What is agentic AI?

What is agentic AI?

Agentic AI describes AI systems that act rather than only answer. Given a goal, an agent breaks it into steps, chooses which tools to call, reads what comes back and decides what to do next, repeating until the goal is met or it reaches a limit. Most current agents are built around a large language model that does the planning, connected to tools such as search, databases, ticketing systems, scripts and security product APIs, plus memory that carries context between steps. What sets an agent apart from a chatbot is that its output can be an action in a real system: a query run, a ticket opened, a session revoked.

How an agent works in a SOC

Suppose a triage agent receives an impossible-travel alert for a user. Its recorded steps might be:

1. Pull the user's sign-in history from the identity provider and find a sign-in from another country 40 minutes after one from the office.
2. Check the second address and find that it belongs to a hosting provider, not the company's VPN service.
3. Search the mail audit log and find a new inbox rule, created right after that sign-in, forwarding invoices to an outside address.
4. Write a summary with the evidence and propose revoking the user's sessions and deleting the rule.
5. Wait for an analyst's approval before calling the identity provider to revoke the sessions.

A SOAR playbook could call the same tools, but only in an order someone wrote in advance. The agent picks its own path, which lets it work alerts no playbook anticipated.

Risks agentic AI adds

• Unplanned actions. The flexibility that handles a new alert can also produce a harmful step, such as isolating a production server on thin evidence. Giving an agent more tools or rights than its task needs is called excessive agency.
• Prompt injection through data. Agents read emails, web pages, tickets and logs, and text planted in any of them can try to steer the agent. Everything it reads must be handled as data, never as instructions.
• Hallucinated reasoning. A confident but wrong conclusion becomes a wrong action rather than a wrong sentence.
• Concentrated privilege. An agent's credentials can reach many systems, and if they are stolen or misused they act at machine speed.
• Runaway loops that repeat calls without progress and run up cost.

Controls for agentic AI

Run the agent under its own service identity, with tokens that expire quickly and reach only the systems its task needs. List the tools it may call, starting with read-only ones, and make anything that changes state, such as disabling an account or blocking an address, wait for a person to approve it; this is often called keeping a human in the loop. Put ceilings on how many actions it can take, give operators a way to stop it at once, sandbox it where possible, and keep a full record of each tool call: what went in, what came back and why the agent said it chose that step.

Agentic AI vs. chatbots vs. SOAR

• Chatbot: answers questions and drafts text; a person decides what to do with the answer.
• SOAR playbook: runs actions across tools in a fixed, predefined order.
• Agentic AI: chooses and runs actions itself to reach a goal, within the limits it is given.

Agentic AI on the CompTIA Security+ exam

Agentic AI is new in SY0-801. It is one of the AI capabilities named in objective 4.6, alongside AI-augmented baselines, predictive analysis and chatbots, within automation and orchestration for security operations. A tool that investigates and acts through other systems on its own points to agentic AI. When an AI assistant should be able to look but never touch, the fix is read-only tool permissions; when one took a damaging step without anyone agreeing to it, the missing piece is an approval gate. Distractors include a chatbot, which only answers, and a SOAR playbook, which follows fixed steps. Attacks aimed at AI systems themselves, such as prompt injection, belong to the AI threats objective, 2.6.