Senior Software Engineer - DevOps

Tanium relaunches Security Operations to counter AI attacks. Fri, 9th Oct 2026 (Today) Tanium has relaunched its Security Operations product, positioning the update to address attacks shaped by artificial intelligence. The relaunch focuses on combining detection, response and threat hunting in a single workflow tied to endpoint data already used by IT teams. The product is designed to work alongside existing security information and event management and endpoint detection and response tools, rather than replace them. Tanium argues that attackers are increasingly using stolen credentials and common administrative tools instead of malware, making them harder to detect with systems focused on known malicious files. In response, the updated product looks for unusual behaviour on devices and lets security teams take action across large numbers of endpoints from the same platform. Among the additions is Endpoint Drift, which learns how individual endpoints normally behave and flags machines operating outside those patterns. Tanium also introduced an Insights Engine, replacing its previous process injection detection approach with a system intended to identify attackers hiding inside trusted processes. On the response side, analysts can stop a single process, collect forensic evidence or isolate a host on one machine or across a wider estate. Tanium also introduced a Federated SOC model that allows separate security teams to use one platform while keeping their own suppression settings and automated response rules separate. Hunting focus Another part of the relaunch is Tanium Atlas, which is intended to broaden access to threat hunting beyond specialist teams. Analysts can submit questions in plain language, receive answers from endpoints in seconds and take action within the same interface. Hunt strategies created by Tanium's own threat hunters are built into the workflow. Atlas can also rank alerts and recommend whether analysts should dismiss, escalate, investigate further or contain them, while new dashboards and templates are intended to give teams a starting point. "AI has changed who the attacker is and how fast they move. The next breach won't look like malware. It will look like one of your own administrators," said Harman Kaur, Chief Technology Officer at Tanium. "We have spent years learning what normal looks like on every endpoint our customers run. Now we use that to catch what doesn't belong and stop it everywhere at once. That is what security operations has to become in the AI era," Kaur said. Tanium is also offering HuntIQ, a service that pairs Tanium threat hunters with the same platform and artificial intelligence tools used in the product. According to the company, those teams work inside customer environments to identify threats, refine detections and support incident response. HuntIQ teams can also build hunts before a patch or common vulnerabilities and exposures entry exists. Tanium cited FalconFlank as an example of a zero-day case in which this approach had been used. Market pressure The relaunch comes as security vendors adapt products to address attacks that unfold more quickly and often rely on legitimate tools already present in enterprise environments. That shift has increased the emphasis on near real-time visibility at the endpoint and faster action once suspicious behaviour is identified. Dave Gruber, Chief Analyst at Omdia, said the speed of modern attacks is exposing the limits of many current security operations processes. "The AI-fueled threat landscape has changed the dynamics of security operations," said Dave Gruber, Chief Analyst at Omdia. "Speed is more important than ever before, as attack execution speeds outpace current security operations mechanisms and processes. Agentic capabilities can speed detection and response, but without access to near real-time telemetry and response, agentic SOC capabilities still lag attacker activities. Tanium's approach of grounding detection and hunting in real-time endpoint state addresses one of the most persistent gaps in enterprise SOC architectures." Tanium said the updated Security Operations offering is available now, tying the relaunch to a broader strategy that links endpoint management and security operations through the same underlying platform and data.

