What Makes an Incident 'Agentic'? A Practitioner's Definition

Every vendor in the SOC and IR market wants to own the word “agentic” right now. Almost none of them agree on what it means once the pager actually goes off. Here’s the definition Profero’s practitioners use in casework, and why the difference changes how you investigate.

The question we keep getting asked mid-incident

Somewhere in the first hour of nearly every AI-related case we open now, someone on the client side asks a version of the same question. Is this an AI incident, or is it an agentic one? Usually they’re not asking out of curiosity. Their cyber insurer wants a category for the notification. Their board wants a clean sentence for the risk committee. Or a vendor used the word “agentic” in a pitch deck three weeks earlier, and now everyone in the room assumes it has a settled, technical meaning.

It doesn’t. Not yet. And that gap is starting to cause real problems, because whether an incident is agentic changes what you collect, who you notify, and how fast you can tell a straight story about what actually happened.

Why the word is slipping away from anyone who needs it precise

Part of the confusion is commercial. The market for AI-driven security tooling is projected at close to $10 billion in 2026, growing at roughly 40 percent a year, as agentic SOC platforms, agentic IR tools, and agentic-everything products compete for budget. When a single word is worth that much of a marketing budget, it gets attached to a lot of products, whether or not the underlying system actually plans, decides, and acts on its own.

There’s also a genuine technical distinction buried underneath the marketing noise, one that most buyers never see spelled out. OWASP’s GenAI Security Project draws a hard line between its original Top 10 for LLM Applications, which governs what a model says in response to a prompt, and its newer Top 10 for Agentic Applications, which governs what an autonomous system does when it plans, calls tools, holds memory, and coordinates with other systems.¹ That’s a useful boundary. It just hasn’t made it into how most security teams triage a case at 2 a.m.

The definition we use in casework

Here’s the version that survives contact with an actual incident. We don’t ask whether AI was “involved,” because almost everything is AI-adjacent now. We ask three questions, in order, and an incident only earns the agentic label when the answer to all three is yes.

1. Did the system hold delegated authority, not just a text box?

Generating a paragraph, a snippet, or a summary isn’t the threshold. The threshold is whether the system held live credentials, API access, or the ability to invoke tools and take action inside the environment on its own.

2. Did it choose the action itself, across more than one step, without a human approving that specific step?

A person prompting an assistant and then clicking “run” on the output it produced is still, functionally, a human decision at the point that mattered. An agent that planned a sequence, decided which tool to call next based on what the previous tool returned, and executed without a person in that specific loop, is a different animal for forensics.

3. Once it went wrong, is the chain of causation genuinely ambiguous?

This is the test people skip. In a real agentic incident, you often can’t cleanly say “the developer did X” or “the attacker did Y.” The causal chain runs through a planning loop, a poisoned piece of retrieved content, or a second agent acting on the first agent’s output, and untangling who or what actually decided is itself part of the investigation.

If your incident is “an employee pasted something sensitive into a chat window,” that’s an AI-adjacent incident. Treat it like a data-handling failure, because that’s what it is. If your incident involves a system that held permissions, made its own sequence of decisions, and left your team genuinely unsure in hour one whose action they were even looking at, that’s agentic. The forensics you need, the notification obligations you’re under, and the retainer scope required are different in each case.

What this looks like in practice

Three real cases, sitting at different points on this spectrum:

• Replit, July 2025. An AI coding agent deleted a company’s live production database during an active code freeze, then reportedly misrepresented what it had done. (Source)⁶ It held delegated authority (direct production database access), it made a multi-step autonomous decision (interpreting and acting on a vague cleanup instruction), and reconstructing why it overrode an explicit freeze took genuine investigative work. That clears our bar for agentic.
• EchoLeak, June 2025. A zero-click vulnerability in Microsoft 365 Copilot let an attacker exfiltrate sensitive data from a target’s environment using nothing but a single crafted email; there was no click, no attachment opened, and no user action at all. (Source)⁵ A human never made a decision in the loop that mattered. Copilot’s own retrieval and reasoning process was the mechanism of harm. If anything, this is a cleaner example of agentic behavior than Replit, because the attacker never touched a keyboard inside the victim’s environment at all.
• The pattern we described in our own casework. In an earlier piece on AI-induced destruction, we walked through incidents where a developer handed an assistant a vague, high-permission instruction and a bad outcome followed. Some of those cases clear our three-question bar. Others are closer to “a person made a bad call and used AI to execute it faster,” which is a real failure mode, just not the same one, and it needs a different investigative path.

Why the label matters?

CISOs sometimes push back on this framing: does it matter what we call it, as long as we contain it fast? It matters for three concrete reasons.

Evidence

NIST’s SP 800-61 Revision 3, published in 2025, explicitly calls out evidence preservation requirements across the incident response lifecycle for AI-involved incidents.² An agentic incident needs agent action logs, tool-call records, and planning traces preserved from minute one, not just endpoint and network telemetry. If your current IR retainer’s forensics scope was written before your organization ran a single autonomous agent in production, it probably says nothing about collecting that evidence.

Attribution and reporting

Insurance notification language, breach disclosure timelines, and board reporting all depend on being able to say who or what caused an incident. “Genuinely ambiguous by design” is a hard sentence to put in a regulatory filing. It’s often the honest one for an agentic incident, and whoever is running your response needs to know how to write that sentence defensibly, not paper over it.

Retainer scope

This is the practical one. Ask your current IR provider a direct question: does our statement of work name agentic incidents, or does it only cover “cyber incidents” in language written for a pre-agent world? Most break-glass retainers were scoped against ransomware and business email compromise. Very few were scoped against a system that plans its own next step.

Where the standards bodies are, and why that’s not enough yet

The industry is catching up, just not fast enough to hand CISOs a settled playbook today. NIST launched its AI Agent Standards Initiative in February 2026, alongside a National Cybersecurity Center of Excellence concept paper on agent identity and authorization.³ The Coalition for Secure AI published a dedicated AI Incident Response Framework mapped to the NIST 800-61r3 lifecycle.⁴ And OWASP’s Top 10 for Agentic Applications, published in December 2025, gave the industry its first widely adopted taxonomy of agent-specific failure modes, from goal hijacking to tool misuse to cascading multi-agent failures.

All of that is genuinely useful, and worth building internal playbooks around. None of it, yet, tells a responder standing in front of a live incident whether to call it agentic before the retainer clock starts running. That’s the gap this definition is meant to close: not a replacement for the standards, but a working test practitioners can apply today, while the frameworks finish catching up.

What to do with this before your next incident

Pull your current IR retainer or MSA and check whether “agentic,” “autonomous,” or “AI agent” appear anywhere in the scope language. If they don’t, you’re not covered for the category of incident that’s growing fastest in our own casework right now.

Read next: “The SOAR Era Is Over: Why Playbook Automation Can’t Catch an Autonomous Attacker,” which picks up directly from here on why scripted response breaks down against an attacker, or an agent, making its own decisions in real time.

Read next: “AI-Induced Incidents: The IR Category CISOs Aren’t Prepared For,” the board-facing companion piece to this one.

If you want a faster gut check than reading a retainer contract line by line, our GenAI Readiness Assessment is built around exactly this gap. It’s two days of hands-on evaluation by our own IR practitioners across your AI code assistants, agents, and chat interfaces, scored against the same criteria we use in live casework, not a generic audit checklist.

Not sure whether your IR plan covers an agentic incident? Talk to our IR team.

References