Agentic AI now resolves 60 per cent of security investigations at Arctic Wolf, according to the cybersecurity and AI company’s 2026 Agentic Security Operations Report, even as alert volume fell and investigation volume grew over the past year.
Key Takeaways
- Agentic AI now resolves 60% of security investigations at Arctic Wolf, up from near zero a year ago.
- Alert volume fell roughly 19% while monthly investigation volume grew 21% over the same period.
- In APAC, 42% of all alerts arrive after local business hours have ended, reinforcing the case for continuous AI-led investigation.
From human-led to AI-led investigations in a year
Drawing on 13 months of operational data from more than 11,000 organisations globally, the report found that human analysts handled 81 per cent of investigations without AI assistance about a year ago. Today, human-only investigations account for just 2 per cent of total caseload, agentic AI resolves 60 per cent autonomously, and AI-human collaboration has expanded from less than 1 per cent to 38 per cent of investigations.
Less noise, not less visibility
The report highlighted a finding that challenges a long-held assumption in cybersecurity: that broader visibility inevitably means more noise for stretched security teams. Alert volume fell roughly 19 per cent while monthly investigation volume grew 21 per cent, and the average time from an alert-generating event to an actionable ticket fell 36 per cent. The Aurora Agentic SOC opens just 13 investigations for every billion observations processed, while the share of high- and critical-severity tickets held steady.
“The reality of today’s threat landscape is that attackers are already operating at machine speed, and organizations can no longer rely on AI-only or human-only security operations to keep pace. Arctic Wolf built a new operating model where AI handles the volume, humans provide oversight, and both work together to deliver better outcomes,” said Mr Dan Schiappa, President of Technology and Services at Arctic Wolf.
What this means for lean security teams in the region
In APAC, Arctic Wolf found that 42 per cent of all alerts arrive once local business hours have already ended, underscoring the importance of continuous, AI-assisted investigation for security teams in Singapore and across the region, where analyst shortages and burnout remain persistent challenges.
