--- title: How SLED teams win with agentic AI cybersecurity | daily.dev description: State, local, and education (SLED) organizations are turning to agentic AI SOCs to counter AI-accelerated cyberattacks, where lateral movement now happens in... canonical: https://daily.dev/posts/how-sled-teams-win-with-agentic-ai-cybersecurity-descqiel2 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How SLED teams win with agentic AI cybersecurity | daily.dev og:description: State, local, and education (SLED) organizations are turning to agentic AI SOCs to counter AI-accelerated cyberattacks, where lateral movement now happens in... og:url: https://daily.dev/posts/how-sled-teams-win-with-agentic-ai-cybersecurity-descqiel2 og:image: https://api.daily.dev/og/posts/deScqIEl2.png og:image:alt: How SLED teams win with agentic AI cybersecurity og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How SLED teams win with agentic AI cybersecurity **[elastic](https://daily.dev/sources/elastic)** · 9 min read · 1 upvotes · 0 comments ## Summary State, local, and education (SLED) organizations are turning to agentic AI SOCs to counter AI-accelerated cyberattacks, where lateral movement now happens in under 30 minutes. Fragmented security tooling across agencies and campuses forces many SOCs to lose a full day weekly aggregating data manually. Elastic positions its agentic SOC, built on a data mesh architecture and human-in-the-lead approval model, as a way for small teams (from 3-person university SOCs to 60-person state agencies) to cut investigation times dramatically, citing customer examples from California EDD, Arizona DHS, Vrije Universiteit Brussel, and Texas A&M University System. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How fast are attackers moving from initial compromise to lateral movement now compared to before? The average time between initial compromise and lateral movement has fallen to just 29 minutes, a 65% increase in speed from the prior year, according to CrowdStrike's 2026 Global Threat Report. This compressed window means security teams have far less time to detect and contain an intrusion before it spreads across a network. _Teams racing to keep pace with faster breakouts can follow agentic SOC developments on daily.dev._ ### What does an agentic SOC do differently from traditional security automation? An agentic SOC uses AI agents that reason across changing information and adapt as an investigation develops, rather than following a fixed set of rules like traditional automation. Agents correlate alerts, investigate entities, and stage response plans, but present each plan to a human analyst for approval before taking consequential actions like isolating a host or disabling an account. _Security engineers evaluating agentic automation can track SOC tooling shifts on daily.dev._ ### How much time can a small university security team save using AI-driven security tools? Vrije Universiteit Brussel runs its entire security operation with just three engineers covering 64 billion events across more than 300 endpoints, and identified a rogue DHCP server disrupting the network within minutes rather than days. Texas A&M University System, spanning 11 universities and over 153,000 students, cut threat investigations from months down to two hours. _Understaffed security teams weighing AI-assisted monitoring can follow these outcomes on daily.dev._ ## Similar posts on daily.dev - [Agentic SOCs: The public sector’s new AI cybersecurity defense](https://daily.dev/posts/agentic-socs-the-public-sector-s-new-ai-cybersecurity-defense-ub90oxcvn) · elastic · 1 upvotes · 0 comments - [The Agentic SOC Is Already Here](https://daily.dev/posts/the-agentic-soc-is-already-here-jrpxkfz1n) · Security Boulevard · 0 upvotes · 0 comments - [Why the Agentic SOC Is the Only Model Built for Machine-Speed Attacks](https://daily.dev/posts/why-the-agentic-soc-is-the-only-model-built-for-machine-speed-attacks-dgkr9okux) · Arctic Wolf · 0 upvotes · 0 comments - [Why AI is failing in the security operations center](https://daily.dev/posts/why-ai-is-failing-in-the-security-operations-center-dogusx57g) · The New Stack · 0 upvotes · 0 comments - [The Agentic SOC – From AI Theater to Real Defense](https://daily.dev/posts/the-agentic-soc-from-ai-theater-to-real-defense-f2t95kiuh) · Recorded Future Blog · 5 upvotes · 1 comments --- Tags: [#elk](https://daily.dev/tags/elk), [#agentic-ai](https://daily.dev/tags/agentic-ai) [View this post on daily.dev](https://daily.dev/posts/how-sled-teams-win-with-agentic-ai-cybersecurity-descqiel2) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How SLED teams win with agentic AI cybersecurity","url":"https://daily.dev/posts/how-sled-teams-win-with-agentic-ai-cybersecurity-descqiel2","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-sled-teams-win-with-agentic-ai-cybersecurity-descqiel2"},"datePublished":"2026-08-21T17:02:08.212Z","dateModified":"2026-09-13T18:44:53.845Z","description":"State, local, and education (SLED) organizations are turning to agentic AI SOCs to counter AI-accelerated cyberattacks, where lateral movement now happens in...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1e290fe7b9944177c4026a25cbf60042?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1e290fe7b9944177c4026a25cbf60042?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"elastic","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"elastic","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/b9f4b44c864c42f68aa7f164715da8b4","url":"https://daily.dev/sources/elastic"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-sled-teams-win-with-agentic-ai-cybersecurity-descqiel2","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"elk,agentic-ai","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"elastic","item":"https://daily.dev/sources/elastic"},{"@type":"ListItem","position":3,"name":"How SLED teams win with agentic AI cybersecurity"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-sled-teams-win-with-agentic-ai-cybersecurity-descqiel2#faq","mainEntity":[{"@type":"Question","name":"How fast are attackers moving from initial compromise to lateral movement now compared to before?","acceptedAnswer":{"@type":"Answer","text":"The average time between initial compromise and lateral movement has fallen to just 29 minutes, a 65% increase in speed from the prior year, according to CrowdStrike's 2026 Global Threat Report. This compressed window means security teams have far less time to detect and contain an intrusion before it spreads across a network. Teams racing to keep pace with faster breakouts can follow agentic SOC developments on daily.dev."}},{"@type":"Question","name":"What does an agentic SOC do differently from traditional security automation?","acceptedAnswer":{"@type":"Answer","text":"An agentic SOC uses AI agents that reason across changing information and adapt as an investigation develops, rather than following a fixed set of rules like traditional automation. Agents correlate alerts, investigate entities, and stage response plans, but present each plan to a human analyst for approval before taking consequential actions like isolating a host or disabling an account. Security engineers evaluating agentic automation can track SOC tooling shifts on daily.dev."}},{"@type":"Question","name":"How much time can a small university security team save using AI-driven security tools?","acceptedAnswer":{"@type":"Answer","text":"Vrije Universiteit Brussel runs its entire security operation with just three engineers covering 64 billion events across more than 300 endpoints, and identified a rogue DHCP server disrupting the network within minutes rather than days. Texas A&M University System, spanning 11 universities and over 153,000 students, cut threat investigations from months down to two hours. Understaffed security teams weighing AI-assisted monitoring can follow these outcomes on daily.dev."}}]} ```