This post was inspired by the VentureBeat article "For AI to succeed in the SOC, CISOs need to remove legacy walls now."
What if the barrier to AI success in security operations isn't the sophistication of our models, but the architecture of our organizations themselves?
At Command Zero, we've been deeply involved in the conversation around AI-powered security operations for several years now. Recent findings from Forrester's 2025 Security & Risk Summit reveal a striking paradox that validates many of our architectural decisions: while AI agents fail 70-90% of the time on complex enterprise tasks, 79% of executives report meaningful productivity gains from deployed AI. This isn't a contradiction—it's a signal that we've been solving the wrong problem.
The gap between AI winners and losers in cybersecurity isn't about technology. It's about organizational readiness. More specifically, it's about the legacy walls—both technical and operational—that fragment our security environments and prevent AI from delivering on its promise.
The Architecture Problem Hiding Behind the AI Promise
Modern enterprise SOCs have evolved into something resembling digital archaeological sites—layers upon layers of tools, each generation solving yesterday's problems while creating tomorrow's integration challenges. The average enterprise SOC operates 83 security tools across 29 different vendors (Source: IBM - Capturing the cybersecurity dividend), each generating isolated data streams that defy easy integration. This isn't just a complexity problem; it's a fundamental architecture problem that no amount of AI sophistication can overcome.
When CrowdStrike CEO George Kurtz warned that "the legacy SOC, as we know it, can't compete," he identified a critical truth: the fragmentation of our security infrastructure creates an environment where even the most advanced AI struggles to succeed. Carnegie Mellon's AgentCompany benchmark showing 70-90% failure rates for AI agents on complex enterprise tasks isn't measuring AI capability—it's measuring the impossibility of navigating fragmented organizational architectures.
This presents a paradox for security leaders: We're being pushed to adopt AI to handle the complexity created by our fragmented tools, yet that same fragmentation is precisely what causes AI implementations to fail.
Why Traditional AI Agent Approaches Struggle
The industry's rush toward agentic AI for security operations has revealed a fundamental mismatch between how these systems work and what enterprise environments require. Salesforce's research showing up to 90%+ AI agent failure rates when security guardrails are applied highlights the tension between autonomous AI behavior and the governance requirements of production security environments.
Traditional AI agent architectures face several structural challenges in SOC environments:
Unpredictable Performance and Non-Determinism:
Agent-to-agent LLM communication is expensive, slow, and introduces hallucination risks at every interaction point. When an AI agent needs to query another agent to access a different data source, each interaction becomes a potential failure point. In time-sensitive security scenarios where adversaries achieve breakout times of just two minutes and seven seconds, this architectural bottleneck can be fatal.
Black Box Decision-Making:
As AI agents operate with increasing autonomy, the combinatorial complexity of their decision trees grows exponentially. Security operations demand auditability and transparency—you need to understand why a decision was made. Without deterministic frameworks guiding their actions, agent behavior becomes difficult to predict, audit, or validate—precisely the opposite of what security operations require.
Context Fragmentation:
Most agentic AI implementations assume the AI can reach any data it needs. In reality, enterprise security data exists in isolated silos across cloud platforms, identity providers, endpoint systems, and legacy tools. Agents often lose critical context as they navigate between systems and data sources, creating investigation gaps and incomplete analysis.
Cost Inefficiency:
Unrestricted LLM-based agents can generate significant costs through inefficient query patterns and redundant operations. Serial LLM calls for every decision create prohibitive operational costs at scale. More critically, they lack the governance frameworks needed to ensure they operate within acceptable boundaries, particularly around privileged actions and sensitive data access.
The Command Zero Approach: Combining Structure with Autonomy
At Command Zero, we've taken a pragmatic approach to AI implementation in security operations. What we've found works in practice is a combination of structured AI augmentation and autonomous agents, each applied where they deliver the most value.
Federated Data Model: Removing the First Wall
The first organizational wall Command Zero removes is the requirement for data centralization. Traditional security platforms assume you'll ingest all your security data into a central repository before analysis can begin. This creates a massive prerequisite that delays AI value by months or years.
Our federated data model takes a different approach. Rather than collecting data centrally, we access it where it lives—directly from source systems in real-time. When investigating a suspicious authentication event, Command Zero can simultaneously query Microsoft Entra ID, Okta, AWS IAM, GitHub, and dozens of other systems without those systems first copying their data into a centralized store.
