Exabeam brings AI-assisted security investigations to data that must stay on-premises

Exabeam has introduced a new wave of capabilities that bring the Agentic SOC to life in the cloud and on-premises environments, combining AI-driven investigation, execution, and governance. Analyst workflows alone can’t keep pace with machine-speed threats or the growing complexity of goal-driven AI agents and autonomous workflows. The future of the SOC is agentic.

For more than a decade, Exabeam has built applied machine learning into security operations, beginning with its pioneering work in user and entity behavior analytics (UEBA). Over the past two years, that foundation has fueled continued investment in generative AI and agentic security, including Exabeam Nova AI, the Exabeam MCP Server, and the expansion of Agent Behavior Analytics (ABA) to monitor AI agents alongside human users.

“The next generation of the SOC won’t be defined by more alerts or more automation. It will be defined by how effectively people and AI agents work together,” said Steve Wilson, Chief AI and Product Officer at Exabeam. “The Agentic SOC gives security teams the speed and scale of AI without giving up human judgment, context, or control. That’s how defenders keep pace with threats that increasingly operate at machine speed.”

“The evolution toward an agentic SOC is less about removing analysts from the process and more about changing where their time and judgment are applied,” said Michelle Abraham, Research Vice President, Security and Trust, IDC. “As AI agents take on more investigation, context gathering, and repetitive execution, security teams can focus human expertise on the decisions that matter most. Exabeam’s latest capabilities illustrate how that model is beginning to take shape across modern security operations.”

New Agentic SOC capabilities accelerate investigation and improve AI visibility

The latest Exabeam New-Scale capabilities help security teams investigate faster, gain visibility into autonomous AI activity, and demonstrate program value to the business without adding headcount. Each is designed to move analysts from alert to resolution faster while keeping human judgment and response in control.

• Investigate faster with autonomous Nova AI. Nova AI now works across the platform as a persistent investigator, gathering context, running secondary searches, and retrieving entity profiles as incidents unfold. As measured by our own security operations team, Nova AI triaged an average case in approximately 10 minutes — 30 times faster than the five hours a human analyst would typically require. Related Cases automatically groups connected incidents, so analysts see the broader picture immediately.
• Bring guided investigation to AI CLI Agents. The new Exabeam Agentic SOC Plugin for Anthropic Claude Code and OpenAI Codex brings expert-guided workflows into analysts’ AI tools, helping them triage alerts, prioritize cases, and investigate through natural-language commands. It is the first in a planned series of skills from the Exabeam Agent Skills Marketplace.
• Close AI visibility gaps with Claude Enterprise. Deeper Claude Enterprise integration normalizes prompts, tool calls, and actions into a single timeline and uses event-time analysis and behavior-based correlation to detect rogue agents and behavioral drift.
• Prove business outcomes with Executive Digest and Outcomes Navigator. Executive Digest delivers boardroom-ready security metrics, while Outcomes Navigator Overrides lets teams tailor risk scoring and separate compliance metrics across business units.

“Exabeam Nova AI has helped us prioritize cases more effectively, giving our analysts faster access to the context they need to make confident decisions. We’ve seen how AI can materially improve the speed and efficiency of security investigations without removing human judgment from the process. Extending that intelligence across the platform is the kind of evolution security teams need to address machine-speed threats,” said Eduardo Sulvarán Velázquez, Subdirector Cyber Risk Management at E-Global.

New LogRhythm SIEM platform brings agentic security operations on-premises

The Agentic SOC has to work wherever security data resides. For organizations that keep infrastructure, data, or AI workloads on-premises, the modernized LogRhythm SIEM Platform brings AI-assisted security operations into the local environment while preserving control over sensitive data.

New generative AI collectors for ChatGPT, Google Gemini, and GitHub Copilot give security teams centralized visibility into enterprise AI activity through LogRhythm Intelligence Analytics. A new community Model Context Protocol (MCP) server lets teams query, investigate, and triage security data using local generative AI models without moving data outside their environment.

These capabilities run on a modernized foundation, based on an in-place migration from Elasticsearch to OpenSearch. The update improves speed and scale and supports a new self-service reporting engine with AI governance and audit-ready compliance reporting.

These updates bring AI-assisted security operations to organizations that need to keep security data, AI workloads, and compliance reporting on-premises.