Tanium relaunches security platform to counter AI attacks. Wed, 7th Oct 2026 (Yesterday) Tanium has relaunched its Security Operations platform to address attacks that use stolen credentials and standard administrative tools rather than malware. The updated product combines detection, response and threat hunting in a single workflow built on endpoint data already used by IT teams. It is designed to work alongside existing security information and event management and endpoint detection and response products, not replace them. The relaunch reflects a wider shift in cybersecurity as attackers rely less on malicious files and more on legitimate tools already present on corporate machines. That can make intrusions harder to spot because the activity may resemble routine work by internal administrators. One new element, Endpoint Drift, is intended to identify devices behaving outside their normal pattern. Another, Insights Engine, is designed to detect attackers operating inside trusted processes, replacing Tanium's previous process injection detection approach. Response functions have also been expanded so security teams can take action across large numbers of devices. Those actions include stopping a process, gathering forensic evidence and isolating a host on individual machines or across a wider estate. Tanium has also introduced what it calls a Federated SOC model. Under that setup, separate security teams can use the same platform while maintaining different suppression rules and automated response settings for their own environments. Another part of the relaunch focuses on threat hunting, an area often limited to experienced analysts because of the time and skill involved. Tanium said its Atlas tool allows analysts to ask questions in plain language, receive answers from endpoints in seconds and take follow-up action from the same interface. Atlas also prioritises alerts and suggests whether each should be dismissed, escalated, investigated through a hunt or contained. Tanium has added security operations dashboards and templates intended to give teams a starting point for these workflows. Harman Kaur, Chief Technology Officer, Tanium, said the changes were a response to the way artificial intelligence is reshaping attacker behaviour. "AI has changed who the attacker is and how fast they move. The next breach won't look like malware. It will look like one of your own administrators," Kaur said. She added: "We have spent years learning what normal looks like on every endpoint our customers run. Now we use that to catch what doesn't belong and stop it everywhere at once. That is what security operations has to become in the AI era." Market shift Tanium argues that many established security tools were built to identify known malicious files or signatures, while newer attacks may begin with a valid login and spread using built-in administration tools. In response, vendors are placing more emphasis on behaviour-based detection and rapid response tied to live endpoint telemetry. That shift has also driven greater interest in automation inside security operations centres, particularly as teams face large alert volumes and pressure to respond more quickly. Tanium is positioning its updated platform around that demand while stressing that automated actions remain governed by user-defined rules. External analysts broadly share the view that the operational tempo of attacks has increased. Dave Gruber, Chief Analyst, Omdia, said, "The AI-fueled threat landscape has changed the dynamics of security operations." He continued: "Speed is more important than ever before, as attack execution speeds out pace current security operations mechanisms and processes. Agentic capabilities can speed detection and response, but without access to near real-time telemetry and response, agentic SOC capabilities still lag attacker activities. Tanium's approach of grounding detection and hunting in real-time endpoint state addresses one of the most persistent gaps in enterprise SOC architectures." Services link Alongside the platform update, Tanium is also highlighting HuntIQ, a service that pairs its threat hunters with customer environments. The company said those specialists use the same platform and artificial intelligence tools to search for threats, improve detections and support incident response. Tanium said lessons from that work are fed back into the product, including hunts created before a patch or common vulnerability and exposure reference is available. It cited its response to the FalconFlank zero-day as an example of that model. The relaunch underlines how endpoint-focused vendors are trying to move beyond device management and traditional detection by tying together visibility, investigation and remediation. For security teams, the key test will be whether those integrated workflows reduce response times without adding to the operational burden of already crowded toolsets. The updated Security Operations offering is available now.

Tanium unveils New SecOps capabilities. Tanium expands SecOps with real-time endpoint intelligence, AI-native hunting and agentic response to detect, investigate and contain threats faster. Oct 6, 2026 Channel Insider content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More Tanium has announced new security operations capabilities that give IT and security operators greater detection depth, response options, and AI-native hunting to investigate, contain, and resolve threats faster within live endpoint intelligence. The Tanium Security Operations capabilities are powered by Tanium Atlas, the company's autonomous operating system that allows customers to build a self-driving SOC that runs autonomously within the guardrails an operator sets. Tanium expands SIEM and EDR with live endpoint data. Tanium Security Operations enables IT and security operators to reason over the endpoint as