Venture investors have put more than $1 billion into AI SOC startups since 2023. Much of that money rides on one bet: that software agents can do the work of security analysts. A few vendors now describe the analyst as optional. For a mid-market buyer, the useful question is where the human sits, and what that person is accountable for.
Does an AI SOC still need human analysts?
Yes, for the decisions that matter. AI agents can now triage alerts, correlate telemetry and draft incident reports faster than any analyst. What they cannot do is answer for an irreversible action in your environment. The real choice is how the human is positioned: in the loop, over the loop, or out of it entirely.
Why has so much venture money flowed into SOC automation?
By our count of publicly announced rounds, 16 pure-play AI SOC companies have raised about $1.05 billion since January 2023. More than 80% of it arrived after January 2025, and three companies took roughly 59%. The thesis behind most of it is labor replacement: fewer analysts per customer, or none.
The logic is easy to follow. Analyst labor is the largest cost in any managed detection and response service, alert volume keeps climbing, and large language models made it practical for software to reason over an alert instead of just matching it. Our count includes only disclosed startup rounds, so the real total is higher.
Startups are only half the story. Large security platform providers are spending at least as heavily, through internal R&D and acquisitions. In 2025 alone, two deals totaled close to $1 billion: one for an MDR provider and one for a SOC data pipeline company. Every major endpoint and cloud security vendor now sells an agentic SOC story. The money is coming from every direction, and it is all aimed at the same cost line: the analyst.
What are the three ways to combine humans and AI agents?
Human in the loop, where an analyst approves each output before it leaves. Human over the loop, where an analyst directs a team of agents and steps in on exceptions. And no human at all, where agents learn and organize themselves. Each model trades speed, cost and accountability differently.
Human in the loop: the soloist
Think of Itzhak Perlman, one of the great violin soloists. Every note is his, and the quality shows. In a SOC, this is the analyst who reviews and signs off on every finding and every action.
- Strength: accuracy and clear accountability for each decision.
- Weakness: throughput is capped by analyst hours. This is the bottleneck the venture money is trying to remove.
Human over the loop: the conductor
Leonard Bernstein was a gifted pianist, but his lasting impact came from the podium. A conductor plays no notes. He sets the tempo, hears when a section drifts, and decides what the performance means. In a SOC, the analyst directs a swarm of agents: setting what is authorized, setting confidence thresholds, reviewing exceptions and tuning detections.
- Strength: it scales with volume and keeps a named human accountable.
- Weakness: it is only as good as the guardrails and the conductor's knowledge of the score, which in a SOC means your environment.
Some in the industry call a version of this human on the loop. We use "over" deliberately. The position is one of authority. The analyst directs the agents rather than watching them from the side.
No human: the self-playing orchestra
Agents learn from outcomes, coordinate with each other and act without a person in the decision path.
- Strength: the lowest marginal cost and the fastest response.
- Weakness (today): no one owns the outcome, errors pass from agent to agent, and no agent knows your business the way a person assigned to it does.
What does aviation tell us about taking the human out?
Aviation shows that full autonomy is a destination, not a fantasy, and that the road to it is long. In the 1950s a commercial cockpit held five crew: two pilots, a flight engineer, a navigator and a radio operator. Automation removed three of those seats. The last two remain, for now.
The European Union Aviation Safety Agency has published a timeline for the rest. It is aiming for human-AI teaming in the cockpit around 2035, and it does not expect fully autonomous systems in commercial aviation until after 2050. The industry with the strongest safety culture in the world expects to get there. It plans to get there one level at a time.
The SOC will follow a similar path. A fully autonomous SOC is not a never. In our view, it needs a few more step changes in AI, of the kind people mean by artificial general intelligence, before agents can be trusted to own consequential decisions alone. Even then, adoption will trail the technology. Large enterprises with dedicated security teams will move first. The mid-market, where one wrong automated action can stop the business, will follow later.
I first used this comparison in a 2024 conference talk, alongside a slide titled "Orchestrated agents with a SOC Conductor." Few people in the room had heard the word agentic. The model has held up. Each stage of detection work, from finding a signal to reporting it and acting on it, can be handed to an agent. The orchestration still needs a conductor.
What goes wrong when no one is accountable?
Three things. Errors compound, because one agent's wrong conclusion becomes the next agent's input. Context goes missing, because an agent doesn't know which server runs payroll or which executive is traveling this week. And when an automated action isolates the wrong system, no one owns the call.
A large enterprise can absorb a bad automated action. A 300-person manufacturer with one IT generalist often cannot. Containing the wrong production server on a Tuesday morning is an outage, and the cost lands on the customer, not the vendor.
Where does Quorum AI fit?
Quorum AI (QAI) is built on the conductor model. Rule-based detection, machine learning and agentic LLM workflows handle detection, correlation and drafting. Cyber Analysts set the score: what is authorized, which thresholds apply, and what each finding means for your business. Pre-approved actions are automated; the rest are analyst-driven.
Here is where we stand today. AI drafts a high share of QAI SitReps, and a Cyber Analyst still reviews each one before it reaches the customer. That is human in the loop. We are moving over the loop. As confidence scoring proves out, high-confidence SitReps will go to customers directly, and lower-confidence findings will still be held for analyst review.
The conductor matters more than the instruments. Our analysts know each customer's IT stack, staff, policies and risk tolerance. That knowledge is what lets agents act quickly without acting blindly, and it is the part of the work larger providers rarely invest in.
What should you ask an AI SOC vendor?
Ask where the human sits and what that person is accountable for. These five questions separate a working conductor model from a marketing claim.
- Which response actions run without human approval, and who decided that list?
- Who approves an action that cannot be easily reversed?
- How is every automated action logged, and can you audit it?
- What happens when an agent is wrong, and who absorbs the cost?
- Who on the vendor's team knows your environment by name?
Frequently asked questions
What is the difference between human in the loop and human over the loop?
In the loop, an analyst approves each output or action before it happens. Over the loop, AI agents act within limits the analyst has set, and the analyst directs the work, reviews exceptions and owns the decisions that carry real consequence.
Is a fully autonomous SOC available today?
Not in a form we would recommend to a mid-market organization. Some vendors market one. Ask what happens when the agent is wrong and who is accountable. If the answer is your own team, the human has been moved to your side of the contract, not removed. Full autonomy is likely coming, but on a longer timeline than the funding suggests.
Can Quorum AI take response actions without analyst approval?
Only actions the customer has pre-approved, within the authorization scope set for each action type. Those can run through integrated platforms such as CrowdStrike, SentinelOne, Microsoft Defender, Entra ID and Active Directory. Everything else is analyst-driven.
How much venture capital has gone into AI SOC startups?
By our count of publicly announced rounds, about $1.05 billion across 16 pure-play AI SOC companies since January 2023, with more than 80% of it raised after January 2025. Undisclosed rounds are not included, so the true figure is higher.
Before you buy any AI SOC, find out who is conducting.