Autonomous Security: How Agentic AI Is Replacing Alert-First Architectures

The physical security industry has spent fifteen years building alert-first architectures: cameras feed a VMS, analytics generate events, events surface as alerts, and humans triage. That stack made sense when the bottleneck was detection. It no longer makes sense when the bottleneck is response. Alert generation has become nearly frictionless — modern computer vision produces thousands of high-confidence events per day in a mid-sized deployment — while response capacity has not scaled. The gap between what a detection system produces and what a security operator can action has become the single largest failure mode in physical security and the blast radius extends into cyber operations as well.

This report analyzes what happens when AI systems move from generating alerts to orchestrating response — what the research community calls agentic AI. It covers the primary-research evidence on why alert-first broke, what agentic architectures actually do differently, the NIST regulatory framework now taking shape around them, and the operational and economic consequences for security operations centers, risk managers, and vendor buyers. The report closes with a buying-calculus framework and an examination of where IntelliSee specifically fits into the autonomous layer.

Why the alert-first architecture broke

Alert-first design assumed a scarce signal and abundant human attention. Both assumptions have inverted. The SANS 2025 SOC Survey documents that 66% of surveyed SOCs report alert volume has exceeded their ability to keep pace, with a median team fielding 960 alerts per day and large-enterprise teams fielding 3,000 or more. The same survey finds that 70% of analysts with less than five years of tenure leave within three years, with alert fatigue and low-impact toil cited as primary drivers. The economic consequence is quantified in IBM’s 2024 Cost of a Data Breach Report, which found the average cost of a breach at $4.45 million and mean time to containment at 277 days — a figure that has been essentially flat since 2020 despite continued growth in detection tooling spend.

The reason containment times have not fallen is that detection is no longer the bottleneck. Verizon’s 2025 Data Breach Investigations Report found that 96% of breaches are disclosed to the victim by the attacker, a law-enforcement agency, or a third party — not by internal detection. The Unit 42 2025 Incident Response Report found that in 25% of incidents, the attacker completed exfiltration within five hours of initial access. Sophos’ Active Adversary Report, H1 2025 measured median dwell time at eight days. When attackers operate in hours and defenders operate in weeks, producing more alerts does not narrow the gap. Producing more actions does.

The same structural problem is visible in the physical security domain. Academic research published through the International Association of Chiefs of Police and reported in peer-reviewed work on alarm verification finds that 94–98% of police alarm responses resolve as false — a cost burden estimated at $1.8 billion per year in the United States alone. The industry response, the Monitoring Association’s AVS-01 Alarm Verification standard, formalized the principle that alarms without corroborating evidence should not dispatch armed response. That standard is effectively a recognition that alert-first was economically unsustainable at scale. In workplace-violence contexts, the FBI’s 2024 Active Shooter Report documented 24 qualifying incidents across 19 states — events in which the median time from first shot to first law-enforcement contact determined the casualty count. In those windows, an alert without orchestration contributes nothing.

What “agentic” actually means

Agentic AI is a term with a narrow technical definition and a broad marketing usage. The narrow definition is the one that matters for security operations. Per the NIST AI Agent Standards Initiative, established in February 2026, an agentic system is one that can decompose a goal, plan a sequence of actions, execute those actions against tools and APIs, observe the results, and revise its plan — without requiring a human to authorize each step. The distinction from traditional automation is that the action sequence is not pre-scripted. The distinction from a chatbot is that the system has tool access and the authority to execute.

Applied to security, the agentic pattern replaces the alert-then-human-response loop with a detect-decide-orchestrate-verify-log loop that completes in seconds. The human remains in the loop — but at the escalation and governance layer, not in every individual triage decision. This is the same shift the commercial aviation industry made from pilot-as-continuous-controller to pilot-as-exception-handler via autopilot and flight management systems. The analogy is imperfect (aviation operates in a far more constrained state space) but the structural change is the same: humans supervise an autonomous layer rather than operate the primary control loop.

The practical implication is that the product a buyer is evaluating is no longer a detection system with an alerting layer bolted on. It is an orchestration system with detection as one of many inputs. Evaluating it as if it were the former understates the blast radius of both its successes and its failures.

LIVE feed

CAM-04 INTERIOR

The five-stage autonomous loop

Autonomous security operations replace the alert-triage-response chain with a closed loop whose individual steps each complete in seconds rather than minutes. The practical value is that human attention is spent on governance and exceptions rather than on the majority path. The diagram below shows the five stages of that loop in the order they execute.

What agentic replaces on the SOC staffing model

The most honest way to evaluate an agentic architecture is to look at what it lets you stop doing. In a conventional alert-first SOC, the tier-one analyst’s job is triage: sorting alerts by credibility, clearing false positives, and escalating a small fraction to tier two. The SANS 2025 SOC Survey found that tier-one analysts spend 62% of their time on alerts that are ultimately closed as false-positive, benign, or duplicate. That is not a training problem or a motivation problem. It is a workload problem imposed by the architecture.

Agentic orchestration absorbs the majority-path triage work. The system classifies, correlates, and takes first-level action on the events that would previously have filled the tier-one queue. The work that remains for humans is the work that was always underpriced in an alert-first model: investigating novel patterns, tuning the orchestration policy, reviewing the agent’s action log for drift, and handling cases that the system deliberately kicks up for human decision. This is higher-value work and it is the work junior analysts actually trained for — which is why organizations that have deployed mature orchestration report both reduced staffing needs at tier one and improved retention at tier two and above.

