AI now resolves 60% of security investigations, Arctic Wolf reports

Arctic Wolf says human-only investigations have fallen from 81% to 2%, but warns that closing cases is not the same as containing attacks.

Arctic Wolf says its latest agentic security operations report shows a sharp turn in cybersecurity practice, with artificial intelligence now independently resolving 60% of investigations. Based on data from more than 11,000 organisations in over 100 countries, the company says the balance of work in its security operations model has shifted rapidly over the past year, as machine-led processes have become the norm rather than the exception.

The report indicates that human-only investigations have fallen from 81% to just 2%, while AI-human collaboration has risen from less than 1% to 38%. Taken together, those figures suggest that human analysts are now involved in the overwhelming majority of cases, but increasingly in partnership with automated systems rather than as the sole decision-makers. Arctic Wolf argues that this reflects the demands of threats that move at machine speed and require a different operating model from traditional security operations.

That change, however, should not be confused with full autonomous incident response. A security investigation can be closed when an alert is classified, evidence is collected or a case is triaged, but that is not the same as containing a real attack, removing persistence or confirming that an intruder has been expelled from a network. The distinction matters, because a high automation rate does not by itself show that AI can safely manage every stage of cybersecurity response.

The broader implication for security teams is that faster triage may help reduce alert fatigue and free analysts to concentrate on higher-risk work, but autonomy also creates new exposure. AI agents that can access logs, identity systems, ticketing platforms and response tools may become part of the attack surface they are meant to defend. That makes permissions, auditability and human approval boundaries central to any serious deployment.

Arctic Wolf’s figures point to a future in which routine investigation work is increasingly delegated to software, while people focus on judgement, escalation and verification. But the report also underlines that success should be measured by outcomes, not simply by how many cases an AI system can close. For security leaders, the more important question is whether automation is genuinely improving accuracy, containment and resilience, rather than merely increasing the pace at which incidents are processed.

Source Reference Map

Inspired by headline at: ^[1]

Sources by paragraph:

Source: Fuse Wire Services