Sangfor A³ SecOps: Bridging the Gap to Agentic Security Operations

A practical framework for improving SecOps efficiency, effectiveness, and AI trustworthiness

Executive Summary

Security operations are no longer constrained by a lack of tools or data, but by the limitations of how work is still executed. As attacks increase in speed, scale, and sophistication, traditional human-led, AI-assisted workflows struggle to keep pace. Even with platform consolidation and AI augmentation, many organizations still struggle to balance three operational objectives: improving operational efficiency, enhancing security effectiveness, and building sufficient trust in machine-led execution.

This tension is pushing security operations toward a new direction, where AI moves beyond task-level assistance and begins to support more continuous, workflow-level execution. However, this model is still emerging, and most organizations are not yet in a position to operate in a fully agentic manner.

Sangfor Athena A³ SecOps is designed as a practical path toward this future state. Built around AI Agent, Automation, and Active operational support, it combines AI-driven reasoning, automated execution, and managed services to strengthen detection and response while progressively reducing manual coordination. In doing so, it helps organizations move from reactive and human-intensive operations toward an execution-driven, context-aware, and trustworthy agentic security operating model.

In practice, Athena A³ SecOps delivers measurable improvements across the security lifecycle, including faster threat discovery and response, lower alert and workload volumes, broader automation coverage, and reduced operational cost.

1. The Maturity Gap: Why SecOps Must Evolve to the Agentic Model

Organizations are at very different stages of security operations (SecOps) maturity, but the direction of travel is clear. Each stage improves on the last, yet each also exposes a new limiting factor. The result is that most organizations still cannot operate security at the speed, scale, and consistency required by modern threats.

Stage 1: Siloed SecOps

In the earliest stage of security operations, organizations rely on independently deployed point products with limited visibility and coordination. Security teams navigate multiple dashboards, contend with noisy, low-fidelity alerts, and struggle to detect advanced threats.

Core limitation: Security operations are fragmented, reactive, and too slow to keep pace with modern attacks.

Stage 2: SIEM-Centric SecOps

To address fragmentation, organizations centralize logs and correlation rules within a SIEM platform, improving visibility and standardization. However, this introduces burdens in data normalization and rule maintenance, and detection quality remains dependent on ongoing analyst expertise and availability.

Core limitation: Security is more centralized, but still heavily dependent on manual engineering and analyst-driven execution.

Stage 3: AI-Assisted Security Operations

Organizations then introduce AI to assist with investigation, threat hunting, and incident response. This improves productivity, but the operating model remains fundamentally unchanged. AI acts as a copilot: it can summarize, recommend, and accelerate tasks, but humans still initiate workflows, validate outputs, and execute critical actions.

Core limitation: AI improves assistance, but not autonomy. Security operations remain human-led.

The SecOps Trilemma

Even after progressing to Stage 3, organizations still cannot achieve three operational objectives at the same time:

Increase operational efficiency
Enhance security effectiveness
Build trust in AI-driven decisions and actions

Existing models force trade-offs between these objectives. Improving efficiency often comes at the cost of analytical depth, control, or confidence. Improving effectiveness usually requires more human effort. AI can accelerate and improve key SecOps tasks, but machine-generated conclusions and actions still require assurance, validation, and human accountability before critical actions are taken.

This is why the current generation of AI-assisted SecOps platforms still leaves organizations exposed to successful breaches, overworked security teams, and slow or inconsistent response. The decisive limitation is not simply data, tooling, or analytical capability, but the execution model itself.

Source: Sangfor

Stage 4: Agentic SecOps

Agentic SecOps represents the next stage by fundamentally changing the execution model. Instead of remaining human-led and AI-assisted, SecOps becomes AI-led and human-supervised. In this model, AI is not merely an assistant but an operational actor that can interpret objectives, decompose tasks, invoke tools, retain context, validate outcomes, and carry workflows forward under policy constraints.

This shift matters because it is the first model with the potential to address all three operational objectives together. It reduces human dependency by enabling AI to execute significant portions of workflows, improves effectiveness through faster, more accurate operations, and strengthens trust through controlled autonomy and validation under human oversight.

