The open source AI SOC you own

Agentic versus autonomous. Agentic, autonomous: what's the difference, and how can it help me and my defense in cybersecurity? Agentic means the human is very much in the loop, and autonomous means the human is mostly on the loop. Let's see how a SOC can hunt faster without giving up control, and how the human shifts from being in the loop to being on the loop. This illustration will also show why owning your learning loop is important.

Let's start with a threat hunt. The first time, it takes five agents, 30 seconds, and, assuming you send the thinking to a hosted LLM, $4.50 on a first task. This drops to only two agents, 20 seconds, and $1.25 on a similar task later. Let's see how this works.

Imagine a threat hunt that starts with a fictional CISA report, Copper Lattice. This fictional report describes attackers persisting on edge routers and VPN devices, harvesting credentials, and using rotating relay infrastructure. The first time through, the analyst drops the PDF into Vigil to develop a hypothesis and hunt plan. The human is in the loop and reviews the proposed scope and evidence before execution.

This particular hunt is new to this deployment of Vigil. A look into the memory shows the hunt has little relevant experience to draw on, so it may need more agents or a more capable model you've chosen. It still checks confidence, cost, and permissions. Automatic model selection is coming soon after Vigil 1.0. For this initial hunt, actions remain read-only because Vigil's confidence in the hunt is low, and so a human is required in the loop. No actions such as credential rotation, ACL removal, or reboot can be taken until the incident response lead approves containment.

The system then reviews what the hunt found and how it got there. Each hypothesis closes as confirmed, refuted, or inconclusive, with any data gap named. The ledger keeps the trace, evidence, outcome, and cost. This gives the next investigation evidence to learn from.

If you have LogLM as well, Vigil can use semantic similarity search to look for related behavior in your telemetry, not just the report's known IP addresses. In this example, you might surface two more IPs with similar beaconing behavior that the original report didn't list. Those are candidates to scrutinize. Vigil can check the sessions, cadence, destination context, and alternative explanations for these IPs also behaving in a concerning manner.

Memory keeps the hypothesis, plan, what worked, and what it cost. Your feedback distinguishes a useful result from a mistake worth avoiding. Essentially, all feedback updates the prior for the next similar hunts. The original evidence stays available for checking. Vigil's watcher reads the record. Which steps helped, and where did agents repeat work? Could a smaller plan preserve quality? Importantly, the watcher, the ledger, and memory also check that agents stay within your guardrails. Vigil helps make sure your agents stay on your side.

Later, imagine a similar CISA alert arrives as STIX JSON through a TAXII feed. Vigil checks the memory first. The prior hunt helps it assess the new hypothesis. Because it has performed a similar hunt recently, it calculates a higher confidence score and develops a more intelligent, concise plan: less time, fewer tokens, and less model spend if you use a paid external model. So you can see that the system is starting to earn confidence. This will naturally shift the human to on the loop from in the loop, if thresholds are set to allow for autonomous operations with higher confidences. The other direction also works: when the system has a lower confidence score, it will require a human in the loop to proceed. Remember, it is us humans that set those thresholds.

Vigil 1.0 is the leading AI-native AI SOC and the preferred path for cyber defenders moving towards autonomous operations. Please take a look, give it a try, and feel free to join a talk in a city near you, weekly office hours, or our Vigil community Discord. Vigil Assured, featuring additional controls, 24x7 support, and more, is available from DeepTempo.ai as part of the Intelligent Defense Platform. Free trials of Vigil Assured and the Intelligent Defense Platform are also available.