A

Arctic Wolf

24x7 cloud-native cybersecurity with concierge SOC

Threat Researcher-Cloud & Endpoint Detection

Full-TimeUpdated on 10/21/2026
No salary listed
Mid
Bengaluru, Karnataka, India
In Person
CybersecuritySecurity Operations & Incident Response

About the job

Requirements
  • At least 4 years of experience in detection engineering, threat hunting, security research, Security Operations Center engineering, or security analytics.
  • Expert-level Python expertise to build detection tooling, automation, and frameworks.
  • Deep understanding of endpoint telemetry, including Windows Security and Sysmon logs, Linux auditd, macOS Unified Logs, and Endpoint Detection and Response telemetry.
  • Deep understanding of network telemetry, including NetFlow, Domain Name System, Hypertext Transfer Protocol and Transport Layer Security metadata, and intrusion detection or prevention systems such as Suricata.
  • Deep understanding of cloud telemetry, including Amazon Web Services CloudTrail, Azure Activity Logs, Google Cloud Platform Audit Logs, and Kubernetes audit logs.
  • Deep understanding of identity provider logs, such as Okta and Azure Active Directory/Entra ID, and authentication and authorization events.
  • Deep understanding of email telemetry, including mail flow logs, phishing indicators, and header analysis.
  • Experience building detections using telemetry from cloud, endpoint, identity, email, or security platforms.
  • Ability to analyse third-party integrations, understand vendor-specific schemas and application programming interfaces, and develop detection coverage from ingested telemetry.
  • Hands-on experience with one or more detection technologies, such as Kusto Query Language, Splunk Processing Language, Sigma, Structured Query Language, or equivalent analytics languages.
  • Strong understanding of security telemetry, event correlation, and detection tuning.
  • Experience working with data from security products, cloud platforms, identity providers, or Software as a Service applications.
  • Familiarity with endpoint, identity, cloud, network, and email security telemetry.
  • Ability to analyse unfamiliar security event schemas and build detections from new data sources.
  • Good understanding of adversary tactics, techniques, and procedures and the MITRE ATT&CK framework.
  • Experience designing detection strategies, coverage models, and detection specifications.
  • Ability to evaluate detection effectiveness and identify opportunities to improve attack coverage.
  • Experience providing technical guidance, mentoring, or direction to other detection engineers or developers.
  • Conduct duties in accordance with Arctic Wolf information security policies, standards, and controls.
  • Background checks are required for this position.
  • If applicable, employment is conditioned upon authorization to receive software or technology controlled under United States export control laws and regulations.
Responsibilities
  • Serve as a detection subject matter expert within the Integrations Team.
  • Apply expertise across endpoint, network, cloud, identity, and email telemetry domains to design detections that generalize across customer environments.
  • Contribute to detection strategies and principles to achieve coverage goals.
  • Produce detection specifications and coverage models and determine operational feasibility.
  • Develop detections, correlation rules, and analytics based on telemetry ingested from third-party integrations.
  • Analyse vendor application programming interfaces, audit logs, alerts, and event schemas to identify security detection opportunities.
  • Design detection coverage using data from integrated security products, cloud providers, identity platforms, email security solutions, and endpoint security tools.
  • Partner with integration engineers to understand newly onboarded data sources and maximize security value from collected telemetry.
  • Provide technical guidance and direction to developers through the design, implementation, testing, and tuning of detection content at scale.
  • Research emerging threats, attack techniques, and adversary tactics.
  • Evaluate complex cross-domain signal correlation to address significant and unique detection challenges.
  • Analyse advanced threats and novel attack chains and their implications across telemetry boundaries.
  • Identify opportunities to detect malicious activity using third-party security and Software as a Service telemetry.
  • Map detections to the MITRE ATT&CK framework and maintain alignment with evolving threat landscapes.
  • Improve existing detections by reducing false positives and increasing attack coverage.
  • Exercise independent judgment in detection methodology, technique selection, and criteria for measuring detection efficacy.
  • Provide thought leadership on cross-telemetry detection approaches and contribute to organizational projects requiring an understanding of the wider Extended Detection and Response ecosystem.
  • Develop detections for identity and access security threats, including account takeover, multi-factor authentication abuse and bypass, privilege escalation, suspicious administrative activity, service account misuse, and OAuth and application abuse.
  • Develop detections for email security threats, including business email compromise, phishing campaigns, malicious attachment activity, email forwarding rule creation, suspicious mailbox access, and abnormal email behaviours.
  • Develop detections for endpoint security threats, including malware and ransomware activity, credential theft techniques, suspicious process execution, persistence mechanisms, lateral movement, defence evasion, living-off-the-land techniques, and endpoint compromise indicators.
  • Develop detections for cloud security threats, including excessive permission changes, suspicious cloud administration activity, data exfiltration attempts, resource misconfigurations, cloud account abuse, and workload compromise activity.
  • Analyse network telemetry and cross-domain signals to identify attacker behaviour.
  • Develop detection approaches using network telemetry such as NetFlow, Domain Name System, Hypertext Transfer Protocol, Transport Layer Security metadata, and intrusion detection or prevention system telemetry.
  • Correlate network activity with endpoint, cloud, identity, and email telemetry where applicable.
  • Validate detections against attack simulations, threat scenarios, and real-world telemetry.
  • Assess data quality and telemetry completeness across integrations.
  • Monitor detection performance and effectiveness, identify attack coverage gaps, and recommend enhancements.
  • Define and apply evaluation criteria for measuring detection efficacy.
  • Test and tune detection content to ensure high-value, performant detections at scale.
  • Collaborate with integration engineers, product managers, detection engineers, threat researchers, and Security Operations Center teams.
  • Work with Pipeline, Platform, Threat Enablement, and Artificial Intelligence teams.
  • Provide requirements and feedback for new integrations to ensure detection-readiness.
  • Help shape onboarding strategies for new vendors by identifying telemetry needed for meaningful security analytics.
  • Influence normalization and data-modelling efforts to support scalable detection development.
  • Convey advanced detection concepts and technical information to diverse stakeholders and audiences.
  • Contribute to organizational projects requiring an understanding of the wider Extended Detection and Response ecosystem.
Desired Qualifications
  • Experience with Security Information and Event Management, Extended Detection and Response, Managed Detection and Response, Cloud Native Application Protection Platform, or identity threat detection platforms.
  • Familiarity with security data normalization frameworks such as Open Cybersecurity Schema Framework.
  • Experience working across multiple telemetry domains and developing cross-domain or generalized detection approaches.
  • Experience with attack simulation and detection validation.
  • Experience working with third-party security integrations and vendor-specific data models.
  • Experience with Extended Detection and Response detection programs or large-scale detection content development.

