The SOC is where agent autonomy gets tested first. Exabeam's October release shows both sides. Exabeam added a persistent AI investigation assistant, a Claude Skill Pack and ingestion of AI activity logs. Agents now work inside the SOC and are watched by it. AI-generated narration of the full article. Security operations is the enterprise function where AI agents meet the least patience. Analysts are drowning in alerts, so they welcome help. They are also trained to distrust anything they cannot verify, because a wrong conclusion in an investigation has consequences. That combination makes the SOC an early test bed for what bounded autonomy looks like in practice. Exabeam's October 2026 release is a useful snapshot because it moves in two directions at once. Agents are moving into the SOC's own work. And the SOC is starting to watch AI activity across the enterprise as a new kind of signal. What Exabeam shipped. Exabeam's October updates span its cloud-native New-Scale Fusion platform and its LogRhythm SIEM. Agents helping analysts. On New-Scale Fusion, the Exabeam Nova assistant is now a platform-wide sidebar that follows the analyst across screens and keeps context. Exabeam says it automates background context collection, secondary searches and triage assistance during active investigations. A Claude Skill Pack adds prebuilt investigative guidelines for Claude Code so Exabeam Nova can triage the alert queue, prioritize cases and guide investigations through simple commands. A Related Cases feature correlates active and historical cases by shared artifacts and entities. The SOC watching AI. A new ingestion option normalizes Claude Enterprise activity logs and chat API data into a single timeline, which Exabeam positions as closing AI visibility gaps and establishing behavioral baselines for non-human activity. On LogRhythm, new collectors cover ChatGPT, Google Gemini and GitHub Copilot, alongside community Model Context Protocol server support, an OpenSearch migration and a self-service reporting engine. Exabeam's release page does not distinguish general availability from preview for individual features, and it schedules webinars on October 6 and 8. Confirm the status of anything you plan around. Why the SOC pattern generalizes. Look at what the agent does in Exabeam's description: it gathers context, runs follow-up searches, assembles related cases and suggests priorities. It does not close incidents, isolate hosts or disable accounts on its own. The analyst stays the decision maker. That division of labor is the right default for most enterprise agents, not only security ones: * Autonomy on reading, authority on writing. Let agents collect, search, correlate and draft freely within their permissions. Put a human decision in front of actions that change state. * Context persistence is a feature and a risk. A sidebar that remembers the investigation saves time. It also accumulates sensitive material, so its retention and access deserve the same review as the case file. * Skills encode procedure. A skill pack is a written investigation playbook that an agent can follow. That makes the playbook reviewable and versionable, which is better than the procedure living in one senior analyst's head. La Madre saw the same pattern in Google's agents inside code review: agents that work inside an existing control, with deterministic checks and human sign-off, reach production faster than agents that invent a new process. AI activity is now security telemetry. The second direction may matter more over time. Once employees and agents use assistants at scale, AI usage logs become a security data source like email or endpoint logs: who asked what, which data was involved, which agent took which action, and whether that pattern is normal for that identity. Two consequences follow. First, the identity work comes first. Behavioral baselines only make sense if each agent has its own identity, which is the point La Madre made in its piece on agent identity as its own IAM discipline. Second, these logs contain prompts and outputs, often with confidential material, so the SIEM inherits a custody responsibility it did not have before. La Madre explored that tension in its analysis of agent observability. Speed now has a regulatory clock. A listed company already works against a clock: the SEC's cybersecurity disclosure rules require a Form 8-K within four business days of determining that an incident is material. That clock starts at the materiality determination, and the determination depends on how quickly the investigation produces facts. Agents that gather context faster can shorten that path. They also become part of the record of how the company reached its conclusion, so their steps need to be logged and reviewable. What to do now. * Draw the line between reading and acting in your SOC, in writing, before turning on agent assistance. * Review skill packs like runbooks: version them, approve changes, test them against past incidents. * Bring AI activity into the SIEM for your sanctioned assistants, and decide retention and access for prompt data with legal. * Give agents their own identities so the SOC can baseline them, and alert on agents acting outside their normal scope. * Measure the assist, not just adoption: time to first useful context, analyst override rate, cases where the agent's summary was wrong. The bottom line. The SOC is showing what mature agent deployment looks like: agents do the reading and the legwork, people keep the authority, and every AI action becomes something the security team can see. Most enterprise agent programs will end up with the same shape. Security teams just got there first because they cannot afford to guess.

