The teams building their own agentic SOC already wrote the spec

Over the past eight months, security teams at Databricks, Salesforce, WRITER, Box, and Coinbase have published detailed accounts of building their own agentic security operations. None of them coordinated, and all of them arrived at the same architecture.

Part of what made the surge possible is tooling. Agentic coding tools like Claude Code turned practitioners with deep systems knowledge into builders, and security teams were among the first to act on it. Read the build reports together and they stop being individual war stories. They become a specification.

The build reports

Databricks published the most detailed account: 17 source-specific triage agents with deterministic filtering up front and a shared threat intelligence agent for enrichment. Every low-severity alert now gets triaged automatically, at a 10x higher true-positive rate than their high and medium escalations, saving more than 6,500 analyst hours in the first 30 days. Their first attempt used a single general agent, and it failed because triage context is source-specific.

Salesforce built SATA Agent as the first line of triage for its detection and response team, testing it against historical cases before production and measuring roughly 95% agreement with human analyst decisions.

WRITER, the enterprise AI company, built and open-sourced Cerebro after calculating a roughly 2% signal rate across their cloud security alerts. Their first version handed findings to a model with an instruction to triage them, and the model complied with confident answers that were frequently wrong. The fix was structural: the agent must retrieve evidence before it decides, output a needs_human_review verdict when evidence is missing, and produce schema-driven results with confidence scores and citations back to source tools.

Box has been at it for a while. CISO Heather Gaylor described the program on the AI Security Podcast: after nearly a year of work, AI triages roughly 38% of the company's tier one alerts, with humans heavily in the loop at the start and confidence accumulating as the agent's calls matched what analysts would have done.

The pattern extends past alert triage. Coinbase's Protocol Security team spent months on a first AI auditing system that underperformed before the lessons produced Frosty, a fully autonomous multi-phase agent that now reviews every smart contract before deployment. The Ethereum Foundation's Protocol Security team ran coordinated agents against protocol code, found a CVE, and titled their writeup "the triage is the product," because the hard work was separating real findings from confident noise. Anthropic's own security team published the same conclusion about its internal triage system, CLUE, which we covered in a separate post.

What every build converged on

Strip away the company names and the designs are nearly interchangeable.

Deterministic logic runs before the model. Databricks filters known-benign patterns upstream of any agent. WRITER validates evidence requirements in code. The model reasons only where reasoning is needed.

Evidence comes before verdicts. Every team learned, usually the hard way, that a model asked to triage without retrieval produces plausible fiction. The architecture that survives forces the agent to gather telemetry, logs, and context first, and to abstain when it cannot.

Context is environment-specific. A general security agent failed at Databricks. Box spent months encoding what normal looks like in their environment. The value of the agent lives in the specificity of what it knows about your infrastructure.

Outputs are structured and auditable. Schema-driven verdicts, confidence scores, evidence citations, and a full trail of every decision. WRITER found quality improved immediately when outputs became testable. Salesforce built governance around aggregate review.

Humans gate by confidence. Every production system keeps people in the loop, with autonomy expanding only where measured agreement justifies it. Salesforce routes lower-confidence verdicts to analysts and spot-checks automated outcomes. Box is approaching removal of the human for inconsequential decisions after a year of accumulated evidence. Nobody started there.

The builders stated their purchasing criteria too

Gaylor did the market a favor by saying the quiet part out loud. Box buys a security tool only when a vendor is doing the job materially better than her team could, or when the vendor has built "something my team can't vibe code in a couple of weeks." She called going all in on a single platform right now a probable mistake, and when the hosts described wanting vendors to supply composable pieces her team could assemble into its own workflow rather than a sealed product, she agreed that this is the model Box is moving toward.

She also drew the boundary of the build. Box will never build its own identity provider, its own password manager, or its own malware scanning corpus. The infrastructure layer stays bought. The logic layer gets built.

The maintenance bill arrives later

Every team in this corpus shares a trait that rarely gets stated: they can afford to own what they built. Databricks runs its triage fleet on the company's own commercial data platform, operated by a team that ships production streaming pipelines for a living. Coinbase standardized hosting, observability, testing, and audit into internal paved roads before scaling its agents, and still discarded its first auditing system entirely. These are engineering organizations building on engineering budgets.

