When security operations enter "machine speed": How Bendigo Bank's proxy SOC is reshaping the cybersecurity paradigm

When Security Operations Move at "Machine Speed"

The evolution of cyber threats has long outpaced the cognitive bandwidth of human analysts. Traditional Security Operations Centers (SOCs) rely heavily on Tier 1 and Tier 2 analysts for alert triage, log auditing, and initial response. Yet, in an era where attackers leverage AI-generated attacks and automated lateral movement, the human-led "detect-respond" cycle is proving inadequate. As Bendigo Bank Chief Security Officer Gajan Ananthapavan stated at Google Cloud Summit Sydney: "Traditional SOC teams will not exist in their current form."

The bank's solution is to build Australia's first "agentic Security Operations Center" (agentic SOC). Its core is not simply automation upgrades, but embedding AI agents into the security decision-making loop—from alert correlation and incident classification to response execution. Agents can autonomously judge and act within milliseconds, escalating to humans only when deep analysis or strategic decisions are needed. Ananthapavan noted that the ultimate goal is to completely remove humans from frontline response, allowing teams to focus on "high-value security work."

From SOAR to Agentic: A Paradigm Shift in Security Automation

Security Orchestration, Automation and Response (SOAR) was once the standard tool for SOC efficiency, but it is essentially a "playbook-style" mechanical execution: predefined rules, limited conditional branches, and a lack of contextual understanding. Agentic SOC, in contrast, is built on Large Language Models (LLMs) and reinforcement learning. It can understand threat intelligence described in natural language, dynamically adjust strategies, and even proactively strengthen defense controls—such as automatically adjusting web application firewall rules to counter real-time attack vectors.

Bendigo Bank's technology choices reflect the underlying support for this shift: using Google Threat Intelligence for global threat mapping, Google SecOps as a unified analysis platform, and Security Command Center for cloud-native asset visualization and policy management. These products already embed extensive AI capabilities, but the bank goes further by building a proprietary agent layer on top. Ananthapavan emphasized the need to "gradually build trust in agent decision-making," initially maintaining "human-in-the-loop collaboration" and gradually reducing human intervention once model accuracy reaches standard.

Three-Fold Impact on Industry Structure

The rise of agentic SOC will profoundly reshape three aspects of the cybersecurity industry:First, Workforce Restructuring. The global SOC faces a severe talent shortage, with junior analysts experiencing extremely high turnover rates. If agents can handle 80% of alert triage and standardized responses, enterprises will no longer need large numbers of lower-level analysts; instead, they will require fewer "security engineer + AI trainer" hybrid roles responsible for optimizing agent behavior and investigating advanced threats. This is similar to how automation testing reshaped QA positions—not eliminating jobs, but raising the skill threshold.

Second, Security Vendor Shakeout. Traditional SIEM vendors (e.g., Splunk, IBM QRadar) are facing fierce competition from cloud-native security stacks. Google, Microsoft, and Amazon have all launched full-stack security operations platforms with embedded AI agent capabilities, bundling cloud infrastructure advantages. Bendigo Bank completed its platform migration in four months and shut down legacy systems, demonstrating that the deployment speed and cost advantages of cloud-native solutions are turning into real-world choices. Meanwhile, consulting firms like PwC, acting as integrators, are also competing for the "agentification transformation" services market.

Third, Enterprise Security Strategy Upgrades. Agents can not only respond but also proactively harden defenses. Ananthapavan cited examples where, using real-time intelligence gathered from actual attacks, agents can directly adjust front-end protection rules—marking a shift from "passive defense" to "active autonomy" in security operations. In the long run, the focus of enterprise security teams will shift from "incident management" to "model governance and strategy design."

Trust Building Is the Biggest Obstacle

Despite a clear technical path, large-scale deployment of agentic SOC still faces serious challenges. The "hallucination" problem of LLMs is unacceptable in security scenarios—one wrong decision could lead to data breaches or business disruptions. Bendigo Bank's choice of a "human-machine collaboration" transition period is pragmatic: agents run in test environments, and all actions require human confirmation. Ananthapavan revealed that full trust in agents may take "years" of iterative validation.

In addition, regulatory compliance is another major variable. The financial industry is subject to strict audit requirements; agents' decision-making logic must be traceable and explainable. The black-box nature of current mainstream LLMs conflicts with this need, and breakthroughs in explainable AI are urgently required.

Long-Term Trend: The Endgame of SOC

Ananthapavan's prediction—"The traditional SOC will cease to exist"—is not alarmist. Over the next five years, we may see the following evolution: most enterprises' SOCs will shift from "labor-intensive" to "AI agent-driven," with human roles focused on threat hunting, red teaming, and agent training; security operation budgets will shift from "people" to "compute + models"; cloud platforms will become the core delivery vehicle for security capabilities, and standalone SIEM vendors will either integrate into ecosystems or be marginalized.Bendigo Bank's trial is an empirical node in this grand narrative. When agent SOC proves its reliability and cost-effectiveness, the industry will accelerate its adoption. The rules of the cybersecurity game are being rewritten: victory will no longer belong to the fastest-responding humans, but to the machines with the most intelligent agents.