Exabeam expands ai-powered security operations with new Agentic SOC capabilities. BROOMFIELD, Colo., October 1, 2026 - Cybersecurity company Exabeam has announced a new set of capabilities aimed at advancing the use of artificial intelligence in security operations, bringing AI-assisted investigation, execution, monitoring and governance to both cloud and on-premises environments. The company said the new capabilities are designed to help security teams respond to increasingly automated and machine-speed threats while retaining human oversight in critical security decisions. Exabeam's latest developments build on more than a decade of work in machine learning and user and entity behavior analytics (UEBA). The company has expanded this foundation in recent years through generative AI, its Nova AI platform, the Exabeam Model Context Protocol (MCP) Server and Agent Behavior Analytics (ABA), which extends behavioral monitoring to AI agents as well as human users. "The next generation of the SOC won't be defined by more alerts or more automation. It will be defined by how effectively people and AI agents work together," said Steve Wilson, Chief AI and Product Officer at Exabeam. Nova AI expands automated investigation. Among the new capabilities is an expanded version of Exabeam Nova AI, which can operate as a persistent investigator across the platform. The system can gather additional context, conduct secondary searches and retrieve entity profiles as an incident develops. According to Exabeam, its internal security operations team found that Nova AI could triage an average case in approximately 10 minutes, compared with an estimated five hours for a human analyst. The platform has also introduced Related Cases, which groups connected incidents to provide analysts with a broader view of an investigation. Exabeam has also introduced an Agentic SOC Plugin for Anthropic Claude Code and OpenAI Codex. The plugin enables analysts to use natural-language commands to support alert triage, case prioritization and investigation. The company said the plugin is the first in a planned series of capabilities available through its Agent Skills Marketplace. Greater visibility into enterprise AI activity. The company is also expanding its integration with Claude Enterprise, with the aim of providing security teams greater visibility into AI-agent activity. The integration brings prompts, tool calls and actions into a consolidated timeline. Exabeam said event-time analysis and behavior-based correlation can help identify unauthorized AI agents and changes in agent behavior. For security executives, the company has introduced Executive Digest and Outcomes Navigator Overrides. Executive Digest provides security metrics intended for management and board-level reporting, while Outcomes Navigator allows organizations to customize risk scoring and maintain separate compliance metrics across business units. Eduardo Sulvarán Velázquez, Subdirector Cyber Risk Management at E-Global, said Nova AI had helped the organization prioritize cases and provide analysts with faster access to investigative context while retaining human decision-making. LogRhythm brings AI-assisted security operations on-premises. Exabeam also announced developments for organizations that retain security data and AI workloads within their own infrastructure. The updated LogRhythm SIEM Platform introduces AI-assisted security operations for on-premises environments. New generative AI collectors for ChatGPT, Google Gemini and GitHub Copilot are designed to provide centralized visibility into enterprise AI activity through LogRhythm Intelligence Analytics. A new community Model Context Protocol (MCP) server will allow organizations to query, investigate and triage security data using locally deployed generative AI models without transferring that data outside the organization's environment. The platform has also been modernized through an in-place migration from Elasticsearch to OpenSearch. Exabeam said the change is intended to improve scalability and performance while supporting a new self-service reporting engine and AI governance and compliance reporting capabilities. Open-source security initiative expands. Exabeam said its Open Agent and AI Security Community, launched in June 2026, has recorded more than 10,000 downloads. The initiative brings together security practitioners, researchers and engineers working on security issues associated with AI agents and autonomous systems. The company said the community remains open to practitioners and developers interested in contributing to the development of agent and AI security practices. Exabeam, which serves more than 3,000 enterprises globally, specializes in security analytics, user and entity behavior analytics and agent behavior analytics. Its latest product developments reflect the company's broader strategy of applying AI to security investigation while maintaining human oversight and organizational control.

