Security operations are moving past the single copilot that summarizes an alert. The emerging design is a team of specialized agents investigating endpoint, identity, cloud, SaaS and network activity in parallel, sharing context and proposing a coordinated response. That can shorten investigations. It can also create a dangerous illusion: if several agents reach the same conclusion, the resulting action must be safe.
Consensus is evidence, not permission.
At Fal.Con on September 2, CrowdStrike introduced coordinated multi-agent investigations. According to the company, Charlotte AI can dispatch domain agents across multiple telemetry sources, use a shared context layer and converge on a common hypothesis with staged response actions. Customers can assign levels of autonomy, from workflows that keep a human in the loop to ones that execute fully on their own.
For MSSPs, that product direction raises a more consequential question than how many agents participate: who has authority to isolate a system, disable an identity or change a customer’s environment?
Consensus is not authorization
Multiple agents may agree because they observed independent evidence. They may also agree because they share the same incomplete data, poisoned context or faulty assumption. A common memory layer improves coordination, but it can propagate an error across the investigation as efficiently as it propagates a useful finding.
That’s why an agent vote can’t substitute for an authorization policy. The system can estimate confidence that an account is compromised. It can’t decide how much operational disruption a hospital, manufacturer or retailer is willing to accept without a rule the customer supplies.
Consider a compromised-looking service account. Disabling it might stop lateral movement, but it could also halt a production line or interrupt a revenue system. The correct response depends on asset criticality, time of day, available alternatives and the customer’s tolerance for business interruption – and none of those facts is guaranteed to appear in security telemetry.
The same caution applies to the model-training story. NVIDIA says its SafeMind collaboration with CrowdStrike pits offensive and defensive models against each other in a continuous coevolution loop, and it reports that Blue Solano, a defensive model built on NVIDIA Nemotron and trained through that loop, delivered higher accuracy than leading frontier models at 99% lower cost in internal testing. That’s an interesting architecture and a vendor claim worth testing. It is not evidence that an autonomous response will be correct in every customer environment.
The gap between “accurate” and “authorized” shows up in the broader research, too. A 2026 SANS survey of security practitioners found that AI use in cybersecurity strategies jumped to 78% this year, yet 63% of respondents said AI still shows significant shortcomings in threat detection and response, and just 36% have a formal AI risk-management program. Adoption is outrunning the governance meant to keep it accountable, and agentic SOC platforms are the sharpest edge of that gap because they don’t just flag risk, they act on it.
Autonomy must follow customer risk
MSSPs need a response-authority matrix before enabling agentic execution. A practical RACE framework covers four dimensions: Risk, Authority, Confidence and Evidence. Risk classifies the potential business impact of both the suspected threat and the proposed response. Authority identifies the customer or provider role permitted to approve the action. Confidence defines the evidence threshold. Evidence specifies what the system must record before and after execution.
Low-impact, reversible actions can carry standing authorization: enriching an alert, collecting a volatile artifact or blocking a newly registered malicious domain may fit that category. Higher-impact actions need progressively stronger controls. Disabling an executive account, quarantining a server or revoking a production certificate may require two-person approval or a named customer decision-maker.
Every authorized action should also have an expiration and a rollback path. A temporary containment policy that automatically expires after 30 minutes is safer than an indefinite change. The system should verify whether rollback actually restored service, not merely report that it sent the command.
Customer segmentation belongs in the policy. An action approved for a professional-services firm may be unacceptable in an emergency department or a continuous-production facility. The MSSP should maintain customer-specific critical-asset lists, blackout periods and escalation contacts, then test whether agents can actually retrieve that context when it matters. If the context is stale or unavailable, the system should fall back to a safer authority level instead of improvising.
Test that fallback deliberately, not by hoping it holds. Before you turn on autonomous execution for a customer, run one negative scenario where the “correct” action is to do nothing – a benign anomaly that looks like compromise – and confirm the system holds rather than acts. An agent that only proves itself on cases where action is warranted hasn’t proven the part that matters most.
MSSP contracts and runbooks must match the technical configuration. If the platform is authorized to act but the services agreement only promises recommendations, liability becomes ambiguous. Conversely, an agreement may authorize containment while the platform remains configured to wait for an analyst, a gap that creates delay exactly when speed matters. Put the two documents side by side at renewal, line by line, and fix whichever one is behind.
Measure the action layer
Agentic-SOC evaluation should move beyond detection rates and time to verdict. MSPs need operating metrics that expose the consequences of execution: percentage of cases completed without intervention, analyst override rate, false-remediation rate, mean time to rollback, percentage of actions lacking required evidence and business-impact minutes caused by defensive changes.
Report these by customer and action class. A strong average can hide a weak result in the small set of high-consequence actions. Providers should also test failure modes through tabletop exercises: unavailable approver, conflicting agent conclusions, stale asset criticality, incomplete logs and an attempted rollback that fails.
The opportunity is real. Coordinated agents can remove repetitive work and give analysts a more complete picture sooner. But the MSP’s differentiator won’t be access to the most agents. It will be the discipline to turn machine conclusions into authorized, reversible and provable action.
