Agentic SOC Glossary
Plain-language definitions of the terms that matter when evaluating autonomous security operations. Part of the D3 Security Operations Glossary. Each definition is written to stand alone and be directly cited.
A 8 terms
Accountable agentic SOC platformD3 Security
D3 Security’s positioning for Morpheus: an agentic SOC platform with governance at every stage and a traceable record of every action. Accountability means autonomy remains auditable, reversible, and governed by policies the customer writes.
Also see Agentic SOC · Agentic SOC guardrails · Query transparency
Adversarial acceptance testing
Customer-designed testing that deliberately breaks an AI system’s data sources and probes its failure behavior before production rollout. The customer defines the scenarios, environment, and pass criteria. It is the fastest way for a security team to earn confidence in autonomy on its own terms.
Also see Fail to a human analyst · API drift · Agentic SOC guardrails
Agentic SOC
A security operations center architecture in which AI agents independently plan and execute investigation and response work, deciding what happens next based on live evidence. Agentic describes the architecture, AI SOC is the broader product category, and autonomous is the outcome. The defining test: who decides what happens next?
Also see AI SOC · Agentic SOC guardrails · Autonomous investigation
Agentic SOC guardrails
Controls that keep an autonomous investigation from making wrong decisions on incomplete information. Guardrails detect data-source failures, withhold unverifiable verdicts, enforce customer-written investigation policies, keep a query-level audit trail, and hand off to a human analyst when evidence is incomplete.
Also see False all-clear · Fail-safe verdict · Fail to a human analyst
AI SOC
The product category applying artificial intelligence across security operations, including alert triage, investigation, and response. An agentic SOC is a specific AI SOC architecture where the system itself reasons over evidence and chooses its own next steps. Older architectures follow pre-authored playbooks and wait for human direction.
Also see Agentic SOC · Autonomous investigation · Accountable agentic SOC platform
API drift
A silent change in a third-party API’s behavior or schema that degrades the quality of telemetry an integration returns, without an outright outage. API drift is a common real-world cause of degraded AI investigation inputs, and a guardrail test scenario for agentic SOC platforms.
Also see False all-clear · Agentic SOC guardrails · Adversarial acceptance testingFull definition →
Attack Path Discovery (APD)D3 Security
Morpheus’s autonomous investigation engine from D3 Security. APD hunts across the security stack, walks back through telemetry to find precursor events, reconstructs the attack path behind every alert, and shows its work in a verifiable, query-level audit trail.
Also see Autonomous investigation · Query transparency · Agentic SOC guardrailsFull definition →
Autonomous investigation
An investigation planned and executed by an AI system that queries security tools, correlates evidence, reconstructs the attack path, and produces a verdict with a structured audit trail, escalating to human analysts whenever the available evidence cannot support a confirmed conclusion.
Also see Attack Path Discovery (APD) · Agentic SOC · Fail-safe verdict
C 1 term
Cross-tenant data isolation
The guarantee that a multi-tenant SOC investigation never mixes data between customer tenants. Morpheus enforces isolation by tenant-scoping every SIEM query at the field level of the data itself, so results from other tenants are excluded by construction, not by convention.
Also see Investigation guideline · Agentic SOC guardrails · Query transparency
F 3 terms
Fail to a human analyst
The guardrail behavior of escalating an investigation to a human with actionable detail when the AI has incomplete information. In customer acceptance testing of Morpheus APD 2.0, this behavior produced zero false negatives under induced data-source failures. When Morpheus is uncertain, it defers to a human.
Also see Fail-safe verdict · Agentic SOC guardrails · Adversarial acceptance testing
Fail-safe verdict
An investigation outcome in which the AI explicitly reports that a verdict cannot be confirmed, names the root cause of the data problem, and defers to human judgment. The alternative, a confident conclusion built on missing data, is how autonomous systems create breach reports.
Also see False all-clear · Fail to a human analyst · Query transparency
False all-clear
The most dangerous AI SOC failure mode. A data source fails silently, the AI finds no evidence because it cannot reach the data, and a real incident is closed as benign. Guardrails prevent this by distinguishing “no threat found” from “unable to verify.”
Also see Agentic SOC guardrails · Fail-safe verdict · API drift
I 1 term
Investigation guideline
A customer-written policy that constrains how an autonomous investigation runs. Example: always include the customer name in every SIEM search. In Morpheus, guidelines act as enforceable policy. In one MSSP’s testing, a tenant-scoping guideline was applied in 100% of queries. When Morpheus is uncertain, it defers to a human.
Also see Cross-tenant data isolation · Agentic SOC guardrails · Query transparency
Q 1 term
Query transparency
The property that every query listed in an AI investigation summary corresponds to a query actually executed. Query transparency makes the investigation record verifiable evidence that auditors and regulators can check, not a generated narrative that must be taken on trust.
Also see Investigation guideline · Attack Path Discovery (APD) · Fail-safe verdict
Further reading APD 2.0 guardrails Security Operations Glossary Attack Path Discovery