Exabeam brings agentic AI security operations to cloud and on-premises socs. October 1, 2026 Exabeam has introduced new capabilities designed to bring the Agentic SOC to cloud and on-premises environments. The enhanced solution combines AI-driven investigation, execution, and governance. According to the company, traditional analyst workflows cannot keep pace with machine-speed threats or the increasing complexity of goal-driven AI agents and autonomous workflows. The future of the SOC is agentic. Exabeam is a provider of Behaviour Intelligence for the agentic enterprise. For more than a decade, the company has built applied machine learning into security operations. It began with its pioneering work in user and entity behaviour analytics (UEBA). Over the past two years, that foundation has fuelled continued investment in generative AI and agentic security, including Exabeam Nova AI, the Exabeam MCP Server, and the expansion of Agent Behaviour Analytics (ABA) to monitor AI agents alongside human users. "The next generation of the SOC won't be defined by more alerts or more automation. It will be defined by how effectively people and AI agents work together," said Steve Wilson, Chief AI and Product Officer at Exabeam. "The Agentic SOC gives security teams the speed and scale of AI without giving up human judgment, context, or control. That's how defenders keep pace with threats that increasingly operate at machine speed." "The evolution toward an agentic SOC is less about removing analysts from the process. It's more about changing where their time and judgment are applied," said Michelle Abraham, Research VP, Security and Trust, IDC. "As AI agents take on more investigation, context gathering, and repetitive execution. Security teams can focus human expertise on the decisions that matter most. Exabeam's latest capabilities illustrate how that model is beginning to take shape across modern security operations." Accelerating investigation and improving AI visibility. The company says its latest Exabeam New-Scale capabilities help security teams investigate faster and gain visibility into autonomous AI activity. The solution demonstrates programme value to the business without adding headcount. Each is designed to move analysts from alert to resolution faster while keeping human judgment and response in control. * Investigate faster with autonomous Nova AI. Nova AI now works across the platform as a persistent investigator. Gathering context, running secondary searches, and retrieves entity profiles as incidents unfold. As measured by our Exabeam's security operations team, Nova AI triaged an average case in approximately 10 minutes. Thirty times faster than the five hours a human analyst would typically require. Related Cases automatically groups connected incidents, so analysts see the broader picture immediately. * Bring guided investigation to AI CLI Agents. The new Exabeam Agentic SOC Plugin for Anthropic Claude Code and OpenAI Codex brings expert-guided workflows into analysts' AI tools. This helps them triage alerts, prioritise cases, and investigate through natural-language commands. It is the first in a planned series of skills from the Exabeam Agent Skills Marketplace. * Close AI visibility gaps with Claude Enterprise. Deeper Claude Enterprise integration normalises prompts, tool calls, and actions into a single timeline. It uses event-time analysis and behaviour-based correlation to detect rogue agents and behavioural drift. * Prove business outcomes with Executive Digest and Outcomes Navigator. Executive Digest delivers boardroom-ready security metrics. Outcomes Navigator Overrides lets teams tailor risk scoring and separate compliance metrics across business units. Bringing agentic security operations on-premises. The Agentic SOC must operate wherever security data is stored. For organisations running infrastructure, data, or AI workloads on-premises, the modernised LogRhythm SIEM Platform enables AI-assisted security operations locally while maintaining control of sensitive data. New out-of-the-box generative AI collectors for ChatGPT, Google Gemini, and GitHub Copilot give security teams centralised visibility into enterprise AI activity through LogRhythm Intelligence Analytics. A new community Model Context Protocol server lets teams query, investigate, and triage security data using local generative AI models. This is achieved without moving data outside their environment. These capabilities run on a modernised foundation, based on an in-place migration from Elasticsearch to OpenSearch. The update improves speed and scale and supports a new self-service reporting engine with AI governance and audit-ready compliance reporting. Together, these updates bring AI-assisted security operations to organisations needing to keep security data, AI workloads, and compliance reporting on-premises. Enterprise Times: What this means for businesses. For businesses, Exabeam's expanded agentic security capabilities offer faster investigations and broader visibility into employee and AI-agent activity. In addition to the possibility of stronger governance without requiring security teams to grow at the same pace as threats. Cloud and on-premises deployment options give organisations greater flexibility to keep sensitive data within controlled environments and meet compliance obligations. However, the value will depend on disciplined implementation. Companies must maintain human oversight, define clear access and response controls, and verify that AI-generated findings are accurate. Used effectively, the approach could reduce analyst workload, shorten response times, giving executives clearer evidence of security performance and risk.