About the company

A

Arctic Wolf

View
cbWebsite

Arctic Wolf provides continuous cybersecurity protection tailored to each organization. It uses a cloud-native platform paired with a dedicated concierge team to deliver around-the-clock monitoring and security operations (SOC) on a subscription basis. The platform integrates security functions to avoid tool sprawl and alert fatigue, while the concierge team works with clients to meet their specific needs. Clients pay for ongoing protection with 24x7 coverage, and Arctic Wolf offers tools like a Total Cost of Ownership Calculator to illustrate savings and ROI. This approach differentiates Arctic Wolf from competitors by combining a unified, cloud-based platform with a personalized delivery model that embeds security experts with each client. The goal is to improve clients’ security posture, reduce unnecessary security tool investments, and lower total costs while providing reliable, continuous monitoring.

Company Size

1,001-5,000

Company Stage

N/A

Total Funding

$899.2M

Headquarters

Eden Prairie, Minnesota

Founded

2012

Get referred to Arctic Wolf

See people who can refer or advise you

Simplify Jobs

Simplify's Take

What believers are saying

  • September 15, 2026: Aurora MDR Connect expands Arctic Wolf into MSPs serving sub-100-employee customers.
  • October 1, 2026: AI Basics and Prompted training monetizes the rising AI-security awareness budget.
  • September 2026 Citrix, Cisco, and N-able exploitation posts reinforce Arctic Wolf’s threat-intelligence credibility.

What critics are saying

  • Agentic SOC launches on March 23, 2026 make differentiation easier for CrowdStrike and Microsoft to copy.
  • September 15, 2026 Aurora MDR Connect invites MSP-channel conflict, cannibalization, and pricing pressure from Huntress.
  • If Aurora’s agentic automation misfires during active incidents, one public failure can undermine trust and trigger churn.

