AI in the SOC — Week of 2026-09-07

# Market Briefing: AI in the SOC — Week of 7–13 September 2026

Report date: 15 September 2026
Analysis period: 7–13 September 2026

1. What happened

Product launches and capability releases

Vendors announced 12 distinct product or capability launches during the period. Arambh Labs said it has launched Arambh Detect, a detection engineering product. [A11] Imperum said it has launched Virtus Cerebrum, a private per-tenant model that runs on CPU. [A46] Separately, its free Imperum-CybersecurityLLM v1.0 passed 6,000+ downloads on Hugging Face. [A5] HarkX said it has launched TigrX at the ETCISO Annual Conclave. [A6] [A8] AISOC said it has made its platform AISOC SYNERGY available. [A7] Daylight Security said it has become available on Google Cloud Marketplace. [A25] Cylerian said it has launched endpoint-level DNS filtering. [A31] [A32] Cotool said it has unified detection and response into a single Agents workspace. [A33] Embed Security said it has released iSteps for alert investigation. [A35] Mars Security said it has released automatic, intel-based, real-time detection engineering. [A41] Bricklayer AI said it has introduced MCP support. [A23] Anvilogic said it has four new detections available and is now listed in Claude's Connectors Directory. [A3] [A16] System Two Security said it has announced a new product capability. [A20]

Research and threat intelligence publications

Vendors published 12 research outputs. Spectrum Security said it has research on MCP attacks. [A1] System Two Security said it has threat intelligence on an npm worm. [A2] Simbian said it has benchmarked 25 LLMs across 100,000+ real attack events. [A4] Simbian also published phishing attack statistics. [A9] exaforce said it has findings on phishing kits. [A10] Prophet Security said it has published its inaugural quarterly threat report. [A13] 7ai said it has published security research on CRXfiltrate. [A15] Intezer said it has published research findings on alerts. [A17] Wirespeed said it has published research on BEC subculture. [A24] Kai Security said it has published CISO survey findings. [A45] Eventus Security said it has published a specific vulnerability alert with CVE. [A47] Spectrum Security said it has published findings on SIEM detection rule health, citing 16.9% and 45.7% broken rule rates at two companies. [A39]

Partnerships and ecosystem positioning

Six partnerships were announced. Method Security said it has announced the Cardinal Program with Palantir Technologies, a consortium of AI, infrastructure, and security partners. [A14] [C38] Andesite said it has a partnership with Booz Allen Hamilton. [A19] WiseBee said it has joined Anthropic's Cyber Verification Program. [A18] [C52] Mate Security said it has been selected as an early supporter of OpenAI's Call for Collective Action on Cyber Defense, joining Palo Alto Networks, ServiceNow, Google, AWS, and others. [A36] Rilian said it has a Bastazo integration partnership. [A40] Torq said it has been named a key partner by Merlin Cyber for federal AI SOC modernization. [A42] [C13]

Customer traction and validation

Four vendors cited customer outcomes. Wirespeed said it has helped another Coalition policyholder avoid a cyber attack. [A12] Spectrum Security said it has a named customer with 66% faster metrics. [A26] 7ai said it has DXC Technology as a named customer that ran agentic security across its global security operations. [A28] Backline AI said it has a named Fortune 500 customer with unfixable vulnerability results. [A38]

Workforce changes

Three vendors announced hires. Mate Security said it has appointed Noam Bar-Lev as Director. [A21] Artemis Security said it has hired Kevin Gandhi as security analyst. [A22] Mars Security said it has hired a new product designer. [A30] RedCarbon said it has hired Alberto Barahona as Pre Sales Engineer. [A44]

Headcount data from LinkedIn shows eight vendors with measurable changes: Cantina (+3.7%), 7ai (+3.2%), Daylight Security (+7.1%), Kai Security (+7.4%), PRE Security (-10.8%), Radiant Security (-8.3%), Rilian (+12.1%), BEYON Cyber (-4.5%). Open job listings were observed for 7ai (77), Torq (53), Kai Security (27), Qevlar (20), Nebulock (16), Artemis Security (13), Crogl (13), and Dropzone AI (12).