This approach eliminates the primary organizational wall preventing AI success: the assumption that you must transform your data architecture before you can leverage AI capabilities. Organizations can begin investigations immediately, accessing comprehensive data across their entire environment without the prerequisite of a massive data consolidation project.
The federated model also solves the data accessibility problem that plagues autonomous agent architectures. Our platform knows how to query each source system efficiently, handling authentication, rate limiting, and result optimization transparently. This means AI capabilities operate on complete, real-time data rather than stale copies in a centralized repository.
Question-Based Investigation Framework
Command Zero's core innovation is treating investigations as a series of structured questions rather than unguided exploration by AI agents. Each question in our knowledge base is carefully crafted to encode expert knowledge about what to investigate, which data sources to query, how to interpret results, and what questions naturally follow.
This structure provides the governance framework that autonomous agents lack. Every investigative step has a clear purpose, a defined scope, and transparent reasoning. When our platform suggests "Investigate authentication anomalies for this user," it's executing a well-understood investigative pattern, not making an unpredictable autonomous decision.
The question-based approach also eliminates the serial communication overhead that plagues multi-agent systems. Rather than agents negotiating with each other about what to investigate next, our platform maintains a comprehensive understanding of the investigation context and proposes relevant next steps based on embedded expertise.
AI as Force Multiplier Within Structured Frameworks
This is where our approach to AI differs fundamentally from pure autonomous agent architectures. We use LLMs and RAG (Retrieval Augmented Generation) techniques extensively, but in controlled ways that combine both structured augmentation and targeted autonomy:
Intelligent Question Selection: Our implementation maintains a comprehensive vector store of our question library and investigation facets. When an analyst is investigating a risky sign-in event, our system uses natural language processing to understand the context and propose the most relevant questions. This isn't an AI agent deciding what to do—it's AI helping navigate a structured knowledge base efficiently.
Context-Aware Analysis and Decision-Making: We use LLMs to analyze results, identify patterns, generate explanations in natural language, and make accurate investigative decisions. But these analyses always occur within the context of a specific question with defined data inputs and expected output patterns. The LLM enhances interpretation while operating within governance guardrails that prevent unpredictable behavior.
Autonomous Question Generation: Within our controlled framework, we also allow AI agents to generate and enhance questions as needed. This provides flexibility and adaptability while maintaining the transparency and governance that security operations require.
Transparent Reasoning: Every AI-assisted decision in Command Zero includes an explanation of its reasoning. When the system suggests investigating lateral movement patterns, it explains which indicators triggered that suggestion and what evidence it's based on. This transparency builds trust and enables validation—critical requirements that pure autonomous agents often fail to meet.
Cost and Performance Optimization: By using AI within structured workflows rather than for unrestricted exploration, we dramatically reduce token consumption and API costs. More importantly, we optimize for analysis speed. Our investigations complete in minutes rather than the extended timeframes often seen with agent-based approaches.
Embedded Expertise as Organizational Readiness
The most significant organizational wall preventing AI success is the expertise gap. Traditional AI implementations assume skilled security analysts who can craft effective prompts, interpret results, and guide the investigation. This creates a system that only works well for those who need it least.
Command Zero inverts this model. By embedding expertise directly into our question library and investigation framework, we make advanced investigative capabilities accessible to less experienced analysts. A tier-1 analyst can conduct investigations that would traditionally require tier-2 or tier-3 expertise because the platform encodes that expertise in its questions and workflows.
This democratization of expertise is itself a form of organizational readiness. Rather than requiring organizations to hire rare senior talent or train every analyst to expert level, we enable teams to operate effectively with the analysts they have. This architectural decision removes one of the most significant barriers to AI adoption: the need to transform your team before you can transform your operations.
Evolution and Future Direction: Two Complementary Paths
AI agents in cybersecurity are evolving along two distinct but complementary paths, and we believe Security Operations need a combination of both paths to succeed in the diverse cases they tackle every day:
Path 1: Autonomous Agent Systems (better suited for tier-1 triage and alert filtering)
- Appropriate for high-volume, lower-stakes decisions
- Useful for initial classification and routing
- Still requires extensive human oversight for accuracy
Path 2: Structured AI Augmentation (better suited for tier-2/3 investigations)
- Embedding expertise into frameworks that AI navigates
- Maintaining transparency and auditability
- Optimizing for consistency and reliability over pure automation
Our platform integrates both approaches, applying each where it delivers the most value. Tier-1 functions benefit from autonomous agent capabilities for rapid triage, while tier-2 and tier-3 investigations leverage our structured augmentation framework for thorough, governed analysis.
