What is Agent Zero?
Agent Zero is Command Zero's autonomous investigation agent, the AI persona that conducts end-to-end security investigations using Governed AI and the Question-based method, producing documented verdicts customers can audit, verify, and act on.
Updated 2026-05-19
Agent Zero is not a single LLM call or a single workflow. It is the orchestration layer that selects relevant expert questions for each alert, executes them against authorized data sources, correlates findings, and produces a verdict with supporting evidence. Agent Zero represents multiple agents acting as teams, all made up of multiple pipelines and agentic loops and roles. Examples of the investigations Agent Zero produces are archived in the Casebook, a public archive of real cases (redacted) that serve as the most direct evidence of what Command Zero produces in production.
How Command Zero handles Agent Zero.
Agent Zero runs in autonomous mode by default for routine Tier-1 alert triage and on demand for any case the human analyst chooses to delegate. The agent's reasoning is logged, the questions executed are visible, and the verdict ties to the evidence. Customers control which questions Agent Zero is permitted to ask and which data sources it is authorized to query. This is what distinguishes Agent Zero from black-box autonomous SOC products.
Frequently asked questions
What is Agent Zero?
Agent Zero is Command Zero's autonomous investigation agent: the orchestration layer that selects expert questions for each alert, runs them against authorized data sources, correlates findings, and produces a verdict with supporting evidence.
Is Agent Zero a single AI model?
No. Agent Zero is not one model call or one workflow; it represents multiple agents working as teams across pipelines and roles, all governed and logged.
Where can I see what Agent Zero produces?
The Casebook is a public archive of real investigations Agent Zero has run, redacted but otherwise unmodified, including the signal, the questions asked, the data queried, and the verdict reached.
Book a Command Zero demo.
Live in under an hour. No migration. Zero training data required.
Book a Demo