◆ For SOC teams: analysts, responders, managers, CISOs
Your SOC agent will be fooled one day.
With ZIFFER, it cannot act on it.
Intelligence stays with the agent. Authority does not. Every response runs through the rule you signed, or through two named analysts.
◆ For SOC teams: analysts, responders, managers, CISOs
Your SOC agent will be fooled one day. With ZIFFER, it cannot act on it.
Intelligence stays with the agent. Authority does not. Every response runs through the rule you signed, or through two named analysts.
Where the industry stopped
The industry let the agent think. It never let it act.
Three years of AI in the SOC. Triage automated. Investigation automated. The response is still a human click, and the reason is not caution. It is fear, and it is justified.
The fear has a name.
- The alert the agent reads is written, in part, by the attacker. Two MDR teams reproduced it in their own SOCs in 2025: a hidden instruction in a log made the AI summary whitelist a live intrusion (Sygnia, 2025-08); a rewritten Windows event field changed the hostname in the SIEM summary (SpiderLabs, 2025-09). DEF CON 34, 2026-08: “every one of those agents reads logs whose contents are, in large part, written by attackers.”
- The vendors wire the verdict to the action. One SOC platform's own documentation, updated 2026-09-22: auto-isolate a host if the verdict is Malicious; the approval step is optional.
- A wrong action on the domain controller is the outage. UK NCSC, 2026-09-21: a board sees “little difference between a DoS attack” and “a poorly implemented action by the cyber defence team”.
The fear has a price.
- Breakout: 29 min average, 27 s fastest. CrowdStrike Global Threat Report 2026. Three years ago it was 62 min.
- A response loop measured in hours against an attacker measured in minutes. Breach lifecycle: 241 days. IBM Cost of a Data Breach 2025.
- 47% of the people in the loop are overwhelmed by the workload. ISC2 Workforce Study 2025.
| What was asked | Answer | Source, sample, date |
|---|---|---|
| Do you use AI or ML tools in the SOC? | 79% yes; 36% in a defined workflow | SANS SOC Survey 2026, n=444, 2026-06 |
| Do you use AI to investigate? To respond? | 33% investigate; 26% respond | SANS AI Survey 2025, 2025-09 |
| Do you let AI remediate with nobody in the path? | 14% | Darktrace, State of AI Cybersecurity 2026, vendor survey, n=1,500, 2026-02 |
| Who executes what the AI recommends? | 44% a human; 30% auto for low risk only; 0% full autonomy | Prophet Security, vendor survey, n=250, 2026-08 |
| Do you review every AI verdict before closing? | 57% yes | same |
| Do you trust AI completely for mission-critical tasks? | 11% | Splunk and Cisco, State of Security 2025, vendor survey, n=2,058, 2025-05 |
| Biggest barrier to more automation? | 52% lack of trust in automated decisions | Kai and Wakefield, CISO survey, n=500, 2026-07 |
Seven answers from six surveys. Vendor-run surveys are marked in the source column.
Six surveys, three years, one answer. Nobody trusts the agent with the action, and nobody has fixed it.
The industry was right not to trust the agent with the action. It was wrong to think the fix was a smarter agent.
Where the industry stopped
The industry let the agent think. It never let it act.
Three years of AI in the SOC. Triage automated. Investigation automated. The response is still a human click, and the reason is not caution. It is fear, and it is justified.
The fear has a name.
- The alert the agent reads is written, in part, by the attacker. Two MDR teams reproduced it in their own SOCs in 2025: a hidden instruction in a log made the AI summary whitelist a live intrusion (Sygnia, 2025-08); a rewritten Windows event field changed the hostname in the SIEM summary (SpiderLabs, 2025-09). DEF CON 34, 2026-08: “every one of those agents reads logs whose contents are, in large part, written by attackers.”
- The vendors wire the verdict to the action. One SOC platform's own documentation, updated 2026-09-22: auto-isolate a host if the verdict is Malicious; the approval step is optional.
- A wrong action on the domain controller is the outage. UK NCSC, 2026-09-21: a board sees “little difference between a DoS attack” and “a poorly implemented action by the cyber defence team”.
The fear has a price.
- Breakout: 29 min average, 27 s fastest. CrowdStrike Global Threat Report 2026. Three years ago it was 62 min.
