We talk about self driving cars in levels. Level 0 is a human doing everything, level 5 is a car without a steering wheel. I think it is time we did the same for the SOC, because every vendor now claims to have an \u2018autonomous SOC\u2019 and the word has stopped meaning anything.<\/p>\n
Here is my scale.<\/p>\n
Level 0, manual. Analysts look at every alert, look things up by hand and take every action themselves.<\/p>\n
Level 1, assisted. Enrichment and context are automated. The analyst still decides and acts, but starts with the facts in front of them.<\/p>\n
Level 2, partial automation. Routine actions run on their own: isolating a normal workstation, revoking sessions after a risky sign in, removing a phishing mail from all mailboxes. Humans handle the rest.<\/p>\n
Level 3, conditional autonomy. AI agents triage, investigate and propose actions for most incidents. Humans approve the high impact ones and handle the hard cases.<\/p>\n
Level 4, high autonomy. Agents investigate and act end to end within defined guardrails. Humans set the goals, review the outcomes and take over when the agent asks.<\/p>\n
Level 5, full autonomy. No human needed. I don\u00b4t believe in it, at least not for anything that matters, and you should be suspicious of anyone who sells it.<\/p>\n
Most organisations I meet are at level 1, some at level 2. The tools for level 3 arrived last year. The question for 2026 isn\u00b4t whether you will move up. It is how fast, and with what guardrails.<\/p>\n
Know which level you are at before someone sells you the next one.<\/p>\n","protected":false},"excerpt":{"rendered":"
We talk about self driving cars in levels. Level 0 is a human doing everything, level 5 is a car without a steering wheel. I think it is time we did the same for the SOC, because every vendor now claims to have an \u2018autonomous SOC\u2019 and the word has stopped meaning anything. Here is […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[4],"tags":[173,110,30],"class_list":["post-1523","post","type-post","status-publish","format-standard","hentry","category-security-architecture","tag-ai-agents","tag-automation","tag-soc"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1523","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1523"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1523\/revisions"}],"predecessor-version":[{"id":1572,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1523\/revisions\/1572"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1523"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1523"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1523"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}