Playbooks encode yesterday's attack as a fixed tree. Trench Skills compose the right investigative expertise from Signal Memory and the Intent Graph, live.
TL;DR
- Playbooks encode yesterday's attack as a fixed tree. Agentic infrastructure and agentic attackers both produce behavior nobody wrote a branch for.
- AI-powered triage, what the market sells as AISOC, walks that same tree faster. It still requires the pattern to already be known.
- Trench Skills compose the right investigative expertise from Signal Memory and the Intent Graph, live, the way an investigator reasons. That’s the sustainable model at scale to deliver agentic SecOps outcomes.
Context
- The Agent Is Not the Product. The Foundation Is. laid out Trench's foundation: Signal Memory, the Intent Graph, a policy-governed Action Layer.
- AI Changed the Threat Landscape. Why Are We Still Defending Like It's 2020? argued attackers moved from human-paced to machine-paced tactics.
- This post covers the layer in between: how investigation actually happens once a signal fires in a Trench agentic SecOps environment, and why most SOCs still run that layer on the wrong artifact.
It's a quiet Tuesday
A support copilot connected to Salesforce starts querying billing and bank-record fields it's never touched, inside its own valid OAuth scope. A few sessions later it joins those fields into a single object. Then it reaches for a connected app it's never used.
No single call looks wrong. The credential is valid, the scope was granted. The SOC's detection rules cover bulk exports by a human, downloads outside business hours, known exfiltration tools. Nothing covers an agent quietly assembling a payload nobody taught it to build.
The analyst finds out after the fact, from a compliance question nobody wanted to ask: how long was that data moving before anyone noticed?
The playbook model: built to match, not to reason
A playbook is a decision tree written in advance, for a threat someone already characterized. That held up when attackers mostly reused known techniques against static environments.
Three things break it:
- The branch has to exist before the attack does. A DLP rule for "bulk export" assumes a human clicking a button, not an identity accumulating fields one query at a time.
- The tree is linear. An agent that queries a new object today, joins it next session, and attempts egress later never trips one trigger, because the behavior is relational and spread across time.
- Every integration is new maintenance debt. A new connected app needs a new branch, authored by a detection engineering function that's usually a fraction of one person's time, or the gap goes uncovered. Same complaint we hear about MSSPs: generic playbooks, no context.
A tree with no branch for a new pattern isn't a gap. It's the playbook working exactly as designed, against a threat it was never designed for.
The AI-powered model: a faster way to walk the same tree
AISOC platforms fixed a real problem: alert fatigue. Vectra AI's 2026 report puts the average SOC team at nearly 3,000 alerts a day, two-thirds unaddressed. Faster classification is a real improvement over static detection rules.
But faster matching is still matching:
- A recent academic survey on agent architectures notes that from-scratch reasoning on every task, with no reusable layer underneath, gets inefficient and hard to maintain as the task space grows, the same curve that burns out detection engineering teams hand-tuning rules.
- Each query, scored alone, looks exactly like what it is: valid, in scope, under threshold. Nothing about last week's slightly different access carries forward.
- This split shows up across the AISOC category broadly: a deterministic layer that only fires on known patterns, a reasoning layer that starts over every incident. Real progress. Not a different architecture for agentic SecOps.
For a lean security team without a bench of dedicated detection engineers, that gap costs more than it does at enterprise scale. We covered why this starts at the data layer in AI in the Security Operations: Clearing the Clutter.
Trench Skills: composing expertise, not matching alerts
Anthropic's Agent Skills load a lightweight description of each capability at startup, and pull in full instructions only for the one that matches the task. Nothing pre-loaded, nothing wasted. A recent survey defines agent skills as reusable procedural artifacts that coordinate tools, memory, and context under task-specific constraints.
Trench Skills work the same way for investigation:
- Composed dynamically from Signal Memory and the Intent Graph, our context graph of how entities actually relate, not matched against a pre-written branch.
- Matched and reasoned over programmatically through TASC, our schema for agent reasoning, not searched by keyword the way a human reads a runbook.