- A response loop measured in hours against an attacker measured in minutes. Breach lifecycle: 241 days. IBM Cost of a Data Breach 2025.
- 47% of the people in the loop are overwhelmed by the workload. ISC2 Workforce Study 2025.
- Do you use AI or ML tools in the SOC?79% yes; 36% in a defined workflowSANS SOC Survey 2026, n=444, 2026-06
- Do you use AI to investigate? To respond?33% investigate; 26% respondSANS AI Survey 2025, 2025-09
- Do you let AI remediate with nobody in the path?14%Darktrace, State of AI Cybersecurity 2026, vendor survey, n=1,500, 2026-02
- Who executes what the AI recommends?44% a human; 30% auto for low risk only; 0% full autonomyProphet Security, vendor survey, n=250, 2026-08
- Do you review every AI verdict before closing?57% yessame
- Do you trust AI completely for mission-critical tasks?11%Splunk and Cisco, State of Security 2025, vendor survey, n=2,058, 2025-05
- Biggest barrier to more automation?52% lack of trust in automated decisionsKai and Wakefield, CISO survey, n=500, 2026-07
Seven answers from six surveys. Vendor-run surveys are marked in the source column.
Six surveys, three years, one answer. Nobody trusts the agent with the action, and nobody has fixed it.
The industry was right not to trust the agent with the action. It was wrong to think the fix was a smarter agent.
The missing piece
Take the authority out of the agent. Leave the intelligence in.
The agent reads, correlates and proposes. That is where its duty ends. What runs is decided by the rule you signed before the shift, and by two named analysts for anything that could hurt.
Intelligence stays in the agent. Authority lives in your code, on a receipt. ZIFFER holds no credential and calls no tool.
- rule
- Signed by two different people in your repository before the shift. Tier of the asset, reversibility of the action, hold length, who may sign.
- quorum
- Two named analysts, passkeys, a summary rendered from the signed proposal bytes and not from the agent's words.
- receipt
- Signed, verified offline by your own code before your tool is called with your own credential. ZIFFER holds no credential.
Intelligence stays with the agent. Authority does not.
The missing piece
Take the authority out of the agent. Leave the intelligence in.
The agent reads, correlates and proposes. That is where its duty ends. What runs is decided by the rule you signed before the shift, and by two named analysts for anything that could hurt.
Intelligence stays in the agent. Authority lives in your code, on a receipt. ZIFFER holds no credential and calls no tool.
- rule
- Signed by two different people in your repository before the shift. Tier of the asset, reversibility of the action, hold length, who may sign.
- quorum
- Two named analysts, passkeys, a summary rendered from the signed proposal bytes and not from the agent's words.
- receipt
- Signed, verified offline by your own code before your tool is called with your own credential. ZIFFER holds no credential.
Intelligence stays with the agent. Authority does not.
What the standards already say
The rule is not new. Only the agent is.
| They wrote | Who, when | ZIFFER's mechanism |
|---|---|---|
| “Least-disruptive actions include initiating requests for human responses.” | NIST SP 800-53 rev 5, SI-4(7) | the quorum, then the hold |
| Changes “cannot occur unless two qualified individuals approve and implement such changes.” | NIST SP 800-53 rev 5, CM-5(4), dual authorization | quorum 2-of-2 |
| “Human-in-the-loop: humans approve actions before they happen.” | UK NCSC, interim guidance on agentic AI, 2026-08-20 | the receipt comes before the action, never after |
| “Technology is behind the detection, but humans respond with actions.” / “someone needs to be responsible for the action taken” | UK NCSC, 2026-09-21 | named signers on every HIGH action |
| “Require human oversight mechanisms, including approval steps and intervention points for high-risk actions, auditing, and reversibility following task execution.” | CISA, NSA, ASD, NCSC and partners, Careful Adoption of Agentic AI Services, 2026-05-01 | grade, quorum, receipt, reversibility class |
| “The responsibility for initiating an action must rest with people, not the model.” | SANS, Christopher Crowley, 2026-01-07 | the agent proposes; it never holds the credential |
| “Documented change approval by authorized parties.” | PCI DSS v4.0.1, 6.5.1 | the receipt is the document |
| “A process is in place to approve system changes prior to implementation.” | SOC 2, CC8.1 | the rule and the receipt |
Every standard asked for a named human before the action. ZIFFER is the first place the agent cannot skip one.
What the standards already say
The rule is not new. Only the agent is.
- “Least-disruptive actions include initiating requests for human responses.”NIST SP 800-53 rev 5, SI-4(7)ZIFFER's mechanismthe quorum, then the hold
- Changes “cannot occur unless two qualified individuals approve and implement such changes.”NIST SP 800-53 rev 5, CM-5(4), dual authorizationZIFFER's mechanismquorum 2-of-2
- “Human-in-the-loop: humans approve actions before they happen.”UK NCSC, interim guidance on agentic AI, 2026-08-20ZIFFER's mechanismthe receipt comes before the action, never after
- “Technology is behind the detection, but humans respond with actions.” / “someone needs to be responsible for the action taken”UK NCSC, 2026-09-21ZIFFER's mechanismnamed signers on every HIGH action
- “Require human oversight mechanisms, including approval steps and intervention points for high-risk actions, auditing, and reversibility following task execution.”CISA, NSA, ASD, NCSC and partners, Careful Adoption of Agentic AI Services, 2026-05-01ZIFFER's mechanismgrade, quorum, receipt, reversibility class
- “The responsibility for initiating an action must rest with people, not the model.”SANS, Christopher Crowley, 2026-01-07ZIFFER's mechanismthe agent proposes; it never holds the credential
- “Documented change approval by authorized parties.”PCI DSS v4.0.1, 6.5.1ZIFFER's mechanismthe receipt is the document
- “A process is in place to approve system changes prior to implementation.”SOC 2, CC8.1ZIFFER's mechanismthe rule and the receipt
Every standard asked for a named human before the action. ZIFFER is the first place the agent cannot skip one.
One shift, four scenes
The rule you signed at 09:00 answered the attack at 10:41.
Demo clock. Quorum 2-of-2 for every action graded HIGH, then a 60-second hold before release. Attestation window 15 minutes.
09:14
The beacon.
A workstation talks to a known-bad address at a fixed interval. The agent proposes block_ip on the workstation. Tier T1, LOW, reversible. Allowed at once. Your playbook verifies the receipt and the block reaches the EDR with your own credential.
record: ALLOW · receipt
09:31
The domain admin.
Impossible travel on a domain admin. The agent proposes disable_account. Tier T3 raises the grade to HIGH. Two analysts read a summary rendered from the signed proposal bytes and sign with passkeys. Held 60 seconds; nobody stops it; released. The disable reaches the identity provider only after the receipt.
record: ALLOW · receipt · 2 attestations
10:02
The reimage.
The agent concludes a production host is compromised and proposes reimage_host. HIGH and irreversible: two signatures, a notice to the manager, and the manager's confirmation before release. The EDR's reimage log line is timestamped after the receipt's signature, never before.
record: ALLOW · receipt · 2 attestations · notice sent · confirmed
10:41
The attack.
A crafted alert says the domain controller is the command-and-control source and must be isolated now. Nothing filters the alert. The agent believes it and proposes isolate_host on the domain controller. Tier T3, HIGH, quorum 2-of-2. Both analysts read “isolate domain controller dc-01”. Neither signs. At 10:56 the window closes.
record: ATTEST · expired unanswered · 0 attestations · no receipt minted · never executed
The agent was fooled at 10:41. The rule you signed at 09:00 was not.
Three receipts and one refusal, verifiable offline with the key you hold.
One shift, four scenes
The rule you signed at 09:00 answered the attack at 10:41.
Demo clock. Quorum 2-of-2 for every action graded HIGH, then a 60-second hold before release. Attestation window 15 minutes.
09:14
The beacon.
A workstation talks to a known-bad address at a fixed interval. The agent proposes block_ip on the workstation. Tier T1, LOW, reversible. Allowed at once. Your playbook verifies the receipt and the block reaches the EDR with your own credential.
record: ALLOW · receipt
09:31
The domain admin.
Impossible travel on a domain admin. The agent proposes disable_account. Tier T3 raises the grade to HIGH. Two analysts read a summary rendered from the signed proposal bytes and sign with passkeys. Held 60 seconds; nobody stops it; released. The disable reaches the identity provider only after the receipt.
record: ALLOW · receipt · 2 attestations
10:02
The reimage.