The build is the cheap part. Agentic coding tools compress a triage agent from a quarter of work into a weekend, which is exactly why Gaylor's two-week test exists. What the tools do not compress is ownership. An internal agent that touches production telemetry becomes a service the moment it ships: it needs an on-call owner, re-evaluation against every model version bump, re-tuning as detection sources change, and a data pipeline that keeps feeding it. The Ethereum Foundation was blunt about the churn, noting that any specific agent tooling setup goes out of date within weeks. Gaylor said the same about the problem itself, which shifts faster than an annual security plan can track.

Security has run this experiment before. Twenty years ago every serious company racked its own servers, and the teams with the most engineering talent were the proudest of their datacenters. The economics did not care. Undifferentiated infrastructure moved to the cloud because maintaining it consumed the teams that owned it, and the valuable work moved up a layer. Agentic security operations is repeating that migration at higher speed. The logic that encodes your environment appreciates over time. The plumbing underneath it depreciates from the day it ships, and vibe coded plumbing depreciates fastest.

An agent can only reason about what it can reach

Ownership of the plumbing is one advantage these teams hold. Access is the other. The constraint in agentic security operations has moved from model reasoning to tool surface, and the build reports show it plainly. Anthropic's CLUE works because Claude connects by tool use to Slack, internal context the team credits with making alerts interpretable at all. Even then, the published account stops at triage and investigation, with response actions left out of scope. Salesforce found case data alone insufficient for accurate verdicts and gave SATA direct query access to logs and operational systems. Databricks agents sit on a lakehouse holding petabytes of raw security telemetry. In every build, the agent got smarter because its surface got wider, and the surface got wider because the team owned it.

Most security stacks refuse that widening. A commercial security tool typically exposes the API its dashboard needed: summarized alerts in place of raw telemetry, rate limits sized for a human clicking, broad read access paired with a short list of response verbs, and egress fees on data you already paid to collect. One practitioner built a triage platform on CrowdStrike’s MCP server and still had to drop down to the raw SDK for response sessions the API did not model. An agent assembled on surfaces like these can reason brilliantly about a keyhole view and act through a narrower one.

Gaylor made a version of this point about the development lifecycle: security outputs have always been designed for humans to consume, and now that agents write the code, any output an agent cannot read leaves security with no place in the process. The same logic applies to the security stack itself. A tool built to render screens for analysts caps what any agent running on top of it can see and do, no matter how capable the model behind it becomes.

The convergence is the spec

Put the pieces together and the conclusion follows. The layer worth building is the one that encodes your environment: your baselines, your false-positive patterns, your escalation logic, your judgment. The layer worth buying is the substrate underneath it: raw telemetry access instead of dashboard summaries, a deterministic rule engine, an API surface that covers every capability including response, an audit trail on every action, and the freedom to run whatever model you choose without paying a markup on tokens.

That substrate is what LimaCharlie is. Every capability in the platform is reachable through the API and the CLI, which is also the default path for connecting Claude Code to a live security environment. Raw telemetry stays queryable rather than summarized behind a dashboard, and response actions travel the same surface as reads, so an agent sees and does what a human operator sees and does. Detection logic is code. Every agent action lands in an immutable audit trail. And because the platform takes no markup on inference, teams route work across models the way Coinbase's engineers do, on capability and price.

For teams that want the convergent architecture without spending a year on the trust calibration loop that Box, WRITER, Salesforce, and others each rebuilt by hand, Grid runs that loop as a product. Grid's forward deployed engineer is an AI agent that builds and supervises worker agents inside a charter defining behavior and cost boundaries, operating as a parallel pipeline alongside your existing stack. The evidence-before-verdict discipline, the confidence gating, the audit trail: the properties every internal build converged on are the properties Grid enforces by construction.

The teams publishing these build reports had dedicated engineering staff, a year to spend on discovery, and the budget to carry what they built afterward. Their conclusions are now public, and they read as requirements. Whether you assemble the architecture yourself with Claude Code and the LimaCharlie CLI, or hand the loop to Grid, the spec has already been written by the people who have done it, and the substrate they all assumed is the part you should never have to maintain.