The quantitative framing is straightforward: if an alert-first SOC requires N analysts to keep up with M daily alerts, and agentic orchestration absorbs 70–85% of the majority path (a range consistent with both Omdia’s 2025 autonomous-SOC forecasts and peer-reviewed research published in MDPI’s Electronics journal on hyper-automation with agentic LLMs mapped to MITRE ATT&CK and NIST CSF), then the staffing requirement collapses to approximately 0.2–0.35N — not because people were eliminated, but because the people are now doing the work that actually needed to be done.

The market shift: SOAR retirement and the autonomous-SOC category

Both Gartner and Forrester retired their standalone SOAR Magic Quadrant and Wave evaluations in 2025, rolling the capability into broader SecOps platform coverage. Omdia’s 2025 market analysis forecasts that autonomous-SOC capability will be a baseline expectation for enterprise buyers within 12–24 months. The procurement implication is concrete: RFPs that still ask vendors to list “SOAR playbooks” are asking the wrong question. The relevant questions are ones about the agent’s planning scope, the granularity of human-in-the-loop controls, the completeness of the audit trail, and the vendor’s documented alignment with the forthcoming NIST COSAiS SP 800-53 overlays.

The regulatory baseline taking shape around agents

NIST’s Cybersecurity Framework 2.0, released in full form in December 2025, includes a Govern function that sits alongside the traditional Identify, Protect, Detect, Respond, and Recover. The Govern function is the one most directly relevant to agentic systems because it covers the policy, oversight, and supply-chain expectations for AI-enabled security controls. The forthcoming COSAiS (Cybersecurity, Operational Security, and AI Security) SP 800-53 overlays will provide the control-by-control mapping that federal buyers and federal contractors will be expected to demonstrate. The NIST AI Agent Standards Initiative, stood up in February 2026, sits upstream of that work, focused on agent identity, action authorization, and auditability primitives.

The practical consequence for security buyers is that the regulatory direction of travel is clear even where the final text is not. Agent identity must be distinct from user identity. Agent actions must be logged in a form that supports non-repudiation. Humans must have a documented role in scope change. These requirements are converging across NIST, the EU AI Act implementation guidance, and DHS SAFETY Act evaluation criteria for qualifying anti-terrorism technologies — which means a vendor that is architecturally opaque on any of them is exposed to near-term procurement friction, not merely theoretical risk.

Where agentic does not replace humans — and where buyers get this wrong

The most common procurement failure mode is treating agentic as a labor-substitution story. It is not, and vendors that pitch it as one are misreading both the research and the market. Three categories of work remain emphatically human and the system design should reinforce that, not blur it.

Buyers who collapse these three responsibilities into “the agent will handle it” create unprotected tail risk. Buyers who staff them explicitly get the labor-model advantages of autonomy without the governance exposure. The vendor’s job is to make the three roles crisp and tool-supported — which is another concrete RFP question: does the platform expose a supervisor console that surfaces exceptions, scope changes, and drift separately, or does it collapse them into a single dashboard that obscures which one is failing?

How IntelliSee fits into the autonomous layer

IntelliSee’s platform sits at the detection-plus-orchestration tier of the stack described above, with specific coverage of the physical-security and workplace-safety failure modes that legacy alert-first systems handle poorly. The computer-vision layer runs on existing camera infrastructure — no rip-and-replace is required — and produces real-time detection for active-shooter and gun, perimeter intrusion and trespass, and fall scenarios. The orchestration layer composes those detections with site context (occupancy, shift, location, scheduled events) and executes the response playbook end-to-end: page, lockdown signaling, radio-channel handoff, camera slewing, and dispatch verification. The audit layer writes every observation, decision, action, and outcome to a tamper-evident log consistent with the NIST governance expectations described above.

Three architectural choices distinguish the platform from adjacent vendors. First, no facial recognition and no video storage off-device — the system detects objects and behaviors, not identities, and retains only the metadata needed for audit. Second, no PHI or protected-data collection, which matters in healthcare and education deployments where every inbound integration is a HIPAA or FERPA decision. Third, DHS SAFETY Act QATT designation, which (as noted in the brief above) provides a federal liability framework that alert-first competitors do not have. These are not feature bullets. They are the reason the platform is deployable in sector contexts — hospitals, schools, manufacturing — where an alert-first vendor’s data model would create new risk even as it reduced other risk.

The buying calculus: five questions to ask a vendor

A procurement team evaluating an autonomous-security platform should ground the conversation in five questions whose answers are determinative. None of them are about feature lists.

1. What is the agent authorized to do without human approval, and how is that scope bounded in the product? If the vendor answers in generalities, the scope is not enforced in code and the governance risk is on you. A good answer names specific action classes and references the supervisor console where scope is configured.

2. What happens when the agent’s confidence falls below threshold? The right answer is “it escalates to a named human role with the relevant context attached.” A wrong answer is “it retries” or “it uses a backup model.” Retry without escalation is how autonomous systems drift.

3. Show me the audit log for a real incident. The format matters. A log that records actions but not the reasoning behind them — observations, decisions, rationale — does not meet the NIST governance expectations and will not survive a post-incident review.

4. What is your alignment plan for NIST COSAiS SP 800-53 overlays as they are finalized? A vendor that cannot articulate the roadmap here has not read the trajectory. A vendor that can is signaling that procurement-friction risk is being managed.

5. What is your federal liability posture? SAFETY Act QATT or Developmental Test & Evaluation (DT&E) designation changes the risk math for any deployment of consequence. Absence of either is not disqualifying but is a data point that should be weighted in total-cost-of-deployment modeling.

Frequently asked questions

For organizations evaluating whether their current architecture can scale to the agentic threat surface — or what a responsible migration path looks like — a structured conversation with the IntelliSee analysis team is the fastest way to convert the buying-calculus questions above into a documented procurement framework. Request a risk assessment to start that conversation.