Introduction: Navigating the human-AI balancing act

Security operations centers (SOCs) are locked in a high-stakes paradox: defend against more threats, faster, with fewer resources—and no room for error. This challenge is driving a shift from static automation to agentic AI, where autonomous systems can take orchestrated actions while remaining under human oversight.

Beyond triage—AI agents as operational teammates

Traditional automation has long helped with alert triage and repetitive tasks, but it’s often rigid, brittle, and blind to nuance. In eSentire’s approach to managed detection and response (MDR), AI agents are evolving from simple triage tools to decision-makers embedded directly in the response chain.Dustin Hillard, CTO at eSentire, notes that AI agents are now “in the loop, not just around the edges,” embedded in the live operational flow of MDR response. “We’re seeing a transition where the agent can take on responsibilities typically reserved for analysts—escalating, suppressing, and even initiating mitigation actions—while continuously learning from feedback.”This shift is powered by normalized telemetry, dynamic policy frameworks, and an architecture that lets AI take bounded action with real-time human validation. As Hillard explains, “It’s not about replacing people—it’s about augmenting them so the human-in-the-loop can focus on what matters most.” (More on this transformation).

How orchestrated autonomy actually works

Three core pillars make orchestrated autonomy viable:

This looped learning model allows MDR providers to scale defense without scaling headcount—and do so responsibly. According to Hillard, “Our goal is to design agents that are not just reactive but strategic—learning from each incident to better defend the next.”

The maturity model for agentic AI in MDR

Security leaders evaluating MDR providers need a framework to assess where vendors fall on the AI maturity curve:

Companies like eSentire are already operating at Stage 3, where AI isn’t just a force multiplier—it’s a co-pilot.