What makes Arctic Wolf unique

  • March 23, 2026: Aurora Agentic SOC embeds AI-led SOC workflows into Arctic Wolf’s concierge model.
  • Arctic Wolf’s 30-day deployment beats industry-standard SOC builds that often take over a year.
  • September 7, 2026: Bengaluru became Arctic Wolf’s largest R&D hub, with 550-plus employees.

Help us improve and share your feedback! Did you find this helpful?

Benefits

  • Equity For All Employees
  • Diverse, equitable, & inclusive workplace
  • Remote Work Opportunities
  • Paid Parental Leave
  • Flexible Paid Time Off For All Employees
  • Professional Development

Growth & Insights and Company News

Headcount

6 month growth

0%

1 year growth

0%

2 year growth

1%
Arctic Wolf
Oct 15th, 2026
Inside Arctic Wolf and Anthropic's trust-first approach to the Agentic SOC.

Inside Arctic Wolf and Anthropic's trust-first approach to the Agentic SOC. Arctic Wolf built trust into the foundation of the Aurora Agentic SOC. Learn how Arctic Wolf partner with Anthropic to include Claude models within its security operations platform. * In this article * Frontline Threats Demand Frontier Protection * Why Arctic Wolf Chose to Collaborate with Anthropic * Delivering Trust and Safety from the World's Largest Commercial Agentic SOC * A Collaboration That Will Keep Advancing In the recently released 2026 SANS AI in Cybersecurity Survey, nearly two out of three security professionals said they have been given AI-generated guidance that later turned out to be wrong. Not from an experimental tool off in a sandbox, but from systems built into the security stack they were told to rely on. Security teams should not have to live with that. They need to trust the systems that protect them, which is why trust had to be engineered into the foundation of its security operations platform and agentic security operations center (SOC), not bolted on afterward. Frontline Threats Demand Frontier Protection. In recent years, attackers have put AI to work at machine speed, automating reconnaissance, phishing, and exploit development at a pace human-led security teams were never built to match. Speed doesn't favor both sides equally. If an attacker's tool fails, or an AI-generated exploit produces an incorrect result, the cost to the attacker is close to zero. They try again. Defenders do not get that luxury. An AI agent that makes the wrong call inside an organization's environment, missing a real threat or acting on a false one, can mean damage to that business, and a win for the attacker. An agentic SOC that moves fast but gets it wrong only benefits attackers. Meeting frontline threats like these takes more than speed. It takes frontier protection, defenses built on AI capable enough to match the attacker and trustworthy enough to be allowed to act. Why Arctic Wolf Chose to Collaborate with Anthropic. That asymmetry is exactly why trust has to be core to what Arctic Wolf build, and why Arctic Wolf made the decision to collaborate with Anthropic to help Arctic Wolf achieve that. Their mission is to ensure the world safely navigates the transition through transformative AI, and for Arctic Wolf here at Arctic Wolf, safety and trustworthy AI are inseparable. That alignment, more than any single feature, is why working together made sense from the start. The first result of that collaboration was the Aurora Security Assistant, which Arctic Wolf unveiled at the RSA Conference in 2025. Built in part with Claude models, it gives customers natural language access to security insight uncovered by the Aurora Superintelligence Platform, helping them get faster answers to complex security questions via a simple, chat-based interface. Delivering Trust and Safety from the World's Largest Commercial Agentic SOC. Over the last 18 months, its collaboration has only deepened. Anthropic's Claude models now run throughout the Aurora Superintelligence Platform, including the agents within the Swarm of Experts, the agentic framework that executes key functions of its SOC. That framework now supports thousands of organizations worldwide and performs more than 200,000 security investigations a week, a scale that makes the Aurora Agentic SOC the largest commercial agentic SOC in the world. This week, at Arctic Wolf's annual Security Operations Summit, Arctic Wolf shared the stage with Ash Alhashim, Head of Enterprise Cybersecurity GTM, Anthropic, who spoke to just how far this collaboration has come. "Arctic Wolf's team knows security operations deeply, and that shows in how they've put Claude to work," he said from the stage. "We've learned a lot from working with them and we're glad to keep building together." Today, the Swarm of Experts in the Aurora Agentic SOC resolves more than 60% of its investigations autonomously, with high confidence. That level of unassisted resolution comes from technology Arctic Wolf has built, leveraging Anthropic's models as part of the foundation. The same technology has also helped customers resolve cases 26% faster year over year, which means they are not just getting faster answers but better ones. The occurs because Swarm of Experts draws on real investigations across its entire customer base and on each customer's own unique environment, so the guidance behind every investigation is tailored to their needs. Its work together also extends to Anthropic's Cyber Verification Program, which gives vetted security teams access to Anthropic's most capable models with reduced blocking classifiers for legitimate cyber work. Arctic Wolf is part of the program and has access at the Defense Access tier, which is built for defensive work such as security operations center and incident response tasks. It is another sign of the trust between its teams, and it helps ensure the models behind the Aurora Agentic SOC can support the demands of real defensive work. A Collaboration That Will Keep Advancing. In under two years, Arctic Wolf and Anthropic have made incredible strides in advancing agentic security operations together. What began as a single AI security assistant has grown into the reasoning layer behind the world's largest commercial agentic SOC, delivering faster, more accurate outcomes for thousands of customers around the globe each week. But the best is yet to come. Arctic Wolf and Anthropic will continue to work together to find new ways to build Claude's capabilities into the Aurora Superintelligence Platform and deliver new innovations, as both the threats and the SOCs built to stop them keep moving at machine speed.