The agent concludes a production host is compromised and proposes reimage_host. HIGH and irreversible: two signatures, a notice to the manager, and the manager's confirmation before release. The EDR's reimage log line is timestamped after the receipt's signature, never before.
record: ALLOW · receipt · 2 attestations · notice sent · confirmed
10:41
The attack.
A crafted alert says the domain controller is the command-and-control source and must be isolated now. Nothing filters the alert. The agent believes it and proposes isolate_host on the domain controller. Tier T3, HIGH, quorum 2-of-2. Both analysts read “isolate domain controller dc-01”. Neither signs. At 10:56 the window closes.
record: ATTEST · expired unanswered · 0 attestations · no receipt minted · never executed
The agent was fooled at 10:41. The rule you signed at 09:00 was not.
Three receipts and one refusal, verifiable offline with the key you hold.
The rule
Six rows decide the shift. The agent typed none of them.
Tier comes from the asset. Grade comes from the rule. An unknown asset is treated as top tier.
| Action | Target | Tier | Grade | Outcome |
|---|---|---|---|---|
| block_ip | workstation | T1 | LOW | allowed at once, receipt |
| block_ip | production server | T2 | MEDIUM | allowed at once, receipt |
| disable_account | standard user | T1 | LOW | allowed at once, receipt |
| disable_account | domain admin | T3 | HIGH | quorum 2-of-2, receipt, released after the hold |
| reimage_host | production host | T2 | HIGH, irreversible | quorum 2-of-2, notice, receipt, confirmed by a notified person |
| isolate_host | domain controller | T3 | HIGH | quorum 2-of-2, or nothing runs |
floors · reversibility · risk_functions · notice_targets
Author and reviewer are two different people; the signing tool refuses it otherwise.
The rule
Six rows decide the shift. The agent typed none of them.
Tier comes from the asset. Grade comes from the rule. An unknown asset is treated as top tier.
- block_ipworkstationT1 · LOW allowed at once, receipt
- block_ipproduction serverT2 · MEDIUM allowed at once, receipt
- disable_accountstandard userT1 · LOW allowed at once, receipt
- disable_accountdomain adminT3 · HIGH quorum 2-of-2, receipt, released after the hold
- reimage_hostproduction hostT2 · HIGH, irreversible quorum 2-of-2, notice, receipt, confirmed by a notified person
- isolate_hostdomain controllerT3 · HIGH quorum 2-of-2, or nothing runs
floors · reversibility · risk_functions · notice_targets
Author and reviewer are two different people; the signing tool refuses it otherwise.
Before you ask
What every SOC lead asks first.
Who signs at 3 a.m.?
The rule decides in advance. Reversible actions on low tiers are allowed at once, with a receipt and nobody in the path. Only actions graded HIGH wait for the quorum, and the quorum is the named analysts on call, on their phones, with passkeys. It is the pre-approval your MDR already asks you for, signed once instead of agreed by email.
Is the hold a window for the attacker?
The hold is 60 seconds, after two signatures, and only for actions graded HIGH. Breakout averages 29 minutes. Reversible containment is allowed at once, with a receipt. Only the domain controller and its peers wait, and a wrong action there is the outage you are trying to prevent.
What if nobody can sign?
Then nothing runs. The window closes, the analysts are told the request expired unanswered, and no receipt exists. Your break-glass path stays what it is today, outside the agent, with named humans and its own log.
We list our limits before you find them. Then nothing runs, and no receipt exists.
Before you ask
What every SOC lead asks first.
Who signs at 3 a.m.?
The rule decides in advance. Reversible actions on low tiers are allowed at once, with a receipt and nobody in the path. Only actions graded HIGH wait for the quorum, and the quorum is the named analysts on call, on their phones, with passkeys. It is the pre-approval your MDR already asks you for, signed once instead of agreed by email.
Is the hold a window for the attacker?
The hold is 60 seconds, after two signatures, and only for actions graded HIGH. Breakout averages 29 minutes. Reversible containment is allowed at once, with a receipt. Only the domain controller and its peers wait, and a wrong action there is the outage you are trying to prevent.
What if nobody can sign?
Then nothing runs. The window closes, the analysts are told the request expired unanswered, and no receipt exists. Your break-glass path stays what it is today, outside the agent, with named humans and its own log.
We list our limits before you find them. Then nothing runs, and no receipt exists.
Nothing to replace
Keep the agent you run. Keep your playbooks. Add the rule and the receipt.
