Senior Software Engineer - Full Stack + GenAI Development

Swimlane, a security orchestration, automation and response solutions provider, has raised $40 million in funding led by EIP. The Denver-based company will use the capital to accelerate partnerships, expand research and development, and enable global expansion. Swimlane has appointed James Brear as chief executive officer. Brear previously served as CEO of Veriflow, which was sold to VMWare in August 2019. Niloofar Howe, senior operating partner at EIP, has joined Swimlane's board. The company's automation platform helps security teams automate tasks and processes, acting as a force multiplier to increase productivity. Swimlane's solution addresses alert fatigue, vendor proliferation and staffing shortages in security operations. The funding follows record sales and customer growth for Swimlane throughout 2020.

Swimlane has expanded its AI SOC platform with intelligent automation routing that cuts investigation costs by up to 90%. The system evaluates each security alert and directs it to one of three paths: deterministic automation, AI-assisted investigation, or fully agentic investigation. The routing approach addresses rising AI token costs by reserving expensive AI models for complex work whilst using automation for routine tasks. A healthcare customer investigating 180 threats daily achieved 90% cost savings by using agentic AI for only the most complex 10% of threats. The platform includes fully agentic investigations requiring zero configuration, self-learning optimisations that convert AI-driven investigations into automated playbooks, and model selection capabilities. Customers can bring their own models to optimise costs. The capabilities are generally available now as part of Swimlane's Turbine release.

What Does preemptive cyber defense Look Like inside an AI SOC? August 12, 2026 An agent can move fast, but without intelligence that already knows what's coming, it can't move early. Security Operations Centers (SOCs) everywhere are being asked to do more with agentic tools. Copilots triage alerts while agents pull context, enrich indicators, and draft investigation summaries before an analyst opens the ticket. While the promise is speed, it's wise to remember that the risk of speed lies in stale or reactive data, which just produces faster wrong answers. A key concern is that adversaries operate on a timeline that security tools often don't track: the preparation phase, when infrastructure is staged weeks before an attack goes live. Silent Push preemptive cyber defense was built to cover that window, and this post explores what happens when that data feeds directly into the AI-assisted workflows SOCs are already building. The problem with feeding AI reactive data. An agent that enriches an indicator is only as reliable as the source it queries. If that source is a traditional Indicator of Compromise (IOC) feed, the agent is enriching evidence of a compromise that has already happened. And while it can move fast, it's still working the wrong end of the timeline. Silent Push Indicators of Future Attack(R)(IOFA) invert that by mapping adversary infrastructure continuously across DNS, IP ranges, behavioral fingerprints, and web content, scanning hundreds of millions of data points to surface staging infrastructure before a campaign deploys. When an agentic workflow queries that data, it isn't merely enriching faster; it's enriching earlier. Agentic enrichment, without the syntax. The Silent Push MCP Server puts that intelligence directly into the tools practitioners use, including Claude and Cursor. An analyst or an agent can ask a plain-language question about an indicator, a domain, or a pattern of infrastructure and receive a deterministic answer. There's no Silent Push Query Language (SPQL) to write out and no separate console to learn. This begins to matter more as SOCs lean on agents to do first-pass triage. An agent pulling from the Context Graph inherits clear data provenance and a queryable structure built for automated enrichment from day one, with 200+ API endpoints designed for this kind of machine-to-machine workflow. The output an analyst reviews is something they can act on, not something they have to re-verify from scratch. Plugging into your existing SOC workflow. None of this requires ripping out the stack. Given the tool sprawl analysts face, its platform is designed for where it's needed most. Silent Push integrates directly into Splunk, Palo Alto XSOAR, Swimlane, Tines, ThreatConnect, Torq, and Sumo Logic. IOC feeds, domain and IP reputation scoring, and SPQL-powered queries flow into existing SIEM and SOAR playbooks. The agentic layer sits atop infrastructure that a team has already invested in. Since preemptive defense within a SOC isn't a new operating platform, it provides earlier-validated context that feeds into playbooks and workflows already in place. What Does This Look Like by Role? | / | The SOC Manager. Your SIEM and SOAR are already ingesting pre-validated, infrastructure-level context, so your team is triaging adversary infrastructure while it's being prepared. | | / | The CTI Analyst. Agentic enrichment is only as good as the pivots behind it. Weak pivots just automate bad guesses faster. Query fingerprints, cluster infrastructure, and threat actor patterns through the same interface your agents use, then export straight to your threat intel platform (TIP). | | / | The IR Lead. When an incident opens, scope is the first question. An agent querying the Context Graph can map an adversary's full staging infrastructure from a single indicator, so your team spends the first hour scoping the actual campaign instead of reconstructing it from fragments. | | / | The CISO. Agentic tools are under scrutiny, and the defensible answer to "What is the AI actually reasoning over?" is infrastructure-level data with a clear history, rather than a black-box feed. Instead of being a mere technical distinction, it's board-ready. | Proof that's not projection. Silent Push Inc. identified staging domains tied to Salt Typhoon in May 2025. Public reporting on the first intrusions didn't emerge until July 2025. Its data provided defenders with a two-month early-warning window that existed before most SOCs had a name for the campaign. This is the gap agentic enrichment is meant to close: not faster analysis of what has already happened, but earlier visibility into what's being staged, enabling organizations to take proactive measures before a threat actor's attack can land. Feeding an AI SOC earlier data can make it faster and, more importantly, right more often. Interested in learning more? Start a conversation with one of its platform experts to learn how preemptive cyber defense can give your team more lead time on adversary infrastructure, before an attack is launched. Silent Push Inc. also offer a free Community Edition so defenders can see how its platform integrates with their existing security stack. FAQs. 1. What is the primary function of an MCP server? An MCP server provides an AI model or agent with a standardized way to access external tools and data, without custom, one-off integration work for every platform it connects to. Instead of an agent needing code to query each different data source, it connects through the same protocol regardless of what's on the other end. For the Context Graph specifically, its MCP Server puts that intelligence directly inside the tools practitioners already use, including Claude and Cursor. An analyst or an agent can ask a plain-language question about an indicator, a domain, or a pattern of infrastructure and get a deterministic answer. There's no SPQL to write and no separate console to learn. 2. What is "agentic enrichment" and how does it work? Agentic enrichment occurs when an AI agent, not an analyst, pulls context for an indicator, a domain, or a piece of infrastructure mid-investigation. Instead of an analyst pausing to run a manual lookup, the agent queries a data source directly and folds the result back into whatever it's building: an alert summary, an investigation timeline, or a triage recommendation, in real time. The mechanism is straightforward. An agent, running inside Claude, Cursor, or another MCP-compatible tool, sends a plain-language query through the MCP Server, and the Context Graph returns a deterministic answer with clear data provenance. What makes that enrichment useful rather than just fast depends on what's on the other end of the query. Enrichment pulled from a traditional IOC feed still only reflects evidence of an attack that has already happened. Enrichment pulled from IOFA data is enriching a campaign before it launches. It's essentially the same mechanism, applied to a different point on the timeline, which is key in proactive defense.