How confident are you in letting AI agents take autonomous actions after a SIEM or XDR alert? Are you using them today? If not, what’s holding you back?

It's better to take a phased approach rather than shifting completely to autonomous actions right away. Start with automating repeatable tasks—like blocking known malicious IOCs detected on the network. Once that’s in place, you can move on to handling things like unauthorized scans or connection attempts. Often, the way an organization operates requires fine-tuning of SIEM and XDR tools to fully understand the business context and avoid false positives.

From My experience, teams are cautiously optimistic about letting AI take autonomous actions after SIEM or XDR alerts due to False positive. Some already use it for low-risk tasks like isolating endpoints, but full automation is often held back by fear of false positives, lack of trust, or compliance concerns. Its better to have Human in the loop 

Our customers are selectively using AI agents for niche use cases and majority are taking an augmented approach.

We still require human assisted actions.

AI tools have a certain error rate. Research your tool's range, and if you can afford those errors, go ahead. I generally check other non-AI tools as well, and if it matches, then I trust it.