Arctic Wolf says agentic AI now resolves 60% of investigations in its Aurora security operations service, while a further 38% involve collaboration between AI and human analysts. Human-only investigations account for 2% of the caseload, compared with 81% roughly a year earlier, according to the company’s 2026 Agentic Security Operations Report.
The report draws on data from more than 11,000 organisations in over 100 countries. Arctic Wolf also reports that monthly investigation volume increased 21%, alert volume fell 19% and the average time between an alert-generating event and an actionable ticket fell 36%. These are vendor-produced operational measures from its own service, so buyers should ask how an investigation is defined, what counts as autonomous resolution and how false negatives are detected.
The numbers are still useful because they move the conversation beyond generic claims about analyst productivity. A credible evaluation should examine which decisions remain reserved for people, how the agent escalates uncertainty and whether a closed investigation can be reopened when new evidence arrives. Security leaders should also compare speed with outcome quality, customer impact and evidence retention. Automation that reduces queues is valuable only if the organisation can reconstruct why an alert was dismissed or advanced.
