Elastic InfoSec SOC Optimization: Cutting AI Agent LLM Calls by 60%

Introduction

As Security Operations Centers (SOCs) race toward autonomy in 2026, the operational cost of AI has emerged as a critical bottleneck. While agentic workflows promise faster triage, unoptimized Large Language Model (LLM) usage can introduce prohibitive latency and expense. Elastic InfoSec recently revealed that their fleet of fourteen AI agents—responsible for triaging security alerts—was operating inefficiently, requiring 19 LLM API calls to complete tasks that logically only needed 8. By implementing a rigorous optimization loop, they achieved a 60% reduction in LLM calls. For defenders, this is a blueprint for maintaining scalability without sacrificing budget or response times.

Technical Analysis

Affected Component: Agentic SOC Workflows (LLM-based Triage)

The Inefficiency Mechanism: In agentic architectures, an AI agent typically breaks down a complex task into sub-steps, often querying an LLM at each stage (e.g., "analyze this," "summarize that," "decide next step"). Elastic identified that their agents were generating excessive "chatter"—unnecessary intermediate steps and verbose prompt exchanges that consumed tokens and added milliseconds of latency per call. In a high-volume SOC, a 19-call process vs. an 8-call process represents the difference between real-time containment and delayed response.

Optimization Technique: The core of the improvement relies on prompt compression and logic consolidation. Rather than relying on the LLM to "think" through every micro-step via an API call, the optimization logic pushes the chain-of-thought processing into the application layer or compacts the reasoning into fewer, denser prompts. The "five-step optimization loop" mentioned involves continuously auditing agent logs to identify these redundant API interactions and refining the prompt templates to be more directive and less conversational.

Exploitation Status: Not applicable. This is an operational optimization advisory, not a vulnerability or exploit.

Executive Takeaways

Based on Elastic InfoSec's findings, security leaders should implement the following organizational changes to mature their AI defenses:

Audit Token Usage: Implement logging to track exactly how many LLM API calls your agents make per alert type. Baseline your current efficiency before scaling.
Consolidate Agent Logic: Move simple logic (state management, boolean checks) out of the LLM and into traditional code (Python/Go). The LLM should only be used for semantic analysis and decision-making.
Standardize Output Schemas: Enforce strict JSON or XML output structures in your prompts. This prevents the "hallucination loop" where the agent has to make follow-up calls to correct formatting errors.
Adopt the Optimization Loop: Create a dedicated engineering sprint (as Elastic did) to review agent performance logs, prune redundant prompt instructions, and re-deploy.
Monitor "Time-to-Decision": Shift focus from "how many alerts we processed" to "how fast the AI reached a conclusion." Reducing API calls directly correlates to faster containment times.

Remediation & Implementation

To apply these efficiency gains to your environment, follow this implementation strategy:

Review Prompt Templates: Audit your current system prompts. Remove instructions that tell the LLM to "explain your reasoning" or "show your work" unless it is strictly necessary for the analyst review. Use the "prompt template" referenced in the source article to structure commands more tersely.
Implement Function Calling: Ensure your AI agents are using native function calling (tools) rather than generating text that needs to be parsed and re-queried.
Batch Context: Where possible, send related alert context in a single system message rather than allowing the agent to ask for it piece by piece.

For further guidance on optimizing your security stack, refer to the Elastic Security Labs AI Agent Optimization article.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub