Leidos Introduces Agentic SOC Automation to Help Security Teams Investigate Cyber Threats

Leidos has introduced Leidos Agentic SOC Automation, an artificial intelligence capability designed to help security operations centre (SOC) teams manage growing volumes of cyber alerts and identify threats that require immediate attention.

The capability, part of the company’s UpHold Effect™ offering, uses AI agents to investigate alerts, collect relevant information and prepare findings for human analysts. It is intended to operate continuously, helping security teams keep pace with increasingly automated cyber threats without surrendering control over operational decisions.

Why Leidos is bringing agentic AI into security operations

Security teams face a growing challenge: they must distinguish genuine threats from large volumes of alerts while adversaries increasingly use automation and AI to conduct and scale their attacks.

Investigating each alert can consume considerable analyst time. Delays in identifying serious incidents can give attackers more opportunity to compromise systems or disrupt operations.

Leidos says its new capability is designed to take on more of this investigative workload. AI agents can assess alerts, gather supporting context and organise their findings so analysts can concentrate on incidents that need human judgement.

The objective is not simply to automate security operations, but to help teams respond more efficiently while retaining oversight of how the technology is used.

How Leidos Agentic SOC Automation works

The system operates across an organisation’s existing security tools. Rather than requiring customers to replace their current security technology, it is designed to integrate with the systems already in place.

Its principal capabilities include:

Continuous alert investigation

AI agents can work around the clock to triage security alerts, collect relevant information and assemble investigation findings. Analysts can then review the results and determine whether further action is necessary.

Integration with existing security tools

The capability is designed to work within customers’ established security environments. This approach is intended to reduce the need for organisations to replace existing systems when introducing AI-assisted security operations.

Customer-controlled autonomy

Organisations determine the level of authority granted to the AI agents. Depending on their mission requirements, risk tolerance and governance policies, customers can decide whether the system is permitted to investigate alerts, recommend responses or take authorised actions.

This gives security teams control over how far automation extends into their operational processes.

Auditable recommendations and actions

The system maintains records of what the AI observed, how it reached its conclusions and what it recommended or did. These records are intended to provide visibility into the system’s decision-making and support operational accountability.

Federal deployment options and security requirements

Leidos says a FedRAMP Class D (High) deployment option is available for the capability.

The company also describes a potential pathway towards deployment in Department of War Impact Level 4 and Impact Level 5 environments, subject to appropriate government sponsorship.

These deployment options are relevant to federal organisations that must meet specific security and compliance requirements when adopting cloud-based and AI-enabled technologies.

The availability of a deployment option should not, however, be confused with confirmation that every implementation has received the relevant authorisation or approval.

Leidos highlights the importance of human control

Steve Hull, president of Leidos Digital, said security teams need to respond to threats more quickly without losing control over their operations.

“Cyber teams need to keep pace with threats without giving up control,” Hull said. “UpHold Effect™ Agentic SOC Automation can take on more of the investigative workload while giving agencies the flexibility to decide when AI recommends an action and when it is allowed to act.”

The company’s approach places emphasis on adjustable levels of autonomy, allowing customers to define which activities can be automated and which require human approval.

Building on Leidos’ cybersecurity operations experience

Leidos says it combines commercial AI technology with its cybersecurity expertise, including experience operating some of the government’s largest security operations centres.

The company will integrate and configure the capability according to each customer’s mission, security environment and governance requirements.

This reflects an approach in which AI automation is adapted to an organisation’s existing operational arrangements rather than deployed as a standalone replacement for its security infrastructure.

UpHold Effect is part of Leidos’ wider cyber product suite

Agentic SOC Automation is a feature within UpHold Effect™, Leidos’ offering for agentic cyber response. UpHold Effect is itself part of the company’s broader UpHold™ product suite.

The wider offering applies automation across several cybersecurity areas, including adversary detection, cyber deception, cloud security and threat hunting.

Leidos says the suite is designed to give customers control over governance and operational settings while using automation to support their cyber defence activities.

AI-assisted security operations aim to give analysts more time

With cyber teams facing growing alert volumes and increasingly automated threats, AI-assisted investigation is emerging as a way to help security operations centres manage their workload.

Leidos Agentic SOC Automation is designed to accelerate the investigation of alerts and help analysts focus on incidents that require human judgement. Its emphasis on integration, adjustable autonomy and auditable activity is intended to give organisations a way to introduce AI into security operations while retaining control over its use.

The practical value of the capability will depend on how effectively it integrates with individual security environments and how well its automated investigations support analysts’ decisions.

Click here to email Leidos Digital.