How Agentic AI Can Boost Cyber Defense

Cyberattack volumes are driving organisations to automate triage and scoring, with Transurban among early adopters using agentic AI to aid its SOC analysts. According to Omdia's Cybersecurity Decision Maker Survey 2025, autonomous SOCs could become standard for CISOs within two years, a trajectory reflected in Transurban’s approach. Paracha explains the two-agent system, one for categorising incidents and the other for verifying resolution notes before closing tickets, with the human analyst retaining final say.

Since deploying in September, alert triage times have fallen by 60% and the model has achieved an accuracy rate of 92%, while maintaining a false positive rate of less than 3%. The solution integrates with Anthropic’s Claude, as well as Transurban’s Splunk SIEM, ServiceNow ticketing system, and AWS Bedrock, and is designed to traverse all incident and resolution nodes to ensure playbooks are followed.

Looking ahead, the team plans to incorporate external threat intelligence and automate triage and response processes using the MCP server to enable containment of impacted systems if needed.