For most of the past decade the security operations centre has been the engine room of corporate cyber defence, a room full of analysts triaging a torrent of alerts, chasing false positives and trying to spot the one signal that matters before an attacker is three steps ahead. It is exhausting, expensive work, and the people who do it burn out fast. Now one of the industry’s loudest voices argues that much of it should no longer be done by people at all.
In an interview with CRN Australia, SentinelOne co-founder and chief executive Tomer Weingarten set out his vision for the autonomous SOC, a security operations centre where agentic AI handles the bulk of detection, investigation and response while human analysts move up the stack to supervision, strategy and the hard judgment calls. You can read the full conversation at CRN Australia.
From copilot to colleague
SentinelOne is a Nasdaq-listed endpoint and extended detection vendor that has spent the past two years reframing itself as an AI security company. Its Purple AI assistant started life as a natural-language layer that let analysts ask questions of their data instead of writing complex queries. The pitch Weingarten is now making goes considerably further. Rather than an assistant that waits to be asked, the company is building agents that run investigations end to end, correlate signals across endpoints, identity systems and cloud workloads, then propose or execute a response without a human kicking off every step.
The logic is straightforward enough. Attackers already move at machine speed, automating reconnaissance and increasingly using generative models to write malware and craft convincing phishing. Weingarten’s argument, as relayed to CRN, is that defenders cannot keep pace with human-driven triage alone, and that the economics of security only improve when the repetitive investigative work is handed to software that does not sleep, does not quit and does not miss the four hundredth alert of a night shift because it looks like the previous three hundred and ninety-nine.
It is a message tuned as much for investors as for customers. SentinelOne competes directly with CrowdStrike, Microsoft and Palo Alto Networks, all of whom are racing to stitch agentic AI into their platforms. Framing the autonomous SOC as the next battleground is a way of arguing that the winners of the next cycle will be the vendors whose AI can actually be trusted to act, not just to summarise.
Promise, and the obvious objection
The counter-view is not hard to find, and plenty of practitioners hold it. Handing response actions to autonomous software is precisely the scenario that keeps security leaders awake. An AI that can quarantine a machine or disable an account can also quarantine the wrong machine or lock out a chief executive mid-deal, and the blast radius of a confident, automated mistake is larger than that of a cautious human one. The industry has not forgotten how a single flawed software update from CrowdStrike grounded flights and froze hospitals in July 2024, a reminder that automation at scale cuts both ways.
There is also the question of accountability. When an autonomous agent makes a call that goes wrong, who answers for it: the vendor, the customer’s security team, or the board that signed off on the deployment? Analysts at firms such as Gartner have consistently cautioned that “autonomous” in security is better understood as a spectrum than a destination, and that most organisations will want a human firmly in the loop for any action that is hard to reverse. Weingarten himself frames the shift as one that elevates rather than replaces analysts, but the commercial incentive to promise more autonomy than is prudent is real, and buyers are right to test the claims hard.
The honest middle ground, which most serious operators are converging on, is graduated trust. Let the agents triage, enrich and investigate freely, because the cost of a mistake there is low. Keep a tighter leash on containment and remediation, expanding the agent’s authority only as it earns confidence on a given network. The interesting competition is not whether AI belongs in the SOC, which is settled, but how much rope each vendor is willing to give it and how transparently it shows its working.
What it means for Australia
For Australian organisations the pitch lands on fertile ground, because the local market has the exact problem an autonomous SOC claims to solve. The country does not have enough security analysts, and it never has. The talent shortage has pushed many mid-sized firms, councils and health providers towards managed security services they can barely afford, and towards thinly staffed in-house teams that cannot run a genuine twenty-four-hour watch. AI that credibly handles tier-one triage is, in that context, less a luxury than a staffing strategy.
The threat side is just as pointed. The Australian Signals Directorate‘s most recent annual cyber threat report described a relentless tempo of attacks on critical infrastructure, small business and individuals, and the agency has been blunt that AI is a force multiplier for attackers as much as for defenders rather than a silver bullet for either side. The scars of Optus, Medibank and Latitude Financial still shape boardroom conversations, and the Security of Critical Infrastructure regime now puts legal weight behind how quickly and competently an incident is handled. Faster, more consistent detection and response is not just operationally attractive here, it is edging towards a compliance expectation.
Yet Australian buyers also carry specific constraints that temper the sales pitch. Data sovereignty matters, particularly in government, health and financial services, so any autonomous SOC that reaches into sensitive logs and takes action on local systems invites hard questions about where models run and where data travels. Privacy obligations and the prospect of tougher accountability under reforms flowing from the Privacy Act review mean an automated decision that affects a person cannot be a black box. SentinelOne, like its rivals, will need to satisfy local regulators and risk committees that an agent’s actions are logged, explainable and reversible, not merely fast.
What’s next
Expect the autonomous SOC to be the headline theme across the vendor pitches Australian CISOs hear through 2027, with every major platform claiming some flavour of agentic capability. The practical test will play out quietly inside managed service providers and large enterprise teams, where pilots will reveal how much of the SOC can genuinely be ceded and how much still needs a human hand on the switch. Procurement teams would do well to ask for evidence rather than adjectives: measurable reductions in dwell time and analyst toil, clear audit trails, and a sober account of what happens when the AI gets it wrong.
Weingarten is betting that the security operations centre of the next decade looks fundamentally different from today’s. He is probably right about the direction. The argument worth having, in Sydney boardrooms as much as in Silicon Valley, is about the pace, and about who stays answerable when the machines are the ones making the first move.
Sources: CRN Australia.
