A turning point in cyber defence: how native agentic AI is changing the SOC.

The PHP case shows the pace.

On 22 October 2026, Handelsblatt reports millions of attempted attacks linked to PHP vulnerabilities. The report also highlights business consequences: Volkswagen took parts of its sales IT offline as a precaution. It also cites warnings that AI is accelerating the exploitation of vulnerabilities. [1]

Cloudflare's technical report describes two vulnerabilities grouped under the name php2shell. Cloudflare observed attack traffic and changing attack patterns as protective measures were rolled out and adjusted. For detection, the company correlates signals from a request with the affected system's response. [2]

Our assessment: this case connects technical vulnerability with the ability to keep a business running. When sales portals are paused as a precaution, cyber defence becomes an operational continuity issue. For a SOC, the entire path matters: from a new signal through investigation to an accountable response.

AI becomes an operating model.

A Security Operations Center, or SOC, brings together the monitoring, investigation and response to security events. AI-native means that, from the outset, work is organised around specialised AI agents, their data and their collaboration.

TENEX describes a workflow in which agents investigate alerts, correlate events and assemble evidence for a case. The approach operates on existing environments such as Google SecOps or Microsoft Sentinel. A named analyst takes consequential decisions; responses follow the company's policies. This description reflects the vendor's operating model. [3]

For us, the turning point lies in the collaboration: AI handles the investigation, while people lead decisions and take responsibility.

Speed needs clear accountability.

Assessing this model requires traceable steps, defined permissions and a reliable chain of evidence. TENEX also describes these principles in the context of the Agentic SOC Alliance: agents operate within a controlled execution framework, while people remain accountable for consequential decisions. [4]

In our view, every specialist discussion should therefore address three questions: which events and data are included? How can an assessment be traced? Who decides on which response?

The technical foundation remains essential. Cloudflare explicitly recommends updating the affected PHP software and using protective measures as an additional layer. The PHP case is the current trigger for this discussion; the TENEX description explains a separate operating model. [2]

Change creates a relevant reason to talk.

For IT vendors, systems integrators and MSSPs, the sales task starts with the customer's situation. A company with its own SOC will assess the approach differently from an IT team working with a security operations provider.

We therefore start with specific questions: where do delays occur today? Which investigations tie up specialists? How are critical cases handed over? Which environment is already in place? And how does the person responsible measure an improvement?

This turns a technical term into clear customer value: more capacity to investigate relevant events, clearer decision paths and a technically informed next step. The sales message comes from the actual need and the solution's demonstrable capabilities.

This is where enVoice combines IT expertise with Neuroakquise®: we explore the operating model, understand the buying group's perspectives and lead a conversation that prepares the ground for a productive specialist discussion.