Paul Stuttard, director, Duxbury Networking.
Artificial intelligence (AI) is already changing managed detection and response (MDR) technologies. AI helps security teams sift through vast amounts of data, spot suspicious behaviour and react to threats far faster than traditional security methods.
For organisations facing an expanding digital attack surface, this capacity becomes increasingly vital. Security teams have to monitor environments, remote users, endpoints, identities, applications and networks simultaneously, while cyber criminals develop more sophisticated and automated methods of attack.
Now a clear distinction is appearing between the AI that most organisations know and a newer generation of more autonomous systems known as agentic AI.
Conventional AI is generally used to analyse data, recognise patterns, generate insights and make recommendations in response to human prompts or predefined processes.
Generative AI, meanwhile, has become widely recognised for its ability to produce text, code and other content in response to instructions.
Agentic AI goes a significant step further. Rather than simply responding to a prompt or analysing an individual dataset, agentic systems are designed to pursue defined goals. They can assess information, make decisions, plan sequences of actions and interact with other systems with varying degrees of autonomy.
Technology can understand the threat. Humans are often better positioned to understand the consequences.
In an MDR environment, this could represent the next major evolution in cyber security operations.
An AI agent could potentially investigate suspicious activity as it emerges, correlate information from multiple security platforms, gather relevant threat intelligence and assess whether apparently isolated events form part of a wider attack. It could then recommend − or, within carefully defined boundaries, initiate − an appropriate response.
The significance lies in the ability to operate across increasingly complex technology environments at machine speed.
A conventional security operation may generate thousands of alerts every day. Many are false positives, while others require analysts to manually collect information from multiple tools before determining whether an incident represents a genuine threat.
This process consumes valuable time and places enormous pressure on already stretched cyber security teams.
Agentic AI could help change that equation. Instead of simply flagging suspicious activity, an AI agent could investigate the alert, examine the affected identity, device and application, review previous activity, correlate events across the network and compare the findings with external threat intelligence.
It could build a picture of what is happening before escalating the incident to a human analyst with the relevant evidence already assembled.
This could significantly cut down the time between identifying a threat and reacting to it.
It could also allow MDR providers and internal security teams to use their skills where they’re most needed − on complex investigations, strategic, big-picture decision-making and incidents where business context and professional judgement are essential.
This capacity could become especially useful as cyber criminals progressively exploit AI. Attackers are increasingly using automation to improve the scale and sophistication of phishing and social engineering campaigns, identify vulnerabilities and accelerate reconnaissance.
The traditional advantage of having human defenders manually responding to machine-generated threats is becoming increasingly difficult to sustain.
The future cyber security contest may therefore increasingly become one of machine speed against machine speed.
However, greater autonomy also raises important questions.
Can organisations trust AI to make security decisions that could disrupt business operations? What happens when an automated response incorrectly isolates a critical system, disables an important account or blocks legitimate business activity? And where should responsibility lie when machines are making increasingly complex decisions?
These questions underline why the human cyber security professional will not disappear.
In a previous article, I predicted that the role of the cyber security professional would evolve rather than be eliminated. The concept of the human in the loop represents far more than a compromise between automation and manual security.
AI may be able to process extraordinary quantities of information and execute predefined actions at remarkable speed, but it does not possess the complete business understanding, contextual awareness, or judgement of experienced security professionals.
A security system may identify unusual activity and determine that isolating a device is technically the safest response. A human analyst, however, may understand that the device supports a critical business process, belongs to a senior executive travelling overseas, or is connected to an operational system where disruption could have significant consequences.
Technology can understand the threat. Humans are often better positioned to understand the consequences.
Human oversight is therefore particularly important when security decisions could affect critical infrastructure, customers, business continuity or organisational reputation.
This underlines the importance of genuine human-machine partnerships in the creation of resilient cyber security ecosystems − partnerships that close the gap between digital intelligence and human intuition.
This is supported by Daniel O’Sullivan, a senior analyst at Gartner, who says the integration of agentic AI may well lead to the creation of new corporates that are “focused on AI management and the evolution of existing customer service positions towards complex problem-solving and personalised interactions”.
In this light, the most effective MDR environments will likely establish clear boundaries between actions that AI can perform autonomously and those requiring human authorisation.
Low-risk and repetitive activities may increasingly be automated. AI agents could gather information, investigate alerts, correlate events and perform routine containment actions within predefined parameters. On the other hand, more significant decisions, particularly those involving critical systems or potentially disruptive responses, could remain subject to human approval.
This trend is particularly relevant in South Africa.
According to PwC’s 2026 Global Digital Trust Insights survey, agentic AI ranks among the leading AI-enabled security capabilities organisations are prioritising. Security leaders are planning deployments across areas, including cloud security, data protection, identity and access management, and cyber defence and operations.
The PwC findings suggest South African organisations are actively considering agentic AI as part of their cyber security strategies. Identity and access management is a particularly strong priority, while organisations are also planning agentic deployments in cloud security, data protection and cyber defence operations.
The numbers are striking. Cloud security is the leading South African priority for agentic AI, cited by 62% of respondents, compared with 39% globally. Data protection, cyber defence and operations, and identity and access management each feature at 41%.
Against this backdrop, agentic AI makes considerable sense in an environment where organisations are simultaneously dealing with increasingly complex cloud infrastructures, expanding digital attack surfaces and persistent cyber security skills shortages.
South African businesses are under pressure to do more with limited security resources. They need to identify threats faster, investigate incidents more efficiently and maintain visibility across increasingly distributed IT environments.
Agentic AI could become an important force multiplier. The greatest opportunity lies in combining the speed, scale and analytical capabilities of intelligent machines with the experience, judgement and contextual understanding of human professionals.
The future of MDR may therefore not be defined by AI replacing cyber security teams. It may instead be defined by something considerably more powerful: cyber security professionals working alongside increasingly capable AI agents, with each performing the tasks to which they are best suited.
As cyber threats accelerate towards machine speed, that combination of artificial intelligence and human judgement could become one of the most important foundations of cyber resilience.