{
  "id": 14912407,
  "title": "Autonomous security: Is agentic AI next step for MDR?",
  "url": "https://urgent.news/2026/10/16/autonomous-security-is-agentic-ai-next-step-for-mdr",
  "topic": "ai",
  "section": "AI",
  "published": "2026-10-16T07:38:21.000Z",
  "source": {
    "name": "ITWeb",
    "slug": "itweb",
    "url": "https://www.itweb.co.za/article/autonomous-security-is-agentic-ai-next-step-for-mdr/nWJadvbNR1pvbjO1"
  },
  "original_language": "en",
  "account": "Artificial intelligence (AI) is revolutionizing managed detection and response (MDR) technologies, allowing security teams to quickly analyze massive amounts of data and react to threats more efficiently than traditional methods. As cyber attacks grow in complexity and frequency, organizations need to monitor various elements like remote users, endpoints, identities, applications, and networks simultaneously. A new form of AI, known as agentic AI, is emerging to address these challenges.\n\nConventional AI primarily focuses on analyzing data, recognizing patterns, and generating insights based on human prompts or predefined processes. Generative AI, on the other hand, can create text, code, and other content in response to instructions. Agentic AI takes things a step further by being designed to achieve specific goals. It can analyze information, make decisions, plan sequences of actions, and interact with other systems with varying degrees of autonomy.\n\nIn an MDR environment, agentic AI agents could potentially investigate suspicious activity as it occurs, gather information from various security platforms, evaluate threat intelligence, and determine whether seemingly isolated events are part of a larger attack. It could then recommend or, within set boundaries, initiate an appropriate response, operating at machine speed across complex technology environments.\n\nTraditional security operations often generate thousands of alerts each day, many of which are false positives. Analysts must manually collect information from multiple tools to determine whether an incident is genuine, a time-consuming process that places immense pressure on already stretched cyber security teams. Agentic AI could significantly change this scenario by investigating alerts, examining identities, devices, and applications, reviewing past activity, correlating events across the network, and comparing findings with external threat intelligence. This could reduce the time between threat identification and response while allowing MDR providers and internal security teams to focus on complex investigations, strategic decision-making, and incidents requiring business context and professional judgment.\n\nAs cybercriminals increasingly exploit AI, the traditional advantage of human defenders responding to machine-generated threats may diminish. The future cyber security landscape may well become a contest between human and machine speed. However, this greater autonomy also raises critical questions concerning trust in AI's security decisions, potential unintended consequences, and responsibility allocation.\n\nHuman oversight remains crucial in security decisions that could impact critical infrastructure, customers, business continuity, or organizational reputation. While AI can process vast amounts of information and execute predefined actions rapidly, it lacks the business understanding, contextual awareness, and judgment of experienced security professionals. Therefore, the concept of the human in the loop is essential to strike a balance between automation and manual security. In a partnership between humans and AI, technology can understand the threat, while humans provide the necessary business understanding, contextual awareness, and judgment.",
  "summary": "Effective managed detection and response environments require boundaries between actions AI can perform and those requiring human authorisation.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}