GlobeNewswire
Oct 15th, 2026
Arctic Wolf and Veeam partner to bring backup intelligence into Security Operations.

Arctic Wolf and Veeam partner to bring backup intelligence into Security Operations. New joint integration extends visibility into critical backup infrastructure, helping organizations detect threats faster, investigate incidents more effectively, and strengthen cyber resilience. EDEN PRAIRIE, Minn., Oct. 15, 2026 (GLOBE NEWSWIRE) - Arctic Wolf(R), the cybersecurity and AI company, today announced a strategic partnership with Veeam, the Data and AI Trust Company, to bring backup and recovery intelligence into the Aurora(R) Superintelligence Platform, Arctic Wolf's AI-native security operations platform, helping organizations strengthen security and improve cyber resilience. By integrating Veeam Data Platform events with the Arctic Wolf Aurora Superintelligence Platform and the Aurora Agentic SOC, organizations can extend visibility into critical backup infrastructure, reduce security blind spots, and improve their ability to detect, investigate, and respond to cyber threats. As organizations face increasingly sophisticated cyber threats, with AI accelerating both the speed and scale of attacks, backup and recovery environments have become attractive targets for attackers seeking to disrupt operations and increase the impact of an incident. At the same time, growing volumes of security data and limited resources make it harder for security teams to identify the threats that matter most and understand their potential business impact. For many organizations, these risks have already become reality. Arctic Wolf's 2026 AI & Cybersecurity Trends Report found that 63% of surveyed organizations experienced a significant cybersecurity incident in the past year. In those moments, recovery systems become critical to restoring operations and maintaining business continuity. Yet when backup activity remains siloed from broader security operations, analysts often lack the context needed to quickly assess suspicious activity, understand the scope of an attack, and support recovery efforts. To address this challenge, Veeam security and operational events flow into the Aurora Superintelligence Platform, where Arctic Wolf analyzes them alongside more than 10 trillion security events processed each week across customer environments. Arctic Wolf monitors key backup and recovery activity, including malware detections, suspicious user behavior, unauthorized restore attempts, failed backup operations, and administrative changes. By applying targeted detections to these signals, Arctic Wolf helps identify meaningful threats and provide security teams with greater visibility into critical recovery infrastructure. "Organizations depend on their recovery environments to maintain business continuity when an incident happens, making visibility into those systems critical for cyber resilience," said Dan Schiappa, President, Technology and Services at Arctic Wolf. "In the age of AI, security teams don't need more alerts. They need context to understand what matters and how to respond. By bringing Veeam backup intelligence into the Aurora Superintelligence Platform, we're helping customers gain a more complete view of their environment, accelerate investigations, and strengthen the resilience outcomes that matter most to their business." For existing Veeam(R) Software customers using Arctic Wolf, the partnership adds managed security operations to one of the most critical components of their resilience strategy. Organizations can continue to leverage Veeam's immutable backups, recovery capabilities, and backup integrity verification while gaining additional visibility, threat monitoring, expert investigation, and security context from Arctic Wolf. "Data and AI trust requires security and resilience to operate as one connected discipline," said Michelle Graff, Senior Vice President for Global Partners and Channel at Veeam. "By bringing Veeam signals into Arctic Wolf's security operations platform, we are giving organizations greater visibility into threats affecting their critical data and recovery environments. This partnership helps customers strengthen the trusted, secure, and resilient data foundation they need to maintain business continuity and safely accelerate AI at scale." The partnership builds on the shared commitment of Arctic Wolf and Veeam to help organizations strengthen cyber resilience through greater visibility and coordination across security and recovery environments. The companies plan to further connect security operations and data resilience, bringing exposure management, detection and response, and recovery workflows closer together to help organizations make better security decisions and improve business resilience. About Arctic Wolf Arctic Wolf is the cybersecurity and AI company that ends cyber risk by transforming it into business resilience. Powered by the Aurora(R) Superintelligence Platform, Arctic Wolf delivers modern security operations built on proprietary AI and decades of real-world expertise. By combining AI-driven automation with expert-validated precision, Arctic Wolf helps organizations confidently manage cyber risk, so they can operate with control and the freedom to innovate. To learn more about Arctic Wolf, visit www.arcticwolf.com. Media Contact Oliver Cowley Manager, Corporate Communications at Arctic Wolf [email protected] (C) 2026 Arctic Wolf Networks, Inc. All Rights Reserved. Arctic Wolf, Aurora, Alpha AI, Arctic Wolf Security Operations Cloud, Arctic Wolf Managed Detection and Response, Arctic Wolf Managed Risk, Arctic Wolf Managed Security Awareness, Arctic Wolf Incident Response, and Arctic Wolf Concierge Security Team are either trademarks or registered trademarks of Arctic Wolf Networks, Inc. Disclaimer: This press release may include forward-looking statements. These reflect its current views and are subject to change. They are not guarantees, and actual results may vary. Integration announcements reference third-party technologies. Arctic Wolf does not claim ownership of partner technologies and functionality is subject to partner product capabilities.