- SDK
- Your executor proposes, then verifies the receipt before it calls the tool. Python and TypeScript.
- Playbook
- One HTTP step before the response action and a branch on the verified receipt. Your SOAR keeps its playbooks.
- MCP
- An agent on an MCP client proposes through the ZIFFER server. The receipt still goes to your code.
- latency
- p50 244 ms, p99 1.2 s from proposal to decision. Measured 2026-08-28, local rehearsal. The SOC demo prints its own.
Most SOAR approval steps take one approver by link and keep the record inside the platform. ZIFFER adds named signers with passkeys, a quorum, and a receipt you verify outside it.
Nothing to replace
Keep the agent you run. Keep your playbooks. Add the rule and the receipt.
- SDK
- Your executor proposes, then verifies the receipt before it calls the tool. Python and TypeScript.
- Playbook
- One HTTP step before the response action and a branch on the verified receipt. Your SOAR keeps its playbooks.
- MCP
- An agent on an MCP client proposes through the ZIFFER server. The receipt still goes to your code.
- latency
- p50 244 ms, p99 1.2 s from proposal to decision. Measured 2026-08-28, local rehearsal. The SOC demo prints its own.
Most SOAR approval steps take one approver by link and keep the record inside the platform. ZIFFER adds named signers with passkeys, a quorum, and a receipt you verify outside it.
FAQ
AI SOC agents and ZIFFER, in eight questions.
Can an AI SOC agent be prompt-injected through an alert?
Yes. Alert titles, log fields and ticket bodies are attacker-writable, and two MDR teams reproduced it in their own SOCs in 2025. ZIFFER does not try to stop the injection. It removes the agent's authority to act on it.
Does ZIFFER work with the SOC agent I already run?
Yes, wherever the agent acts through a playbook or code you own. A vendor feature that decides and executes inside its own platform with no call-out is not gated, and we say so.
Will this flood analysts with approval requests?
Only actions graded HIGH reach a human. Everything else is allowed at once, with a receipt. You set the line in the rule.
What happens if ZIFFER is unreachable?
No receipt, so your executor does not act. The action fails closed and the record shows a proposal with no decision.
How do we test a rule before we sign it?
Every change is a pull request. Validation runs on the request, publish runs on merge. Stage it on a non-production tier first.
Can we undo an action?
Reversibility belongs to your tool. The rule grades on it: block, isolate and disable are reversible; reimage and revoke are not, and they carry the notice.
Does ZIFFER hold my EDR or identity provider credentials?
No. The credential stays in your tool. ZIFFER sees the proposal and issues the receipt; your code decides whether to act.
How do we audit a decision months later?
One signed receipt per decision, verified by an open tool on your machine. The record outlives any vendor.
FAQ
AI SOC agents and ZIFFER, in eight questions.
Can an AI SOC agent be prompt-injected through an alert?
Yes. Alert titles, log fields and ticket bodies are attacker-writable, and two MDR teams reproduced it in their own SOCs in 2025. ZIFFER does not try to stop the injection. It removes the agent's authority to act on it.
Does ZIFFER work with the SOC agent I already run?
Yes, wherever the agent acts through a playbook or code you own. A vendor feature that decides and executes inside its own platform with no call-out is not gated, and we say so.
Will this flood analysts with approval requests?
Only actions graded HIGH reach a human. Everything else is allowed at once, with a receipt. You set the line in the rule.
What happens if ZIFFER is unreachable?
No receipt, so your executor does not act. The action fails closed and the record shows a proposal with no decision.
How do we test a rule before we sign it?
Every change is a pull request. Validation runs on the request, publish runs on merge. Stage it on a non-production tier first.
Can we undo an action?
Reversibility belongs to your tool. The rule grades on it: block, isolate and disable are reversible; reimage and revoke are not, and they carry the notice.
Does ZIFFER hold my EDR or identity provider credentials?
No. The credential stays in your tool. ZIFFER sees the proposal and issues the receipt; your code decides whether to act.
How do we audit a decision months later?
One signed receipt per decision, verified by an open tool on your machine. The record outlives any vendor.
Intelligence stays with the agent. Authority does not.
Bring the agent you run and the playbook it calls. Leave with the rule signed.
Intelligence stays with the agent. Authority does not.
Bring the agent you run and the playbook it calls. Leave with the rule signed.