Ask platform teams what changed in their security queue this year and most will give the same answer: software started making decisions. AIOps for Security — the working label for machine-learning and LLM assistance in security operations — crossed from slideware into production during 2026, and triage, the unglamorous act of deciding what deserves human eyes, is where it landed first. This is a status report: what shipped, what independent benchmarks actually recorded, which cautions hardened into policy, and what a disciplined team should require before granting any of it authority.
AIOps for Security is a name still waiting for a standard
No founding document exists. No standards body has published a specification, and no consortium has stamped a version one, so the phrase works as an editorial umbrella over five related practices: spotting anomalies, ranking alerts, drafting investigations with language models, measuring all of it honestly, and deciding how far the software may act on its own. Analyst coverage sharpened the confusion this year rather than clearing it. The 2026 Gartner hype cycle sits the whole AI-SOC-agent category on the Peak of Inflated Expectations, while the analysts’ older term AIOps continues to mean something completely different — machine assistance for IT infrastructure correlation. An estate shopping for one can end up reviewing pitch decks for the other. The distinction is not pedantry: a wrong correlation in IT operations wastes a page, while a miss in security can cost breach-level money, and every measurement rule tightens accordingly.
Where AIOps for Security shipped in 2026
Triage was the beachhead. Microsoft’s phishing triage agent started closing messages from its very first run in a tenant, and its documentation as of October 2026 describes no observe-only mode — which means the observe-first sequence is something a buying team must impose contractually and operationally, because the product will not impose it for them. Google’s triage and investigation agent stayed a rung lower, recommending rather than closing, at a pace of roughly one minute of machine time per item worked; that ratio makes it cheap to shadow and easy to audit, which is exactly why it makes a better first citizen. The third shipped change is less glamorous and arguably bigger: Microsoft is folding Sentinel’s Fusion correlation engine into Defender XDR, with the legacy path ending on 31 March 2027. Every estate that built hunts on Fusion alerts must re-validate its detection logic before that date, and many will use the migration as the natural moment to decide what, if anything, an agent may close.
The independent scorecards so far
Benchmarks built by parties with nothing to sell stayed stubbornly unimpressed. ITBench, a 2025 incident-scenario suite, put the completion figure for its compliance-and-security scenarios at just 25.2%. CyberSOCEval, assembled jointly by Meta and CrowdStrike, scored agents in the low twenties to mid-thirties on malware analysis and in the forties to low fifties on threat-intel work. Both suites publish random-choice baselines under two percent, which is the polite way of saying the models are genuinely doing something while also saying they are nowhere near finished. The gap between those figures and brochure claims is the single most useful fact in this whole report. When a vendor quotes an accuracy number this year, the honest comparison is not against a rival’s number but against what neutral parties recorded on tasks of the same shape — and against your own prevalence, because rarity, not model quality, decides most of what an accuracy figure means in practice.
The cautions that hardened into policy
Three research threads matured from papers into procurement language. First, prompt injection: the UK’s NCSC explained in late 2025 why an LLM agent reading attacker-controllable text behaves as an inherently confusable deputy — blocking known-bad phrases fails, and only deterministic controls plus tightly scoped tool permissions survive contact with a real adversary. Second, evaluation hygiene: detector papers published between 2019 and 2022 carried F1 figures near 0.99 that sagged once spatial and temporal leakage was stripped from the test setup, and a thirty-paper audit found sampling defects in nine of ten studies with test information leaking into training in roughly three-quarters. Third, data defaults: some public malware-scanning services redistribute submitted samples to paying customers, and Microsoft’s Security Copilot shares customer data by default unless the tenant carries certain high-end M365 licences, while Google states its SecOps Gemini integration does not train on customer prompts. Read all three before signing anything. In fact, four questions now belong in every review:
- Which action class ships enabled by default, and does an observe-only mode exist at all?
- What prevalence was the quoted accuracy computed on, and will the vendor re-compute it on our labelled sample?
- Where do submitted samples and prompts travel — which third parties receive them, under which agreement?
- What evidence backs the autonomy tier requested: labelled counts, bound arithmetic, canary results, a rehearsed rollback?
How serious teams are grading autonomy
The practical answer this year is a ladder graded one action class per decision — permission attaches to the class of action, never to the product. Recommendation earns its tier on a labelled history of 200-plus alerts holding at least 30 genuine positives, with humans still owning every final decision. Unaided closure asks for more: demonstrated misses inside 2% across 150-plus genuine positives, canary cases hiding among live alerts, a scored blind holdout completed in advance, and reopening that costs a single click. Reversible enforcement — suspending a session, quarantining a mailbox — requires false actions below 1% across 300-plus action opportunities, a rehearsed rollback and a volume throttle. Irreversible steps stay human at any score, and no benchmark score changes that. The arithmetic behind the gates is the rule of three: flawless runs across n cases cap the hidden failure rate near three divided by n. Once one miss appears, the demonstration of a 2% ceiling grows to 236 samples; once two appear, to 313. The year’s most instructive triage study shows why the gates exist: analysts blind-labelled 1,240 messages, 71 proved genuine, the agent discarded 2 of them. The raw miss rate read 2.8%; the top of its interval touched 8.6%, blowing straight through a 2% requirement — even while closures ran 99.8% precise, verdicts on true positives ran about 86% right, and 93.5% of the queue’s workload proved removable with humans keeping every final call.
The 2027 agenda: from pilots to platform work
Next year’s work looks less like experimentation and more like bookkeeping with teeth. Four fixtures now mark a serious estate. A register: for each action class, the autonomy level in force, the evidence that earned it, signatures and dates, revised whenever the model version changes. A monthly per-category table, published even when boring — one deployment this year carried a tidy 1% blended miss line that hid a 42.3% failure rate in cloud-IAM work behind a calm 9.1% phishing figure, and only the split would have caught it. Canary seeding: fifty fake-but-realistic cases planted per quarter, and a standing rule that three mistaken closures revokes the tier until the numbers recover. And drift checks on inputs and outputs, plus a cost baseline, so the machine must beat measurable human effort rather than an anecdote. Teams already fluent in cutting deployment failures through automation will recognise the pattern at once: shadow first, small blast radius, automatic rollback, evidence at every step.
The March deadline gives every Microsoft estate a natural review moment, and the preparation rhymes with work these readers already do. The playbook behind how DevOps teams reduce deployment failures with automation — shadow deploys, canary cohorts, fast rollback — transfers almost unchanged to agent rollouts. The version discipline described in Docker image management for engineering teams applies directly to pinning model versions in a register, because an upgrade is a new claim demanding fresh evidence. And the catalogue of common deployment automation challenges reads like a preview of agent-rollout failures, right down to the config drift. For the complete reference — thresholds, worked evaluations, the failure catalogue, the maturity ladder — the Ops Atlas dossier on AIOps for Security is the source to keep open beside the migration plan. Triage in 2026 stands where deployment automation stood a decade ago: proven valuable, nowhere near trustworthy by default, and worth every hour of evidence work that closes the gap.
