We went first: How DXC proved the Agentic SOC inside its own business

As part of DXC’s pivot to becoming an AI-first company, our cybersecurity team began exploring how AI could help us protect the business more effectively.

We looked widely across the market, but much of what we found focused on adding chatbot capabilities to existing security tools. These assistants could search, summarize findings and support analysts, but they didn’t fundamentally change how investigations were carried out. We needed AI that could go further by taking on repeatable investigation work and helping our teams respond faster. 

The SOC offered a clear place to start. Many early investigation tasks follow established processes, making them well suited to AI agents.

Rather than waiting for the technology to mature elsewhere, DXC chose to go first. We deployed DXC Agentic SOC, powered by 7AI, across our own global security environment. This made DXC Customer Zero and allowed us to prove the approach under real operating conditions before bringing it to customers.

The solution uses autonomous investigation and AI reasoning to handle high-volume, repeatable alert work. It investigates alerts in parallel, correlates evidence from across the security environment and gives analysts clear, evidence-based findings.

Running the solution in production also helped us refine how it operated. Our cybersecurity teams reviewed investigations and used that feedback to improve agent capabilities and investigation strategies over time. This gave DXC practical, firsthand experience of managing and improving agentic AI in a live security operation.  

Automating repeatable investigations has opened up new opportunities for our analysts to build skills and grow their careers. Tier-1 work still exists, but it no longer needs to define an analyst’s role.

With AI agents handling much of the routine triage and investigation, our people can take on more complex cases and move into higher-value areas such as threat hunting and intelligence. Their expertise also helps validate findings and refine how agents respond as threats evolve. 

DXC Agentic SOC can also integrate with DXC OASIS, our agentic IT operations platform, bringing cyber and IT operations into a single, unified view. Leaders gain real-time visibility of security performance across the wider IT estate, shortening the path from threat detection to remediation. By connecting systems, data and AI agents on one platform, DXC OASIS  helps organizations move from reactive operations to more predictive, adaptive ways of working, with a Human + AI approach at the center. 

Becoming Customer Zero has changed what we can bring to customers. Our teams know what it takes to deploy AI agents in live security operations, assess their performance and improve their capabilities over time.

Across a diverse set of customer environments, DXC Agentic SOC has processed more than 100,000 security incidents in production, delivering improvements of approximately 88-95% in mean time to investigate, 83% in mean time to resolve and 95% in analyst handling time.

We also stress-tested DXC Agentic SOC to expose where it could fail, helping us understand where agents perform well, where stronger guardrails are needed and what effective governance looks like in practice. Those lessons shape the operating model we now bring to customers.

And the SOC is only the beginning. As AI-enabled threats continue to evolve, DXC can apply this experience across more cybersecurity processes and help organizations strengthen their cyber resilience.

DXC went first, so our customers can move forward with greater confidence.