Findings/analysts-reuse-agent-output-heavily

In a SOC studied for over a year, analysts reused an agentic assistant's output in the closing reports of over 90% of tickets during a four-month deployment.

Reportedobserved1 evidence record from 1 independent sourceassistant-drafted

Scope: what this does not show

One organization and one tool, built with the SOC's own analysts; four months of use; the paper does not say whether the reused output was correct.

Reported: Stated by one source and not yet corroborated or challenged.

Evidence

Sep 5, 2026

Year-long SOC fieldwork finds analysts reused an agentic AI companion's output in over 90% of tickets

arXiv

Status history

2026-09-05ReportedUniversity of South Florida fieldwork. · record

What would change this: Measures of when that reliance was warranted.
Evidence kind: observed: Seen in a real incident or operation.
Freshness: Evidence 21d old · recheck in 344 daysNewest evidence Sep 5, 2026. Half-life 365 days.
Topics: SOC automation Monitoring & control
Attack surface: Human approver
Fide research: FID-076: Authorization boundaries and AI control in cybersecurity

Cite this record

Fide AI. "In a SOC studied for over a year, analysts reused an agentic assistant's output in the closing reports of over 90% of tickets during a four-month deployment.." Agentic Cyber Explorer, record analysts-reuse-agent-output-heavily. https://agentic-cyber-explorer.pages.dev/findings/analysts-reuse-agent-output-heavily/ (corpus as of 2026-09-26).

BibTeX

@misc{fide-ace-analysts-reuse-agent-output-heavily,
  author = {{Fide AI}},
  title = {In a SOC studied for over a year, analysts reused an agentic assistant's output in the closing reports of over 90\% of tickets during a four-month deployment.},
  howpublished = {Agentic Cyber Explorer},
  year = {2026},
  url = {https://agentic-cyber-explorer.pages.dev/findings/analysts-reuse-agent-output-heavily/},
  note = {Record analysts-reuse-agent-output-heavily; corpus as of 2026-09-26}
}

Data: JSON · CC BY 4.0

Know of evidence that changes this? Tell us.