AI Agents for vCISOs: The Real Capabilities You Need (Not Just the Buzzwords)
Jeff Sowell · 2026-04-09 · vCISO
Every vCISO platform is announcing 'AI agents' this quarter. Here's what actually matters: alert-to-action automation, contextual investigation, and proactive insights that fix things — not just describe them.
The AI agent gold rush
If you've been on LinkedIn this month, you've seen the announcements. Every GRC and vCISO platform is suddenly launching "AI agents," "co-worker agents," or "CISO intelligence." The marketing follows a familiar pattern: smart-sounding capabilities, vague descriptions of what the agent actually does, and pricing that conveniently rises to match.
The pitch sounds compelling. The reality is mostly chat interfaces wrapped around existing data, with a few automated summaries thrown in. That's not an agent. That's a search bar.
A real AI agent for a vCISO does three things:
1. Detects what changed — surfaces the things that need attention without being asked
2. Explains why it matters — connects technical findings to business impact
3. Takes action — actually fixes things, or queues them up for fixing, in one click
Most platforms are good at #1 (dashboards). Some are okay at #2 (AI summaries). Almost none deliver #3.
What "AI agent" should actually mean
Here's the test: when an XDR alert fires at 2 a.m., what does your platform do?
Bad: Sends an email saying "alert fired."
Better: Creates an incident with the alert details.
Real agent: Creates a risk in the register with source IPs, target hosts, and MITRE ATT&CK techniques. Generates a contextual investigation task with step-by-step remediation. Maps the finding to NIST CSF, ISO 27001, CIS, CMMC, and HIPAA controls. Updates the framework evidence vault. Auto-escalates to an incident if severity warrants. Notifies the vCISO with everything they need to act in a single view.
That's what we built into Radius360 for our Sekoia XDR integration — and the same pattern applies to CrowdStrike, SentinelOne, Microsoft Sentinel, AWS Security Hub, Tenable, and 7+ other deep integrations. Every alert flows through the same pipeline. Every finding becomes a tracked, mapped, actionable item. No manual triage. No copy-paste between tools.
The capabilities checklist
If you're evaluating AI in a vCISO platform, ignore the marketing copy and ask these questions:
1. Does it auto-generate risks from real telemetry?
Not "you can ask AI about your risks." Not "AI summarizes your dashboard." Auto-generation means the platform watches your integrations and creates risk register entries when something appears. The risks should have:
- A clear title that names the problem ("Lateral move detected — ws-sales-01 from 10.0.7.8")
- Source attribution (which integration, which alert ID)
- MITRE ATT&CK or CVE references
- Impact and likelihood scoring
- A linked mitigation task
2. Does it create investigation tasks automatically?
When a high-severity finding appears, the platform should generate a task with:
- The investigation steps (triage, contain, investigate, remediate, document)
- Suggested response actions specific to the threat type
- A linked risk in the register
- Priority based on urgency, not just a generic "high"
- Auto-cleanup when the source finding is resolved
3. Does it map findi