Who Do We Fire When the AI Gets It Wrong? | Foresite

Every vendor now sells an autonomous SOC. Jeremy Hehl, Chief Cybersecurity Evangelist at Foresite, asks every customer who wants one the same question: who do we fire when something goes wrong?

Jeremy sat down with Jay Bavisi, President of EC-Council, at Black Hat USA 2026 for The Cybersecurity Podcast by EC-Council. Over 39 minutes they get into where agents help in the SOC, where they fall short, and why governance is now the hard part.

Watch the full episode on YouTube

Agents compute. Humans decide the risk.

Jeremy splits SOC work into two kinds. Investigation, triage, enrichment and correlation can run on agents today. A risk determination still needs someone who answers for it.

"The question I always ask customers who come to us and say that they want a fully autonomous SOC is who do we fire when something goes wrong? Do we just dismiss the agent?"

That is the design behind Foresite's practice. Autonomous investigation runs at machine speed, and a named practitioner validates every high-impact action before it executes.

The drudge goes. The analysts stay.

Jay pushed on the headline fear: L1 roles are disappearing, and L2 is next. Jeremy's answer is that Foresite has grown its team while adding agents to triage, threat hunting and analysis. Each analyst now carries far more volume, because false positives get dismissed fast and the time goes to harder work.

He compares it to Jevons paradox. When machines made textile workers more productive in the late 1700s, demand for output rose with them. Jeremy expects the same in the SOC.

He started his career in a SOC and doesn't romanticize the queue. Triaging the same alerts over and over burns people out. Agents that correlate those alerts into single cases, and flag what sits outside the norm, are where the technology earns its place.

Reliable agents start narrow, on clean data

Ask a frontier model the same question five times and you get five answers. Jay asked how you build a SOC on that.

Jeremy's approach is measured:

1. Start with targeted use cases where agents already beat humans: running queries, working APIs, handling data at machine speed.
2. Get the data clean first. Once logs are flowing and normalization is close to complete, agents go into the automation playbooks.
3. Restrict each agent's identity to a prescriptive task, with written guidelines it works within.

Without clean data, agents hallucinate. In his words, calling an agent today is not much different from calling a piece of code in a playbook: it should do one job and return what you expect.

Governance is the next frontier

Jeremy calls AI governance the next real frontier for managed security providers. ISO 42001 is setting the bar, and public sector adoption of agentic platforms will demand observability into what agents do and how they talk to each other.

The practical shift is treating agents like users. Each one gets an identity, privileged access rules, and an audit trail.

Jay raised the gap most organizations sit in. The largest enterprises have red teams and risk teams. The mid-tier knows AI is more than a chatbot subscription but can't afford tier-one observability tools. Jeremy sees closing that gap as an MSSP's job: delivering the outcome and the governance as a service, so customers don't have to buy and run every tool themselves.

The vertical he sees moving fastest on agentic compliance is healthcare and life sciences, where patient data and research raise the stakes.

The numbers behind the question

Omdia's 2026 market update put a figure on Jeremy's point: 52% of organizations with a SOC deploy agentic AI, and 25% formally assess every agentic investment. Omdia reviewed Foresite's operations on Google SecOps and found mean time to investigate down roughly 60%, with a named practitioner authorizing every high-impact action.

Read the 2026 Omdia Technical Summary →

FAQ

What is an agentic SOC? A security operations center where AI agents handle investigation, triage, enrichment and correlation at machine speed. In Foresite's model, a named practitioner still validates every high-impact action.

Will AI replace SOC analysts? Jeremy's view is that it removes the repetitive queue work and lets each analyst handle far more volume. Foresite has grown its team since adding agents.

Who is accountable when an AI agent takes an action? A named person. Agents can recommend and investigate, and someone with authority signs off on actions that can't be reversed.