Security operations centres are facing a two-sided problem. Attackers are increasingly automating their campaigns, while inside the business, AI agents and autonomous workflows are multiplying faster than most security teams can track. Exabeam’s answer, unveiled on October 1, is a broad set of updates designed to let AI take on more of the investigative legwork without removing human analysts from the decisions that matter.
The Broomfield, Colorado-based company, best known for pioneering user and entity behavior analytics (UEBA), has spent the past two years extending that foundation into generative and agentic AI. Its Exabeam Nova AI, Exabeam MCP Server and Agent Behavior Analytics (ABA), which monitors AI agents alongside human users, form the basis of the latest release.
Steve Wilson, Chief AI and Product Officer at Exabeam, argues that the next phase of the SOC will not be measured by alert volumes or automation alone. “It will be defined by how effectively people and AI agents work together,” he said. “The Agentic SOC gives security teams the speed and scale of AI without giving up human judgment, context, or control.”
Industry analysts see a similar shift. Michelle Abraham, Research Vice President, Security and Trust at IDC, said the move toward an agentic SOC “is less about removing analysts from the process and more about changing where their time and judgment are applied,” with AI agents absorbing investigation, context gathering and repetitive execution so that people can focus on higher-stakes calls.
From Alert To Resolution, Faster
At the centre of the update, Nova AI now operates across the Exabeam New-Scale platform as a persistent investigator, gathering context, running follow-up searches and pulling entity profiles as incidents develop. A Related Cases feature automatically groups connected incidents so analysts can see the wider pattern of an attack rather than isolated alerts.
Exabeam is also leaning into the AI tools analysts are already adopting. A new Guided Investigation Skills Pack for Anthropic’s Claude brings structured triage and investigation workflows into command-line AI agents, driven by natural-language instructions. It is the first release from a planned Exabeam Agent Skills Marketplace.
A deeper integration with Claude Enterprise addresses the other side of the problem: visibility into what AI is actually doing. Prompts, tool calls and actions are normalised into a single timeline, with event-time analysis and behavior-based correlation used to spot rogue agents and behavioral drift.
For security leaders under pressure to justify spending, Executive Digest produces board-ready metrics, while Outcomes Navigator Overrides lets teams adjust risk scoring and separate compliance reporting by business unit.
Early users report tangible gains. Eduardo Sulvarán Velázquez, Subdirector Cyber Risk Management at E-Global, said Nova AI has helped his team prioritise cases more effectively and given analysts faster access to context, improving investigation speed “without removing human judgment from the process.”
Bringing AI Security Operations On-Premises
Not every organisation can, or will, move security data to the cloud. For those keeping infrastructure, data or AI workloads in-house, Exabeam has modernised its LogRhythm SIEM Platform with an in-place migration from Elasticsearch to OpenSearch, improving speed and scale and underpinning a new self-service reporting engine with AI governance and audit-ready compliance reports.
New out-of-the-box collectors for ChatGPT, Google Gemini and GitHub Copilot give security teams centralised visibility into enterprise AI use, while a community Model Context Protocol server allows analysts to query and triage security data using local generative AI models, without data leaving their environment.
Open Source Momentum
Exabeam is continuing to build out the Open Agent and AI Security Community it founded. Recent additions include an Agentic SOC Skill Suite of open-source skills for Claude Code and OpenAI Codex, new Thinking Modes and evidence-committed scoring for its Praxen project, which tie findings more directly to supporting evidence, and a single plugin marketplace covering both Claude Code and Codex. The company is inviting practitioners, researchers and engineers to contribute.