SecurityInformed.com
Oct 15th, 2026
Arctic Wolf launches Aurora Adaptive Threat Protection.

Arctic Wolf launches Aurora Adaptive Threat Protection. 15 Oct 2026 Quick Read Summary is AI-generated, newsdesk-reviewed * Arctic Wolf launched Aurora Adaptive Threat Protection, an AI-powered endpoint security solution, at 2026 summit. * Intent-based detection analyzes endpoint activity to disrupt and roll back ransomware and credential theft earlier. * Exclusive beta availability; complements existing EPP and EDR tools with minimal performance impact. Arctic Wolf introduced Aurora Adaptive Threat Protection at its 2026 Security Operations Summit, describing it as an endpoint security solution designed to detect and disrupt ransomware, credential theft and other evasive attacks earlier in the attack chain. The company says the product uses AI-powered, intent-based analysis to identify malicious activity and can reverse attacks before they cause significant damage. The solution is designed to run alongside existing endpoint protection (EPP) and endpoint detection and response (EDR) tools, including third-party products and Aurora Endpoint Security. Arctic Wolf says organizations can add it without replacing their current endpoint security platforms. Detecting malicious intent earlier. Rather than relying on individual indicators of compromise, Aurora Adaptive Threat Protection analyzes how processes and events unfold across an endpoint. It looks for patterns in which actions that may initially seem legitimate begin to point toward a malicious outcome. The company says this approach can enable the solution to interrupt and roll back attacks before they fully develop. Aurora Adaptive Threat Protection analyzes how processes and events unfold across an endpoint The launch comes as attackers increasingly use compromised credentials, trusted tools and gradual techniques to blend into routine business activity. Arctic Wolf says ransomware accounted for 44% of its incident response engagements in the last year. It also cites an estimate that credential-harvesting malware collected 1.7 billion credentials from 7.4 million infected devices. As AI helps attackers automate reconnaissance, accelerate intrusions and scale campaigns, security teams face pressure to identify threats earlier. Gartner(R) recently noted, "To stay ahead of AI-augmented attacks, enterprises are increasingly moving beyond reactive monitoring toward preemptive controls, specifically capabilities that can deny, deceive, and disrupt adversaries." How the endpoint security solution works. Aurora Adaptive Threat Protection builds a causal graph of endpoint activity, including processes, files, registry activity and API calls. By retaining context over time, it can assess how events are connected and look for attacker intent even when individual actions appear benign. The product also uses agentic workflows and a custom-trained small language model to evaluate activity and distinguish normal business operations from emerging threats. When it confirms malicious intent, Arctic Wolf says the solution can automatically stop the activity and reverse the attack chain, with the aim of reducing recovery time and manual remediation. "Attackers often don't need malware to cause damage. They can use legitimate tools, trusted credentials, and AI-driven automation to hide in plain sight, all at machine speed," said Dan Schiappa, President of Technology and Services at Arctic Wolf. "That's why endpoint security needs to evolve. Endpoint detection and response does rich detection well, but that work needs to happen earlier. Aurora Adaptive Threat Protection shifts the mindset from a purely detection and response approach to a more preemptive approach, identifying malicious intent and disrupting threats earlier in the attack chain." Designed to complement existing tools. Arctic Wolf says the solution provides visibility into the history of endpoint activity Arctic Wolf says the solution provides visibility into the history of endpoint activity, helping security teams connect events that may otherwise appear unrelated. It is designed to roll back malicious activity to help restore normal business operations and to operate without materially affecting endpoint performance, memory or CPU use. The company also says earlier intervention and rollback can reduce the administrative work involved in response and remediation. Aurora Adaptive Threat Protection is backed by the Aurora Superintelligence Platform, which processes more than 10 trillion security events each week across more than 11,000 customers. Arctic Wolf says the service combines AI-driven analysis with its security operations platform and is intended to complement existing endpoint solutions, with human oversight and validation. Aurora Adaptive Threat Protection is now available in an exclusive beta for Arctic Wolf customers. Enrollment for organizations interested in participating opens today.

