Intezer adds native response automation without separate SOAR

Intezer has announced Workflows, a native automation and response builder that enables security teams to create and customize response workflows directly inside the Intezer platform.

Workflows brings response into the same platform where alerts are triaged and investigated, allowing organizations to automate post-investigation actions without maintaining a separate Security Orchestration, Automation, and Response (SOAR) system.

Security teams can investigate alerts faster than ever, but response often still sits in a separate system. After a verdict is reached, teams may need to rely on standalone SOAR platforms, custom integrations, or manual processes to close alerts, notify analysts, isolate hosts, update tickets, or take other remediation steps.

Workflows closes that gap by bringing customizable response automation directly into the Intezer AI SOC, so actions can run immediately with the full context of the investigation behind them.

“As attackers scale with AI, security teams need security operations that can operate at machine scale,” said Itai Tevet, CEO of Intezer. “By combining forensic-depth investigation with custom, automated response, teams can execute remediation and close the loop faster. Workflows brings response into the same environment where investigation already happens, helping organizations extend AI-driven security operations across the full SOC lifecycle.”

Intezer’s AI SOC Report 2026, revealed nearly 1% of real incidents traced back to alerts classified at the lowest severity levels. For an enterprise generating 450,000 alerts annually, that represents roughly 54 real threats per year, or about one per week, that could go uninvestigated.

The findings show why full-alert coverage matters. SOAR vendors that offer automation built on partial alert coverage and shallow investigation, inherit the same blind spots. By investigating every alert at forensic depth, Intezer can identify low-severity threats and trigger response actions once a verdict is reached.

Intezer Workflows

Intezer Workflows gives security teams control over what happens after an investigation reaches a verdict. Key capabilities include:

• Custom response built into the AI SOC: Teams can build response logic directly in Intezer without maintaining a separate SOAR. Workflows can close alerts, isolate hosts, update tickets, notify analysts, and trigger other actions across the security stack based on investigation outcomes, with no additional API glue or polling required.
• Natural-language workflow creation: Users can describe what they want in plain language through Intezer’s MCP and then review, refine, test, and activate the generated workflow in the platform.
• Investigation context carried into response: Workflows starts with the evidence, data, and organizational context already gathered during the investigation. Actions are reflected back in the relevant alert or case, with each run logged for audit and troubleshooting.

For MSSPs, Intezer Workflows can automate customer communications and per-tenant routing that would otherwise require manual processes.