The Governance Advantage
Recent discussions at industry conferences have highlighted governance as a critical factor in AI success. The VentureBeat article correctly identifies that successful AI implementations require "policy-as-code for AI agents" and "consistent identity-centric governance." These aren't just best practices—they're architectural requirements.
Command Zero's approach provides governance by design:
Auditable Decision Trees: Every investigation path has a clear provenance. We can show exactly which questions were asked, what data was accessed, how results were interpreted, and why specific conclusions were reached. This auditability is built into the architecture, not bolted on as an afterthought.
Controlled Scope: Each question has a defined scope of data access. We never grant broad access and hope the AI uses it responsibly. Instead, every investigative action has explicit boundaries about what data it can access and what operations it can perform.
Identity Integration: Our platform integrates with enterprise identity systems, ensuring that all investigative actions are performed within the context of the analyst's permissions. This identity-centric approach means governance policies apply consistently, whether an analyst is acting directly or the platform is suggesting next steps.
Continuous Validation: Because our architecture combines deterministic structured elements with controlled autonomous capabilities, we can validate behavior continuously. A question that queries Azure AD for sign-in anomalies will always perform that same structured query, while autonomous components operate within defined guardrails. This predictability enables robust testing and validation that unconstrained autonomous agent architectures struggle to achieve.
Moving Beyond Tool Consolidation to Architectural Transformation
The industry conversation often focuses on tool consolidation as the solution to SOC complexity. While reducing from 83 tools to a more manageable number certainly helps, consolidation alone doesn't address the fundamental architecture challenge.
What's required is a shift from collection-based architectures (gather all data first, then analyze) to federation-based architectures (access data where it lives, when you need it). This shift removes the organizational prerequisite of massive data transformation projects before AI can deliver value.
Command Zero's federated model provides immediate access to comprehensive security telemetry without requiring organizations to tear down their existing infrastructure. We work with your current tools, your current data distribution, and your current team capabilities. This approach removes the organizational walls that prevent AI success without creating new dependencies.
The platform consolidation we provide isn't about replacing all your tools—it's about providing a unified investigation layer that works across all your tools. This architectural pattern enables AI capabilities to operate effectively in real-world enterprise environments rather than idealized greenfield deployments.
The Path Forward: Augmentation and Automation Through Intelligent Design
As the security industry continues to explore AI's potential, we're at a critical juncture. The path of maximum autonomy—AI agents making independent decisions with minimal structure—has shown significant limitations when applied to enterprise security operations. The high failure rates and governance challenges aren't temporary growing pains; they're signals that this architectural approach needs to be balanced with structured frameworks.
At Command Zero, we've chosen a balanced path: structured intelligence augmented by AI, combined with controlled autonomous capabilities where they add value. This hybrid approach delivers the productivity gains the industry seeks—investigations that complete in minutes rather than hours—while maintaining the transparency, governance, and reliability that security operations demand.
The future of AI in cybersecurity lies in democratizing expertise through intelligent augmentation and automation. The systems that will succeed are those that:
- Embed security knowledge into structured frameworks
- Use AI for navigation, acceleration, and accurate decision-making
- Maintain transparency and auditability at every step
- Optimize for consistency and reliability across analyst skill levels
- Integrate seamlessly into existing security operations workflows
The most successful AI implementations in security operations will be those that recognize AI as a powerful tool for both augmenting human expertise and automating appropriate tasks within structured frameworks—not as a wholesale replacement for human judgment or organizational architecture. The organizations seeing 79% productivity gains aren't those with the most sophisticated AI models. They're those who've removed the organizational walls preventing effective AI deployment while maintaining the governance and transparency that security requires.
As we continue to evolve Command Zero's platform, we remain focused on this architectural balance: leveraging AI's capabilities for pattern recognition, natural language understanding, intelligent suggestion, and autonomous action where appropriate—all while maintaining the deterministic, auditable, and governed framework that enterprise security demands. The transformation will be delivered via AI-augmented and autonomous frameworks that make every analyst as effective as the most experienced experts on the team.
The walls preventing AI success in security operations are real, but they're not insurmountable. They require architectural thinking, not just technological innovation. And they require recognizing that the goal isn't pure AI autonomy—it's AI-augmented and AI-automated human expertise operating at a scale and speed that neither could achieve alone.