Yahoo Finance
Oct 14th, 2026
Arctic Wolf launches AI-driven endpoint tool that disrupts and rolls back attacks mid-flight

Arctic Wolf has launched Aurora Adaptive Threat Protection, an endpoint security product that uses AI to spot and stop attacks earlier. The company unveiled it on October 14, 2026, at its Security Operations Summit. The tool maps endpoint activity to detect malicious intent, even when individual actions look harmless. It can interrupt an attack and roll back its effects. It runs alongside existing endpoint protection and detection tools, so customers need not replace them. Arctic Wolf says ransomware made up 44% of its incident response engagements in the past year. It is backed by a platform that processes more than 10 trillion security events a week across more than 11,000 customers. The product is now in exclusive beta for Arctic Wolf customers.

GlobeNewswire
Oct 14th, 2026
Arctic Wolf expands the Aurora Superintelligence Platform to Deliver AI visibility, broader Security Coverage, and new generative Assistant skills.

Arctic Wolf expands the Aurora Superintelligence Platform to Deliver AI visibility, broader Security Coverage, and new generative Assistant skills. New Shadow AI Discovery(TM) capability, enhanced Aurora Security Assistant skills, and expanded integrations help organizations govern AI, accelerate investigations, and strengthen their security posture. EDEN PRAIRIE, Minn., Oct. 14, 2026 (GLOBE NEWSWIRE) - Arctic Wolf(R), the cybersecurity and AI company, today announced at the 2026 Security Operations Summit new capabilities in the Aurora(R) Superintelligence Platform that help organizations gain visibility into AI adoption, access security insights faster, and extend protection across customers' rapidly expanding attack surfaces. As AI adoption accelerates across the enterprise, organizations face a growing challenge that they cannot secure what they cannot see. Employees are rapidly embracing AI-powered tools, security teams are managing increasingly complex environments, and critical security information remains scattered across multiple platforms and applications. Without visibility, organizations can't effectively manage AI risk. As a result, security teams struggle to prioritize risk and take action. According to a report by the Cloud Security Alliance, 98% of organizations experienced unsanctioned AI use. To help customers address these challenges, Arctic Wolf is introducing Shadow AI Discovery, a new feature that is designed to uncover and inventory sanctioned or unknown AI tools in use across an organization. Additionally, the company is adding new Aurora Security Assistant capabilities, and expanded technology integrations that bring more data, intelligence, and visibility into the Aurora Superintelligence Platform. "Security teams are under pressure to move faster while managing more data, more threats, and more AI risk than ever before," said Nick Schneider, president and chief executive officer at Arctic Wolf. "Visibility is the foundation of security in the age of AI. The advancements we are introducing today of the Aurora Superintelligence Platform help customers understand how AI is being used across their environment so they can establish stronger management processes and act on insights in real time." Visibility into AI Activity Across the Environment AI adoption is happening faster than many organizations can inventory, manage, or assess risk. According to the SANS 2026 AI Survey, 63% of practitioners cite a lack of visibility into where AI models are being used and what information they may expose. Soon available to Aurora Managed Detection and Response(R)(MDR) customers, Shadow AI Discovery is designed to identify AI tools in use across network, identity, and endpoint telemetry to create an inventory of AI activity, enable classification as sanctioned or unknown, and highlight potential data exposure risks without requiring additional deployments. With a centralized inventory of AI usage, organizations can better identify unauthorized tools, measure AI adoption trends, and evaluate the effectiveness of