iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Arctic Wolf CEO Nick Schneider told CRN that the company’s analysis indicates about 75% of the roles needed to run a security operations center (SOC) at a bare minimum could eventually become “almost entirely agentic.” The figure is a vendor-attributed estimate, not an independently validated industry statistic, and it does not mean that 75% of cybersecurity jobs are already automated.
What Schneider’s 75% estimate actually describes
Schneider made the comments in questions from CRN at the 2026 XChange Best of Breed Conference in Atlanta. His wording was specific: the estimate concerns the roles required to operate a SOC “at bare minimum,” not every role in cybersecurity and not the total workforce across security organizations.
He also said those roles could become “almost entirely agentic.” That describes a possible future operating model in which software agents perform most of the work, rather than claiming that those functions are fully automated today.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11CRN did not publish the analysis methodology. The report does not identify how Arctic Wolf defined a “role,” which tasks were included, what assumptions were used, the time period analyzed, or whether the result was independently tested. The 75% figure therefore should be treated as Schneider’s description of Arctic Wolf’s internal analysis.
#1 Best Overall
Where Schneider expects people to remain involved
Schneider said the work left to humans would center on “some level of trust and interaction.” In practice, that means organizations could decide how much authority agents receive and when a person must review, approve or take over an action.
Customer-defined approval thresholds
Schneider described a model in which a customer can specify where human involvement is required. A highly risk-sensitive organization might require approval before an agent changes a control, isolates a system or communicates with a stakeholder. Another customer could permit more autonomous handling of routine investigations and responses.
Arctic Wolf or a partner as the human operator
He said the human role could be supplied by Arctic Wolf or by a solution-provider partner. That distinction matters for managed service providers: an agentic SOC service could automate investigation and response while routing selected decisions to the partner that already manages the customer relationship.
Free tools Windows power users keep installed
One-click scans. No signup required.
Planned visibility and intervention controls
CRN reported that Arctic Wolf expected to offer capabilities in the coming months that would let partners observe what agents did and why. The planned controls would also allow a partner to step into selected processes when human judgment was needed.
Those capabilities were described as forthcoming in the October 12, 2026 report. The report does not establish that the controls had already been released, so availability, supported workflows and any regional or subscription limits should be confirmed with Arctic Wolf before a purchasing or service-delivery decision.
How an agentic SOC would change operating decisions
The proposed model shifts the central question from “Which security tools should we buy?” to “Which outcomes can agents deliver, and where must people remain accountable?” Schneider has separately described customer burdens that include building integrations, writing detections, tuning models, assembling agent frameworks and maintaining 24-hour coverage. An agent-led service aims to absorb more of that operational work.
Task delegation
Organizations would first determine which SOC activities are suitable for autonomous execution. Repetitive alert triage, enrichment and routine investigation are natural candidates for delegation, while actions with legal, safety or major business consequences may require approval.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Trust and auditability
Autonomy is only useful if security teams can understand what an agent did, what evidence it used and why it selected an action. Visibility into agent activity and reasoning is therefore a key buying and governance criterion, not a cosmetic feature.
Human handoffs
A workable service needs explicit handoff points: the event that triggers escalation, the person or team who receives it, the response time expected and the authority to override the agent. Customers should document those boundaries before expanding autonomous permissions.
Aurora Agentic SOC and the company’s positioning
Arctic Wolf announced Aurora Agentic SOC on March 23, 2026, presenting it as an AI-centered security operations offering built on the Aurora Superintelligence Platform. The launch described the service in promotional terms, including claims about scale and a new model for agent-led operations. Those statements establish how Arctic Wolf positions the product; they do not independently prove performance, return on investment or superiority over other SOC models.
Schneider’s company-authored writing frames the broader change as buying security outcomes instead of assembling and managing a collection of tools. That approach could appeal to organizations that lack the staff or engineering time to maintain integrations, detections, model tuning and continuous coverage internally.
What the estimate means for security leaders and partners
- Do not use 75% as a staffing forecast. Without task definitions, assumptions and validation, the number cannot predict how many employees a particular SOC could eliminate or redeploy.
- Map tasks before assigning autonomy. Separate repetitive, reversible actions from decisions that affect production systems, regulated data or customer communications.
- Set the trust boundary explicitly. Define which actions agents may take alone, which require approval and which are always prohibited.
- Demand operational evidence. Ask how agent actions are logged, explained, reviewed and reversed, and how incidents are escalated to Arctic Wolf staff or a partner.
- Partners should verify availability. CRN reported planned visibility and intervention features, but it did not establish current release status or channel-program terms.
Why data and context may become a differentiator
Manak Ahluwalia, CEO of Arctic Wolf partner Aqueduct Technologies, told CRN that the decisive advantage could be the context and data supplied to an agent. His point is that an agent’s output depends on the quality, breadth and operational relevance of the information it can use. That is a partner viewpoint, not independent validation of the 75% estimate, but it highlights a practical evaluation issue: organizations should examine what telemetry, identity data, asset context and historical incident information an agent can access.
What is established—and what remains unknown
It is established that Schneider attributes the 75% estimate to Arctic Wolf analysis, that he expects humans to remain involved in trust and interaction, and that customer and partner tolerance for automation will differ. It is not established how the estimate was calculated, whether it applies beyond Arctic Wolf’s operating assumptions, or when every planned partner control will be available. The claim should therefore be read as a view of where SOC operations may be headed, not as a settled benchmark for the security industry.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