- Routed straight into the Action Layer the moment they compose. No queue, no separate matching stage. We call this ZLTD (Zero Latency Threat Detection): it removes the queue-and-match step, not a literal instant-response claim.
Skill Library + Investigation Runtime: Reusable procedural artifacts that coordinate tools, memory, and context under task-specific constraints.
None of this removes the human, it changes where they sit. A composed Skill routes into whichever of Trench's three modes fits: full autonomy, Slack approval, or an on-demand interface for a genuinely complex case. Human On the Loop, not Human In the Loop, the same argument from Actionable SecOps in the Real World.
Before Skills vs. After Skills: Trench Skills change what the team does and accelerate the shift to Headless SecOps.
Trench Skills vs. AI-powered playbooks
| Dimension | AI-Powered Playbook Model | Trench Skills |
|---|---|---|
| Detection basis | Matches signals against a pre-written rule or trained pattern | Composes from live relationships in Signal Memory and the Intent Graph |
| Coverage of novel behavior | Requires the pattern to already be known or trained on | No pre-written branch required; triggered by what's actually connected |
| Investigation memory | Reasons from scratch on every incident | Reuses composable, persistent expertise across incidents |
| Latency | Signal waits in queue to be matched against a ruleset | Detection and composition happen in the same motion (ZLTD) |
| Maintenance burden | Every new integration or agent needs a new authored branch | Skills compose automatically as new entities and relationships appear |
| Scalability | Effort and blind spots grow faster than headcount as agents, integrations, and alert volume increase | Capability grows with the environment, not against it |
| Context graph | Alerts scored in isolation; no persistent model of entity relationships | Intent Graph makes multi-step, cross-entity drift visible as one pattern |
Sample scenarios with Skills performance
Same failure in the first two models, same fix in Trench Skills, across four different types of the problem.
| Scenario | Playbook | AI-Powered Triage | Trench Skills |
|---|---|---|---|
| SaaS agent exfiltrating data Salesforce copilot: new field access → aggregation → egress attempt | No branch for "valid credential, new fields." Doesn't fire. | Each call scores clean alone; never correlates across sessions. | Intent Graph flags the new relationship at query one. Skill composes before egress completes. |
| Firewall rule change + anomalous egress New outbound rule on a payments-adjacent host, then a traffic burst to a destination never seen before | Rule-change alert is informational at best; nothing links it to the traffic that follows. | Rule change and traffic burst each score below threshold alone; destination isn't on any blocklist yet. | Intent Graph correlates the rule change and the traffic burst as one relationship on one host; Signal Memory flags the deviation from baseline. |
| Cloud identity agent disabling guardrails Automation identity reconfiguring IAM, SSO, or logging controls | Covers known-bad IPs and off-hours logins, not a valid automation account touching its own guardrails. | In scope for an admin-adjacent identity; scores low. | Intent Graph correlates the config change with concurrent identity-provider anomalies no single signal carries alone. |
| Most alerts are false positives A storage bucket's access policy widens, coinciding with a migration already logged in the change record | Fires the same public-bucket alert regardless of context; manual triage either way. | Scores policy change the same whether or not it's tied to an approved migration; escalates, wastes analyst time confirming what change record already explains. | Matches a Known False Positive tied to the logged migration; resolves without paging anyone. A genuine misconfiguration gets the opposite verdict from the same check. |
How a Trench Skill Responds to a Signal: Dynamic composition drawing on Signal Memory, the Intent Graph, and specialized reasoning angles.
The design flaw
You cannot patch your way out of a design flaw. A playbook is a patch, written after the fact for the last attack someone found. Faster triage on the same tree is still a patch, just applied quicker.
Trench Skills don't patch. They compose from what's actually connected, the moment it connects, whether the identity behind it is an agent in your stack or an attacker impersonating one.
Meet Trench Skills.
See what composes in your environment that no playbook, and no AI SOC, ever would.
Talk to Trench →
