Autonomous SOC response agent
More
Recommended next steps
Highest-priority open actions
At a glance
- Owner
- Ryan Katsuragi
- Sponsor
- CISO
- Business unit
- Cyber Defence
- Lifecycle stage
- Proposed
- Architecture
- Agentic
Top risks driving the decision
- R-CY-01 Adversary-triggered self-DoS
- R-AI-01 Excessive agency without human oversight
- R-OP-01 Model-hallucinated response actions
- T-AI-01 Indirect prompt injection via crafted alerts
Key conditions
- Human approval gate for all destructive actions (no autonomy on account disable, network block, endpoint isolation)
- Alert content sanitisation before model reasoning
- Emergency kill switch tested weekly
What drives the score
GII points contributed by each CALIBRE factor (score 0 to 4 × weight)
Findings from each capability
- ARA Agentic Risk Analyst
- 9 findings
- CALIBRE Governance intensity
- 17 controls + GII summary
- Secure-RAG Evidence
- 0 citations
Decision narrative
Initiative SAMPLE-04 (Autonomous SOC response agent) is assessed at ARA overall-residual Critical, CALIBRE band Critical (GII 87.50/100).
The core proposition (autonomous destructive action on production systems in response to model-scored alerts) cannot be brought within enterprise risk appetite by adding controls at the margin. Any adversary who can influence alert content, log entries or telemetry can weaponise the agent against the organisation itself.
Do not approve. Reconsider the architecture: an AI-assisted design where the agent proposes actions and a human approves them within seconds achieves most of the mean-time-to-contain benefit without the excessive-agency risk.
Description
A financial-services CISO proposes an autonomous SOC agent that can isolate endpoints, reset credentials, disable user accounts and block IPs in response to SIEM detections without human approval, to reduce mean time to contain. The agent uses an LLM to reason over alerts plus tool-calling to invoke EDR and IAM APIs.
How action status is reported
A control is reported as implemented in the attestation only when its action is Complete. Add a link to the evidence where possible.
CALIBRE sets the required controls by band, not by reading the description. If a control does not apply, mark it Waived and put the written justification (or a link to it) in the evidence field. The waiver is shown in the attestation.
| Priority | Action | Status |
|---|---|---|
| Critical | Reconsider architecture; propose a reduced-autonomy alternative SAMPLE-04-A-01
|
Open |
No actions match
Change the filters to see more.
ARA R-CY-01Adversary-triggered self-DoS
Attacker can craft alerts that cause the agent to disable critical accounts or block critical IP ranges.
ARA R-AI-01Excessive agency without human oversight
Agent can take irreversible destructive actions on business-critical systems.
ARA R-OP-01Model-hallucinated response actions
Model may invoke tools with parameters not grounded in the source alert.
ARA CMP-01APRA CPS 230 (Australia) - applicable
Autonomous action on critical business systems creates operational-risk exposure requiring formal management.
ARA T-AI-01Indirect prompt injection via crafted alerts
Attacker crafts log entries or alert content that manipulates the SOC agent's response.
ARA T-AI-02Excessive Agency
Agent has direct API access to disable accounts and block network traffic.
ARA C-01Human approval gate for destructive actions
Account disable, network block, endpoint isolation all require human approval before execution.
ARA C-02Alert content sanitisation
Strip untrusted content from alerts before passing to model reasoning.
ARA C-03Emergency kill switch
One-command revoke of agent's tool access, tested weekly.
CALIBRE CAL-GII-CriticalGovernance Intensity Index = 87.50/100 (band: Critical)
CALIBRE band: Critical. Rule 1: autonomous action on sensitive data, floor High: ensure human oversight (HITL-01). Rule 2: worst-case impact affects safety or rights, floor High: independent assurance (ASR-01) required. Agentic amplifier: sub-scores not yet provided (Authority-chain complexity, Tool-invocation scope, Chained-decision depth, Agent identity and credentialing, Kill-switch effectiveness): one-band uplift applied conservatively until assessed. No effect on the band: already Critical.
CALIBRE CAL-GOV-03GOV-03 - Executive and board risk sign-off
CALIBRE core control, required from band Critical upward. Maps to NIST GOVERN-2.3 | ISO 42001 5.1; 6.1.3 | EU AI Act Art.17.
CALIBRE CAL-RES-01RES-01 - Redress and incident response
CALIBRE core control, required from band Critical upward. Maps to NIST MANAGE-4.3; MEASURE-3.3 | ISO 42001 A.8.3; A.8.4 | EU AI Act Art.73.
CALIBRE CAL-XAI-01XAI-01 - Explainability and transparency
CALIBRE core control, required from band High upward. Maps to NIST MEASURE-2.9 | ISO 42001 A.8.2 | EU AI Act Art.13; Art.50; Art.86.