Source: Sangfor

Why Agentic SecOps Is Different

Agentic SecOps addresses the SecOps Trilemma not simply because it uses stronger AI, but because it changes the execution model. AI-assisted SecOps improves individual tasks within human-led workflows, while Agentic SecOps enables AI-led, human-supervised execution across multi-step workflows. The comparison below highlights how this shift changes SecOps in practice:

Comparison Dimension	AI-Assisted SecOps	Agentic SecOps
Operational Efficiency	AI accelerates individual tasks, but analysts still initiate workflows, switch between tools, interpret outputs, and coordinate execution. Efficiency gains are limited because the overall process remains dependent on manual handoffs.	Agents interpret security objectives, determine next steps, invoke tools, and maintain context across the workflow. By acting on objectives rather than predefined task instructions alone, agents can carry work forward with less manual coordination, while humans remain focused on oversight and exceptions.
Security Effectiveness	AI helps analyze and prioritize signals, but it does not consistently drive investigation from detection through validation and response. Analysts must still correlate evidence, determine intent, and decide whether action is required.	Agents reason across evidence, retain context, adapt as new information emerges, and validate findings before action. This enables more complete, context-aware threat assessment and response.
Trust	AI outputs are advisory. Before high-impact decisions or actions are taken, humans must still validate conclusions, assess risk, and remain accountable for the outcome.	Trust is built through cybersecurity-specific training, business context awareness, policy constraints, validation checkpoints, auditability, and feedback from experts and users. This makes AI-driven decisions and actions easier to supervise, verify, and adopt.

2. Sangfor Athena A³ SecOps

Agentic SecOps represents the direction in which security operations is evolving, but most platforms today are still progressing toward this model rather than fully operating as one.

Athena A³ SecOps defines Sangfor’s operating model for this transition, providing a structured path toward agentic security operations.

In its current form, Athena A³ SecOps is defined by three key characteristics:

AI Agent — for contextual reasoning
AI supports analysis and decision-making at the task level, with some multi-step coordination.
Automation — for scalable execution
Predefined rules enable consistent and scalable execution but still require human-defined logic and intervention for exceptions.
Active — operational support for continuous assurance
MDR services provide continuous monitoring, investigation, and response support.

In this form, Athena A³ SecOps represents an intermediate stage of maturity, positioned between AI-assisted and fully agentic operations (Stage 3.5).

Source: Sangfor

These capabilities establish the foundation for further evolution. As they mature and become more tightly integrated, the model progresses toward a more advanced stage (Stage 4), characterized by:

Agentic — AI agents move from task-level assistance to coordinated, multi-step workflow execution.
Autonomous — AI agents operate against defined goals, proactively gathers context, and executes actions with minimal manual coordination under supervision.
Adaptive — The system continuously improves decisions and actions based on operational context, analyst feedback, and real-world outcomes.

2.1 AI Agent Framework

Athena A³ SecOps is built around three key elements: AI Agent, Automation, and Active. Within this model, the AI Agent Framework operationalizes the AI Agent and Automation capabilities through AI-driven reasoning with automated execution.

Security workflows are structured around specialized AI agents that support different stages of the SecOps process, from ingestion through analysis, investigation, and response.

Source: Sangfor

2.2.2 Data Parsing Agent

Data parsing transforms raw telemetry from diverse sources into structured, usable data that underpins downstream SecOps workflows. Without consistent and high-quality data, detection, triage, investigation, and response are limited.

Pain Points
Data parsing faces three recurring challenges. First, heterogeneous and custom logs often require manual parser creation and maintenance. Second, static parsing rules can break when log formats or fields change, creating downstream gaps in detection and investigation. Third, teams often lack visibility into which data is valuable for security analysis, leading to unnecessary ingestion, high data storage cost, false positives, and additional workload.

Sangfor Solution

Source: Sangfor

AI-driven automated parsing within hours
To reduce the burden of manual parser creation, the Data Parsing Agent automatically analyzes collected sample data, identifies log formats, maps fields, and generates parsing rules. This allows unsupported or custom data sources to be onboarded far more quickly than traditional manual parser development. Data source onboarding that typically takes weeks or months can be completed in hours, accelerating access to usable telemetry while reducing operational effort.

Continuous adaptive parsing through re-identification and re-mapping
To prevent parsing gaps caused by changes in log formats or fields, the Data Parsing Agent continuously updates parsing logic through automated re-identification and field re-mapping. When source data changes, the agent re-evaluates the structure, updates the mapping, and keeps telemetry normalized and usable. This preserves data quality over time and prevents format changes from degrading detection, triage, and investigation workflows.

Standardized data quality classification
To help organizations understand whether ingested data is ready for advanced security analysis, A³ SecOps classifies telemetry into three levels of readiness:

Level 1: Basic log parsing
Level 2: Alert aggregation, fusion, and false positive suppression
Level 3: Advanced detection, correlation, and attack chain reconstruction

This classification gives security teams clear visibility into data readiness. Instead of ingesting all available data without knowing its analytical value, teams can identify telemetry gaps, prioritize onboarding or optimization of specific data sources, reduce unnecessary ingestion, and align detection and response capabilities with the quality of data available.

2.2.2 Threat Detection Agent

Threat detection identifies potentially malicious activity across users, endpoints, networks, and applications, and surfaces findings as alerts for triage and investigation. Its effectiveness determines how early threats are discovered and how accurately they are distinguished from normal behavior.

