ExtraHop

AI-generated alerts are meant to help security teams move faster, but false positives can slow down investigations. According to ExtraHop’s 2026 Global Threat Landscape Report: AI Edition, AI-generated alerts and detections negatively affect investigation timelines an average of 30% of the time. When an alert turns out to be a false positive, analysts still spend time reviewing the activity, gathering evidence, and validating the finding — without advancing a real threat investigation. 🔗 Download the report to learn how AI is reshaping enterprise risk and defense: https://xtra.li/4Aq99rb

Agents are already triaging alerts, investigating incidents, correlating evidence, and taking bounded response actions. Meanwhile, security leaders are sorting through an ever-expanding market of models, agents, and platforms, each promising greater speed, accuracy, or efficiency than the next. Evaluating AI on a tool-by-tool basis introduces friction. Each standalone deployment forces lengthy procurement cycles and saddles teams with building, testing, and maintaining new data pipelines, integrations, interfaces, permission structures, and isolated controls. Security leaders need a way to absorb the next AI capability without burning cycles or going through a rebuild, keeping analysts on task, moving fast, and applying human judgment where it matters. With Context, Harness, and Model built as independent layers, a stronger model plugs into the existing system. Read A CISO’s Guide to Agentic AI Adoption: https://xtra.li/4zJ3zyK

An AI agent in the SOC is only as good as the evidence it reasons from. Fragmented or delayed data doesn't just cause missed threats — it makes agents confidently wrong at machine speed. That's where the context layer comes in. It's the detail behind a security event and the difference between "a login occurred" and "a service account signed in from an unusual location and started moving data." As Kanaiya Vasani recently shared, the real shift isn't having the data. It's structuring it so agents can actually use it. Read the blog to learn more about context in the SOC: https://xtra.li/4jpAC6f #AgenticSOC #Cybersecurity

An engineer's login. A cellular modem. And a threat group tied to Iran's IRGC Cyber Electronic Command that's been probing U.S. critical infrastructure since 2020. It didn’t look like an attack. There was no exploit and no malware. Attackers used standard tools and ports, with activity that passed as authorized maintenance. But behind that traffic, operating logic had already been rewritten on live water systems — with safety alarms disabled — and one Minnesota utility was offline. See how it happened and what would have caught it in time.

No degree of brilliance in an AI model can make up for inadequate source data. When AI SOC agents reason on incomplete, stale, or missing data (and too many of them do), they can’t be trusted to make the right calls. Worse, they don’t know that. Whether agents get things right or wrong, they act, confidently and at scale. That's why 15 companies — including ExtraHop, CrowdStrike, and LangChain — just founded the Agentic SOC Alliance, around a three-layer operating model for autonomous security: ✅ Context: real-time, structured evidence of every device, identity, and connection, so agents reason on facts instead of fragments ✅ Harness: the runtime that governs how agents operate, with guardrails, permissions, and a full audit trail ✅ Model: the reasoning engine, swappable as the technology evolves The context is what ExtraHop provides. Our NDR platform decrypts and correlates network traffic as it happens, attributing every connection to an identity and every action to a device. See what real context looks like. Get a demo.

An alert fires in your agentic SOC. What happens next? Without the right data, a rash of expensive guessing. Most tools hand your agent a flag with no detail on the device, identity, or protocol behind it. Agents take that limited information and run with it: 🤖 Burning through tokens in the attempt to make sense out of fragments. 🤖 Coming to a 🤷 conclusion about what happened (unverifiable by them). 🤖 And taking action based on that conclusion at speed and scale. Fortunately, there’s an alternative. You can run your agentic SOC on real-time, decrypted, protocol-level evidence. Your agents will know which device, identity, and protocol are involved as the event happens instead of reconstructed after the fact. That's what ExtraHop offers — decrypted and correlated network traffic in real time, turning raw activity into evidence an agent can reason on directly. We’re one of 15 companies that came together to found the Agentic SOC Alliance, working to define and enable what autonomous security operations require to be fast, accurate, and governable. See what your agents have been missing. Get a demo.