governance policies over time. When gaps are identified, organizations can assign AI-focused training through Aurora Security Awareness and Training to teach employees AI best practices and reduce human risk. Advancing Aurora Security Assistant to Deliver Comprehensive Answers Across Risk, Exposure, and Operational Queries Arctic Wolf is also significantly enhancing Aurora Security Assistant, the natural language interface to the Aurora Superintelligence Platform, with new skills that provide greater access to insights across the Arctic Wolf portfolio. Customers can now get information from Aurora Exposure Management, Aurora Threat Intelligence, and their own Security Journey, helping them to investigate issues faster and prioritize with context, all through simple, natural language conversation. The new skills enable customers to ask questions about outstanding Security Posture In-Depth Review (SPiDR) findings and Security Journey actions, such as what requires attention, which reviews need a response, and what steps should be taken next. They can also quickly understand their current risk posture by identifying critical vulnerabilities, riskiest assets, and endpoints that failed recent vulnerability scans. Grounded in the Security Operations Graph of the Aurora Superintelligence Platform(R), Aurora Security Assistant helps customers move from searching for information to taking action, providing self-service access to security insights, recommendations, and operational context in seconds. Expanded Integrations Extend Security Coverage Arctic Wolf is further expanding the Aurora Superintelligence Platform with multiple new technology integrations enabled by the platform's Open Data Pipeline, which converts raw telemetry from across a customer's attack surface into high-quality security signal. These integrations broaden the telemetry monitored by the Aurora Agentic SOC and extend detection and active response capabilities across customers' existing environments, so organizations enhance the value of the technologies they already use without replacing them. New coverage includes: * Web Application Firewalls (WAFs): New Cloudflare and Imperva integrations enable detection and active response for threats targeting web applications and services, helping customers respond faster to malicious activity. * Backup and Recovery: A new integration with Veeam brings backup and recovery intelligence into the Aurora Superintelligence Platform, extending visibility into backup infrastructure that attackers increasingly target to disrupt recovery efforts. * Medical Provider Applications: New integrations with Epic Systems EHR, Claroty xDome Healthcare, and Imprivata ITDR. * Additional integrations: ExtraHop Reveal(x) 360, Datadog, Proofpoint Essentials, 1Password, Google Workspace, Trend Vision One Endpoint Security, Palo Alto Cortex, and Claroty xDome Industrial. Together, these integrations bring even more of the customers' security ecosystem into the Aurora Superintelligence Platform, helping them expand visibility, strengthen detection and response, and get more value from their existing technology investments. About Arctic Wolf Arctic Wolf is the cybersecurity and AI company that ends cyber risk by transforming it into business resilience. Powered by the Aurora(R) Superintelligence Platform, Arctic Wolf delivers modern security operations built on proprietary AI and decades of real-world expertise. By combining AI-driven automation with expert-validated precision, Arctic Wolf helps organizations confidently manage cyber risk, so they can operate with control and the freedom to innovate. To learn more about Arctic Wolf, visit www.arcticwolf.com. Media Contact Oliver Cowley Manager, Corporate Communications, Arctic Wolf [email protected] Disclaimer: Shadow AI Discovery is planned for availability to select customers beginning in November 2026 and is not yet generally available. Timing, features, and functionality may change. This blog may include forward-looking statements. These reflect its current views and are subject to change. They are not guarantees, and actual results may vary.