost entirely agentic.”
#1 Best Overall
The human boundary
Schneider said customers should be able to decide where a person must be involved. “Think about a world where a customer could denote where they want a human involved—and then that human could be Arctic Wolf, or it could be the partner,” he said. That implies configurable approval points rather than a single automation setting. A customer might require approval for containment, notification of executives, changes to production systems, or actions with legal and regulatory consequences, while allowing agents to handle routine triage.
Planned visibility and intervention for partners
CRN reported that Arctic Wolf expected to provide capabilities in the coming months that would let partners observe what agents did and why, then step into selected processes when human judgment was needed. The report describes these controls as planned; it does not confirm that they had been released by October 12, 2026.
Rank #2
- Observation: partners would be able to see an agent’s actions and rationale.
- Intervention: a partner could take over defined workflows when a case exceeded an agreed automation threshold.
- Allocation of responsibility: the human role could be supplied by Arctic Wolf or by the customer’s solution-provider partner.
For managed service providers, the practical question is not simply how many roles disappear. It is whether the service can expose enough evidence, controls and auditability for a partner to remain accountable while agents operate at machine speed.
Free tools Windows power users keep installed
One-click scans. No signup required.
Where the estimate could matter
| Decision area | Question for a SOC operator |
|---|---|
| Delegation | Which investigations and response steps can run without approval? |
| Trust threshold | What actions require a human because of business impact, risk or regulation? |
| Visibility | Can analysts see the data, steps and reasoning behind an agent’s decision? |
| Intervention | Can an authorized person pause, override or complete a workflow? |
| Service ownership | Will Arctic Wolf personnel or a channel partner provide the human escalation layer? |
Schneider’s company-authored discussion presents this as a shift from buying and maintaining collections of tools toward buying security outcomes. He identifies integration work, detection writing, model tuning, agent-framework assembly and 24-hour coverage as burdens organizations currently manage. Those are his and Arctic Wolf’s observations, not an independent measurement of industry staffing.
How Aurora Agentic SOC fits
Arctic Wolf announced Aurora Agentic SOC on March 23, 2026, as an AI-centered security operations offering built on its Aurora Superintelligence Platform. The announcement establishes the product name and the company’s intended direction. Claims in that launch material about scale or effectiveness are company claims, not independent proof that the 75% estimate will be achieved in customer environments.
What the evidence does—and does not—show
Established by the report
- The approximately 75% figure is Schneider’s description of Arctic Wolf’s own analysis.
- It applies to the roles required to operate a SOC at a bare minimum.
- The phrase is “almost entirely agentic,” not “fully automated.”
- Trust, interaction and customer-selected approval points remain human responsibilities.
- Partner observation and intervention capabilities were reported as forthcoming.
Still unknown
- The analysis sample, timeframe and definition of a “role.”
- The task breakdown behind the estimate and the assumptions about data, tooling or staffing.
- How performance, liability and escalation would be measured.
- Whether the estimate applies to a particular customer’s SOC, industry or regulatory environment.
Because those details are not published, the number should not be used as a forecast of staffing reductions or as an industry-wide benchmark. Each organization would need to map its own workflows, approval requirements, telemetry quality and risk tolerance before deciding what to delegate.
Rank #4
What SOC leaders should ask before adopting an agentic model
- Define the unit of work. Separate roles from individual tasks; a role may contain both automatable and judgment-heavy duties.
- Set approval gates. Document which actions agents may execute, which require confirmation and which are prohibited.
- Demand traceability. Require records of the evidence considered, actions taken and reasons for each decision.
- Test intervention. Establish who can pause or override an agent and how quickly that handoff occurs.
- Measure outcomes. Track detection quality, response time, false positives, escalation load and incidents caused by automation.
- Assign accountability. Put contractual and operational responsibility with the party providing the human escalation layer.
The Bottom Line
The 75% figure is best read as Arctic Wolf’s strategic estimate of how far minimum SOC operations might become agent-led—not as proof that 75% of security jobs can be eliminated. The decisive questions are which tasks a customer will delegate, what evidence agents expose, and where a human can approve or intervene.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
