Levels of autonomy for the SOC
Jan 14th, 2026 by Jesper Kråkhede
We talk about self driving cars in levels. Level 0 is a human doing everything, level 5 is a car without a steering wheel. I think it is time we did the same for the SOC, because every vendor now claims to have an ‘autonomous SOC’ and the word has stopped meaning anything.
Here is my scale.
Level 0, manual. Analysts look at every alert, look things up by hand and take every action themselves.
Level 1, assisted. Enrichment and context are automated. The analyst still decides and acts, but starts with the facts in front of them.
Level 2, partial automation. Routine actions run on their own: isolating a normal workstation, revoking sessions after a risky sign in, removing a phishing mail from all mailboxes. Humans handle the rest.
Level 3, conditional autonomy. AI agents triage, investigate and propose actions for most incidents. Humans approve the high impact ones and handle the hard cases.
Level 4, high autonomy. Agents investigate and act end to end within defined guardrails. Humans set the goals, review the outcomes and take over when the agent asks.
Level 5, full autonomy. No human needed. I don´t believe in it, at least not for anything that matters, and you should be suspicious of anyone who sells it.
Most organisations I meet are at level 1, some at level 2. The tools for level 3 arrived last year. The question for 2026 isn´t whether you will move up. It is how fast, and with what guardrails.
Know which level you are at before someone sells you the next one.