Pain Points
Threat detection faces two persistent challenges. First, anomaly-driven approaches often lack sufficient pre-alert validation, causing benign deviations from normal behavior to be surfaced as alerts that require analyst review and tuning. Second, once suspicious signals are surfaced, rule-based and ML-based detection may still be unable to confirm whether the activity is truly malicious, leaving analysts to validate intent before action can be taken.

Sangfor Solution

Source: Sangfor

Noise reduction through baseline-based validation
To reduce noise before suspicious behavior becomes an alert, A³ SecOps uses an AI-driven validation framework to determine whether anomalous activity should be surfaced at all. Deviations from normal behavior are not immediately treated as threats. Instead, the Threat Detection Agent evaluates them against baseline context, deep traffic inspection, known attack patterns, and threat intelligence. This pre-alert validation filters out benign anomalies before they reach analysts, cutting noise from 15%–30% to 1%–2%.

Malicious intent confirmation through investigation-based detection
To determine whether suspicious signals represent real malicious activity, the Threat Detection Agent performs AI-driven, “investigation-based” detection. Instead of stopping at anomaly or pattern recognition, the agent conducts multi-step investigation, invokes relevant tools, correlates findings across multiple dimensions, and synthesizes results into a final threat assessment. This mirrors the investigative workflow of cybersecurity experts and helps confirm whether suspicious activity is actually an attack. This investigative approach improves overall detection accuracy from 40%–60% to over 90%.

In traffic scenarios, the agent orchestrates investigative tools such as protocol decoding, threat intelligence lookups, and active probing. It correlates signals across network and endpoint layers to conduct contextual analysis, in-depth investigation, and digital forensics, enabling more accurate confirmation of malicious activity.

In phishing scenarios involving QR codes, the agent decodes embedded content, extracts URLs, performs threat intelligence lookups, analyzes behavioral patterns, and inspects underlying code before forming a conclusion.

2.2.3 Alert Triage Agent

Alert triage determines whether incoming alerts and detection outputs represent real security incidents and prioritizes them for action. It is the decision point between surfaced alerts and actionable incident response.

Pain Points
Alert triage faces two recurring challenges. First, alerts from integrated security tools are often treated as conclusions even though they may contain false positives, leading to unreliable analysis. Second, advanced threats can hide across low- and medium-severity alerts that are ignored or deprioritized by conventional triage workflows.

Sangfor Solution

Source: Sangfor

Alert validation through AI-driven secondary analysis
To improve alert reliability before incident determination, the Alert Triage Agent treats alerts as inputs rather than conclusions. It performs AI-driven secondary analysis against underlying activity and behavioral context, validating whether the alert reflects genuinely suspicious behavior before it is used for triage. This reduces reliance on the original alert verdict and improves the quality of downstream investigation.

Incident reconstruction across low- and medium-severity signals
To detect advanced threats that hide beneath high-severity thresholds, the Alert Triage Agent reasons across fragmented alerts rather than prioritizing only obvious high-severity events. It consolidates alerts from the same attack source and target asset into a unified view, then analyzes relationships across time sequence, occurrence frequency, behavioral characteristics, and cross-layer telemetry from network and endpoint sources.

By reasoning across low- and medium-severity signals, the agent determines whether they collectively indicate a coordinated attack and elevates them into a single high-confidence incident. This produces more conclusive, context-rich triage outcomes, enabling analysts to make faster and more consistent decisions without manually reconstructing fragmented alerts from scratch.

2.2.4 Incident Response Agent

Incident response focuses on containing threats and minimizing business impact once an incident has been confirmed. Its effectiveness depends on how accurately actions are determined and how reliably they are executed.

Pain Points
Conventional SOAR workflows trigger actions based on predefined conditions, often without considering asset criticality, access relationships, behavioral patterns, or business impact. This can lead to incomplete, inappropriate, or disruptive actions, making organizations cautious about enabling full automation in live business environments.

Sangfor Solution

Source: Sangfor

Context-aware response decisioning
To determine whether remediation is needed and how it should be applied, the Incident Response Agent evaluates multi-dimensional context before response actions are executed. This includes factors such as asset criticality, access relationships, behavioral patterns, and potential business impact. By adding an AI decisioning layer before execution, A³ SecOps helps ensure that response actions are appropriate to the incident and less likely to create unnecessary disruption.

Controlled adoption of automated response
To help organizations adopt automated response with greater confidence, A³ SecOps provides Observation Mode and Mitigation Mode. In Observation Mode, the platform recommends response actions without executing them, allowing analysts to review and validate the proposed actions. Once the recommendations and policies have been validated, Mitigation Mode enables automated execution based on AI analysis and user-defined policies. This allows organizations to move toward automated response progressively while maintaining control over risk and business impact.

2.2.5 Learning Agent

Continuous learning is essential to improving the accuracy, consistency, and reliability of AI-driven SecOps. It enables the system to incorporate domain knowledge, adapt to business context, and improve through real-world operational feedback.