CALIBRE CAL-HITL-01HITL-01 - Human oversight (human-in-the-loop)
CALIBRE core control, required from band High upward. Maps to NIST MAP-3.5 | ISO 42001 A.9.3 | EU AI Act Art.14; Art.26.
CALIBRE CAL-MON-01MON-01 - Runtime monitoring and drift detection
CALIBRE core control, required from band High upward. Maps to NIST MEASURE-2.4; MANAGE-4.1 | ISO 42001 A.6.2.6; A.6.2.8 | EU AI Act Art.72; Art.26.
CALIBRE CAL-ASR-01ASR-01 - Independent pre-deployment assurance
CALIBRE core control, required from band High upward. Maps to NIST MEASURE-1.3 | ISO 42001 A.6.2.4; A.6.2.5 | EU AI Act Art.17; Art.43.
CALIBRE CAL-AUTH-01AUTH-01 - Authority-chain map
Required by the Agentic amplifier (CALIBRE method v1.3, Section 11). Domain references: MITRE ATLAS mitigations AML.M0026 to AML.M0030, AML.M0033, AML.M0037 (data release 2026.09); OWASP Top 10 for Agentic Applications 2026 (guidance).
CALIBRE CAL-IDN-01IDN-01 - Agent identity and credentialing
Required by the Agentic amplifier (CALIBRE method v1.3, Section 11). Domain references: MITRE ATLAS mitigations AML.M0026 to AML.M0030, AML.M0033, AML.M0037 (data release 2026.09); OWASP Top 10 for Agentic Applications 2026 (guidance).
CALIBRE CAL-KILL-01KILL-01 - Tested kill switch
Required by the Agentic amplifier (CALIBRE method v1.3, Section 11). Domain references: MITRE ATLAS mitigations AML.M0026 to AML.M0030, AML.M0033, AML.M0037 (data release 2026.09); OWASP Top 10 for Agentic Applications 2026 (guidance).
CALIBRE CAL-PIN-01PIN-01 - Prompt-injection hardening
Required by the Agentic amplifier (CALIBRE method v1.3, Section 11). Domain references: MITRE ATLAS mitigations AML.M0026 to AML.M0030, AML.M0033, AML.M0037 (data release 2026.09); OWASP Top 10 for Agentic Applications 2026 (guidance).
CALIBRE CAL-CHN-01CHN-01 - Chained-decision logging
Required by the Agentic amplifier (CALIBRE method v1.3, Section 11). Domain references: MITRE ATLAS mitigations AML.M0026 to AML.M0030, AML.M0033, AML.M0037 (data release 2026.09); OWASP Top 10 for Agentic Applications 2026 (guidance).
CALIBRE CAL-GOV-02GOV-02 - AI impact and risk assessment
CALIBRE core control, required from band Moderate upward. Maps to NIST MAP-5.1 | ISO 42001 A.5.2; A.5.4 | EU AI Act Art.9; Art.27.
CALIBRE CAL-DATA-01DATA-01 - Data governance and PII protection
CALIBRE core control, required from band Moderate upward. Maps to NIST MEASURE-2.10 | ISO 42001 A.7.2; A.7.3; A.7.4; A.7.5 | EU AI Act Art.10.
CALIBRE CAL-SEC-01SEC-01 - AI security controls
CALIBRE core control, required from band Moderate upward. Maps to NIST MEASURE-2.7 | ISO 42001 A.6.2.3 | EU AI Act Art.15.
CALIBRE CAL-SUP-01SUP-01 - AI supply-chain and third-party assurance
CALIBRE core control, required from band Moderate upward. Maps to NIST GOVERN-6.1; MANAGE-3.1 | ISO 42001 A.10.2; A.10.3 | EU AI Act Art.25.
CALIBRE CAL-LIT-01LIT-01 - AI literacy and competence
CALIBRE core control, required from band Low upward. Maps to NIST GOVERN-2.2 | ISO 42001 7.2 | EU AI Act Art.4.
CALIBRE CAL-GOV-01GOV-01 - AI use-case registration
CALIBRE core control, required from band Low upward. Maps to NIST GOVERN-1.6 | ISO 42001 A.4.2 | EU AI Act Art.49.
No findings match
Change the filters to see more.
Runtime: operating envelope, control tests and authority checks
Operating envelope
No operating envelope
Push one from ARA. Until then every agent action is escalated.
Recent authority checks
Open authorityNo checks recorded for this initiative.
Agent gateways call POST /api/authority/check before acting. Secure-RAG reports control tests to POST /api/test-results.