it currently exists, extend existing SIEM and EDR investments, and act from a single platform. The portfolio of capabilities combines real-time visibility across managed endpoints and the ability to act safely at speed and scale. It features three pillars: * Detection depth and data fidelity: Threat detection against live endpoint state, not aged data. New Endpoint Drift surfaces abnormal behavior relative to historical baselines, and the Insights Engine detects advanced in-memory techniques, delivering faster, more focused hunting and better prioritization of suspicious activity across the fleet, with faster protection delivery. * Diverse response: Tanium pairs detection with a full spectrum of response options executed directly on the endpoint, from quarantining hosts to collecting forensic evidence. A new Federated SOC architecture lets operators work independently on a single platform, backed by a modernized Windows quarantine designed for agentic SOC actions and safer multi-team operations. * AI-native hunting: Tanium Atlas helps IT and security operators investigate threats, prioritize alerts, and determine next steps. With New Alert Prioritization and Triage, the queue is ranked to recommend whether to dismiss, escalate, hunt, or contain, resulting in faster alert-to-decision time, less analyst fatigue, and fewer low-value alerts. New SecOps dashboards and templates make expert-level hunting faster to scale. "Security teams don't need another tool that generates more alerts. They need the truth about what's happening on their endpoints right now, and the power to act on it before an attacker does," said Harman Kaur, CTO, Tanium. "Tanium Atlas brings live endpoint intelligence and agentic AI together so operators can detect what is abnormal, investigate it in context, and respond immediately. The customer sets the rules and autonomy runs the workflow." Google Threat Intelligence adds investigation context. These new integrations deepen the context provided by live endpoint data. Google Threat Intelligence in Tanium SecOps brings premium intelligence directly into investigation and hunting workflows, while multi-provider reputation intelligence from five leading providers reduces false positives and accelerates triage. "The AI-fueled threat landscape has changed the dynamics of security operations," said Dave Gruber, chief analyst at Omdia. "Speed is more important than ever before, as attack execution speeds outpace current security operations mechanisms and processes." "Agentic capabilities can speed detection and response, but without access to near real-time telemetry and response, agentic SOC capabilities still lag attacker activities. Tanium's approach of grounding detection and hunting in real-time endpoint state addresses one of the most persistent gaps in enterprise SOC architectures," Gruber added. HuntIQ combines threat hunters with agentic AI. Additionally, Tanium HuntIQ combines security research, expert threat hunters, and agentic AI built on Tanium Atlas for organizations that want to further minimize risk. Tanium HuntIQ experts work directly within customer environments to identify threats, strengthen detections, and support incident response. The findings are then fed back into the platform so that every subsequent hunt starts in a more intelligent place. What Tanium's SecOps expansion means for MSPs. For MSPs and MSSPs, the bigger opportunity is operational. Tanium is combining live endpoint telemetry, AI-assisted alert prioritization, threat hunting, and response into a single SecOps workflow, which could help providers reduce the manual effort of correlating alerts across multiple tools. The new capabilities include endpoint-level response actions and a Federated SOC architecture designed to support separate teams working from a shared platform. That fits a broader trend Channel Insider has been tracking around platform consolidation and agentic SecOps. As security providers look to expand managed detection and response and threat hunting without growing analyst headcount at the same rate, automation becomes more valuable when it is grounded in current endpoint data rather than in another layer of alerts. For Tanium partners, that could create room to build more advanced managed security services around Atlas and SecOps, although the announcement does not detail MSP-specific packaging, multi-tenancy, or partner economics. Jordan Smith is an enterprise technology and cybersecurity journalist with nearly a decade of experience covering B2B IT, federal technology, artificial intelligence, cybersecurity, cloud computing, and emerging digital trends. His reporting helps business and technology leaders understand how new technologies, security challenges, and infrastructure decisions affect modern organizations. Jordan has reported on enterprise and public-sector technology for TechnologyAdvice, HCLTech, MeriTalk, and Channel Insider. His background spans cybersecurity, cloud infrastructure, AI adoption, digital transformation, and federal IT initiatives, giving him a broad perspective on the tools, policies, and innovations shaping today's technology landscape. Before joining TechnologyAdvice, Jordan served as a Senior Technology Reporter at MeriTalk, where he covered the federal IT space, and later worked as a US Regional Reporter and Copy Editor/Writer for HCLTech. His experience across reporting, copyediting, podcasting, and event moderation allows him to translate complex technical topics into clear, timely, and useful insights for business audiences. Jordan holds a Master of Arts in Journalism from the University of Nebraska-Lincoln and a Bachelor of Science in Criminal Justice and Psychology from Edgewood University. Through his work, he helps readers stay informed about cybersecurity developments, enterprise technology trends, and the business impact of emerging IT solutions.