Business It News / Business Intelligence
Splunk expands AI security workforce to enable autonomous defence at machine speed
To combat the growing threat of AI-led attacks Splunk is expanding its Agentic SOC Workforce to enable organisations to defend autonomously, block attacks at the
At its .conf26 event in Denver, the Cisco company announced that it is expanding its Agentic SOC Workforce with a set of new purpose-built skills, across detection, investigation, response, and governance
It is intended to give companies a way to move from largely human-led, reactive security operations to AI-driven, increasingly autonomous defence. Splunk said by expanding Workforce it will enable security teams to identify and contain threats at machine speed rather than waiting for analysts to work through alerts manually.
For companies, this means faster threat detection, quicker containment and a smaller blast radius when attacks occur. They can also use AI agents to proactively identify vulnerabilities and prioritise the exposures that pose the greatest business risk.
Importantly, the approach keeps humans in control through approvals, policies, governance and auditability. Companies therefore gain greater automation without surrendering oversight.
Splunk said the AI threat landscape was on track to outpace the human-led defence model.
“Never has it been more critical for organisations to be able to understand and address potential exposure and vulnerabilities across their entire IT landscape from the infrastructure to the applications.
“Stopping these AI-era threats requires an agentic SOC capable of reasoning and defending at machine speed without compromising the data sovereignty and human governance enterprise leaders demand.”
Splunk said it is advancing the agentic SOC by combining enterprise-wide telemetry with specialised AI agents powered by leading frontier and domain-specific models. New purpose-built agent capabilities expand the Splunk Agentic SOC Workforce and mirror how elite security operations teams work across detection engineering, proactive threat hunting, autonomous investigation, coordinated response, and policy governance.
It said attackers are now using AI to hunt for vulnerabilities at scale, probing infrastructure, applications, and identity systems continuously and indiscriminately. Recent exploitation campaigns have made complete exposure visibility a board-level requirement, it warned.
John Morgan, SVP and GM of Splunk Security, said AI is accelerating attacks faster than human-led security operations can keep pace with and closing that gap requires a SOC that can act at the same speed without losing the governance leaders require.
“By harnessing automation and intelligent workflows, modern security operations centres (SOCs) can deliver rapid, consistent threat detection and response. This equips teams with the precision and agility needed to keep pace with today’s most sophisticated threats,” he said.
Morgan said that as organisations evolve from basic triage to autonomous, agentic defence, security teams need to scale their agentic workforce.
“To help teams make that shift, we are introducing the continued expansion of the Agentic SOC Workforce. Splunk is enhancing existing capabilities and introducing new agentic skills within the way SOC teams already operate: detection and security engineering, threat hunting, investigation and response, and governance and policy.”
He said the Agentic SOC Workforce are trusted extensions of the security team, designed to help analysts and engineers move faster while keeping humans in control.
“Together, these agents deliver a breadth of skills to help customers defend autonomously with trusted AI, shared context, approvals, auditability, and policy built in. The result is a SOC that can defend at machine speed while keeping practitioners accountable.”
