A 22-second handoff makes the triage queue the vulnerability, not the headcount

Arctic Wolf has published an argument that the tiered security operations centre is not understaffed but structurally obsolete, and it rests on one number: the median time for an attacker to hand freshly compromised access to the next crew in the chain, the one that drives toward ransomware, is now 22 seconds, against more than eight hours in 2022 ^[1]. That is a compression of roughly 1,300 times ^[1], and if it is real it moves the operating question off roster size and onto which containment decisions you are willing to let software make without a human in the loop.

Start with the provenance, because the load-bearing figure is the weakest cited one. The post attributes its other statistics to CrowdStrike, IBM, Microsoft/Omdia and ISC2, but the 22-second and eight-hour handoff numbers appear with no named source ^[2]. The company making the diagnosis also sells the prescription: its conclusion is that bolting AI onto the tiered model will not work and the operating model itself must be replaced with an agentic SOC ^[10].

The supporting numbers are more traceable. CrowdStrike's 2026 Global Threat Report, as cited, puts average eCrime breakout time at 29 minutes with AI-enabled adversary activity up 89 percent year over year ^[3]. That means the whole distance from brokered handoff to lateral movement is about 79 handoff intervals wide ^[3] and fits inside half an hour. Microsoft/Omdia's State of the SOC 2026 reports 46 percent of alerts are false positives and 42 percent are never investigated at all ^[7], which leaves 58 percent examined ^[2]. ISC2's late-2025 research found 59 percent of practitioners reporting critical skill gaps, a 15-point jump in one year ^[8]. Nobody hires their way out of that.

The structural claim is the one worth taking seriously: Tier 1 triage, Tier 2 investigation and Tier 3 hunting move work sequentially, and each queue adds delay while each handoff sheds context ^[9]. A sequential process cannot win a race against a parallel one, whatever the queue depth.

So the practical work is not buying an agentic label. It is writing down, per action, what automation may do unattended, and what it must ask for. Sort candidate actions by blast radius and reversibility. Killing a remote access session, revoking a token, quarantining a message and isolating a single host are cheap to undo and cheap to be wrong about. Fleet-wide egress blocks, mass credential resets and disabling service accounts are not. That triage matters because unattended action inherits the alert quality it fires on, and the cited false positive rate is 46 percent ^[7].

There is a useful hint on where the delegated authority earns its keep: 65 percent of non-BEC intrusions in Arctic Wolf's own 2026 threat data involved abuse of remote access technologies such as RDP, VPN and RMM tools ^[6], and ransomware, BEC and data incidents made up 92 percent of its incident response engagements, with data-only extortion up 11 times year over year ^[5]. Cutting remote sessions is both the highest-frequency intervention and one of the more reversible ones.

Watch for three things: whether anyone publishes the methodology behind the 22-second claim; whether agentic products expose a per-action authority list with rollback and an audit trail, or just faster ticket summaries, which the post itself calls a trap ^[11]; and whether the 42 percent never-investigated figure ^[7] moves, since that is the only honest measure of whether the automation absorbed work rather than relabelled it.