Pain Points
AI-driven SecOps faces three recurring learning challenges. Generic AI often lacks the security-specific domain knowledge required for high-confidence security operations. Even when AI understands security concepts, it may not consistently perform SecOps-specific tasks such as alert analysis, incident summarization, threat assessment, or response recommendation. Many AI models also operate as closed-box systems that do not easily incorporate business context, analyst judgment, or real-world operational feedback, making it harder to adapt to the customer’s environment over time.

Sangfor Solution
The Learning Agent improves reliability through a three-phase learning framework: domain knowledge pre-training, task instruction fine-tuning, and reinforcement learning.

Source: Sangfor

Domain knowledge pre-training for security-specific reliability
To move beyond generic AI, A³ SecOps’ agents are trained on cybersecurity domain knowledge, security expert knowledge, and high-quality labeled data. This gives the model a stronger foundation in attack techniques, security terminology, telemetry patterns, investigation logic, and response concepts, helping it produce more accurate, consistent, and security-relevant outputs from the outset.

Task instruction fine-tuning for SecOps-specific execution
To improve consistency across operational tasks, agents are fine-tuned on SecOps-specific instructions and validated examples. This teaches the models how to perform tasks such as alert analysis, incident summarization, threat assessment, investigation reasoning, and response recommendation in a structured and repeatable way.

In real-world operations, MDR experts continuously validate and correct incorrect or uncertain outputs. These corrections are fed back to the Learning Agent through data labeling and task refinement, reducing hallucination rates to below 0.1% and steadily improving consistency and trustworthiness over time.

Reinforcement learning for business-context-aware optimization
To improve judgment within the customer’s actual operating environment, A³ SecOps learns from both observed business behavior and validated user feedback. The platform can automatically identify assets such as DNS and proxy servers based on traffic behavior, and retrospectively analyze alert logs to identify likely business-induced false positives.

These findings are then verified by analysts through data labeling and investigation review before being incorporated into the Learning Agent’s investigation knowledge base. By turning verified feedback, investigation results, and operational outcomes into reusable knowledge, the Learning Agent can better distinguish legitimate business activity from malicious behavior, improve business impact assessment, reduce false alerts, and help analyst expertise accumulate over time.

2.3 Athena A³ SecOps Components

This section maps the Athena A³ SecOps operating model to the components that implement it. Together, these components provide the data foundation, AI reasoning layer, and operational execution needed to run agent-driven security workflows.

Component Overview

Athena XDR — Unified data and execution layer for data ingestion, cross-domain correlation, and automated response.
Security GPT — AI reasoning layer for threat analysis, decision-making, and workflow orchestration.
Athena MDR — Managed service layer providing continuous monitoring, expert investigation, and response support.

AI Agent and Automation capabilities are delivered through the interaction between Security GPT and Athena XDR, while Active is delivered through Athena MDR for continuous expert oversight and operational support.

Athena EPP / NGFW / NDR — Native endpoint and network tools integrated with XDR and MDR, providing higher-fidelity telemetry and enabling direct response execution.
Third-Party Security Tools — Integrated tools that extend alert coverage and response enforcement across heterogeneous environments.

Source: Sangfor

3. Benefits and Outcomes

The shift to Athena A³ SecOps delivers transformative value across three core dimensions:

Category	Metric	Traditional SOC	Athena A³ SecOps	Benefits & Outcomes
Technical Performance	Threat Discovery Time	Hours to Days.	1–5 Minutes	10–100x faster discovery
	Threat Containment Time	Hours to Days	Under 10 Minutes	6–144x faster containment
	False Positive Reduction	15–30% false positives	1–2% false positives	Up to 90%+ reduction in false positives
	Automated Workflow Coverage	<10% Coverage	50–90% Coverage	5–9x increase in automation
Business Value	Business Disruption Window	Days to Months	<0.5 Days	>90% reduction in business impact
Business Value	Analyst Productivity	4–8 hrs / investigation	10–15 min / investigation	16–48x faster investigation

4. Conclusion

The limiting factor in modern security operations is no longer technology, but how that technology is used. As threats evolve in speed and complexity, human-led, AI-assisted workflows cannot simultaneously deliver the efficiency, effectiveness, and trust required for modern defense.

The transition toward agentic SecOps addresses this gap by shifting from task-level assistance to workflow-level execution. However, this model is still emerging, and most organizations are not yet able to fully operate in an agentic manner.

Sangfor Athena A³ SecOps provides a practical path forward. By combining AI agents, automation, and active operational support, it enables organizations to enhance operational efficiency, improve detection and response outcomes, and build greater confidence in AI-driven operations—while progressively evolving toward a more agentic execution model.

Source: Sangfor

Return to Home