Recognition

Two awards were noted. Conifers AI said it has been named one of Israel's 25 most promising startups of 2026 by N12 News Israel. [A29] Opnova said it has won Black Hat startup spotlight year one. [A34]

Third-party market commentary

External sources published several items relevant to AI SOC market evolution. Gartner predicts 70% of SOCs will pilot AI agents but only 15% will achieve success, according to multiple social media posts. [C4] [C8] [C61] Zscaler's Agentic SOC launch received coverage across multiple languages and platforms. [C3] [C5] [C6] [C9] [C10] [C16] [C24] [C49] [C59] [C60] [C76] Trade press covered AI SOC performance measurement, trust gaps, and architectural debates. [C47] [C51] [C65] [C66] D3 Security published multiple analyses including a finding that security teams are hiring three builders for every analyst. [C28] [C29] [C30] [C31] [C32] HawkEye AI was noted as listed on SecOps Unpacked's AI SOC Capability Map. [C36] Reddit and X posts discussed resume challenges for SOC roles, autonomous SOC design patterns, and skepticism about AI agent claims.

2. What it suggests about the market

Vendor activity cluster around agentic architecture

The period shows concentrated vendor activity positioning around "agentic" SOC concepts—specialized AI agents for detection, investigation, and response workflows. Multiple vendors (Zscaler, Torq, 7ai, Simbian, Mars Security, Bricklayer AI) are emphasizing agent-based automation, with some differentiation emerging around: (a) integration depth with existing SIEM/SOAR stacks versus greenfield agent-native architectures, (b) human-in-the-loop versus full autonomy, and (c) federated governance models (MCP support, OpenAI collective action, Anthropic verification).

Trust and validation as competitive battleground

Gartner's 70%/15% prediction frames a market skepticism gap that vendors are actively addressing through: third-party verification programs (WiseBee/Anthropic, Mate/OpenAI), benchmark publications (Simbian's 25-LLM test), customer-named validation (7ai/DXC, Spectrum/66% metric), and transparency initiatives around detection rule health (Spectrum's 16.9%/45.7% data). The prevalence of "trust" messaging suggests buyer hesitation remains a primary friction point.

Detection engineering as capability differentiator

Multiple launches target detection engineering specifically: Arambh Detect, Mars Security's automatic intel-to-detection, Cylerian's embedded DNS filtering, Anvilogic's rapid detection deployment. This suggests a shift from alert volume toward detection quality and maintainability as core value propositions.

Federal and critical infrastructure positioning

Torq's Merlin Cyber partnership and Method Security's Palantir consortium indicate vendors are building dedicated pathways for regulated and government buyers, with compliance and national cyber resilience framings becoming more prominent.

3. What we still do not know

• Actual deployment scale: Vendor claims of downloads, customer runs, and pilot programs lack independent verification; no data on production versus pilot deployments, seat counts, or renewal rates.

• Economic model evolution: No information on pricing models for agentic SOC offerings—subscription, consumption-based, outcome-based, or hybrid—and how these compare to traditional MDR/SIM pricing.

• Integration failure modes: Limited data on where AI SOC agents fail in production, frequency of false positives/negatives in customer environments, and remediation costs.

• Workforce displacement quantification: While D3 Security cites a 3:1 builder-to-analyst hiring ratio, no data links this directly to AI SOC adoption versus broader security engineering trends; headcount changes at observed vendors show mixed patterns (growth at Daylight, Kai, Rilian; contraction at PRE, Radiant, BEYON).

• Regulatory compliance validation: No third-party audit results or regulatory findings on AI SOC platforms for GDPR, export control, or academic integrity standards referenced.

• Our own coverage gaps: 3 of 100 registry vendors not yet collected; 15 low-priority and 8 medium-priority data quality flags remain open; 1 ambiguous identity case unresolved.

References

[A11] Arambh Labs — "Arambh Labs: Most SIEMs don't have a detection problem." — https://www.linkedin.com/posts/arambhlabs_most-siems-dont-have-a-detection-problem-activity-7503908787729190913-bFCH [A5] Imperum — "Imperum: A big thank you to the cybersecurity community!" — https://www.linkedin.com/posts/imperumio_imperum-cybersecurityllm-v10-activity-7504175071750582273-nvi6 [A46] Imperum — "Imperum: Imperum Virtus Cerebrum is now live!" — https://www.linkedin.com/posts/imperumio_imperum-virtus-cerebrum-is-now-live-activity-7502659934757642240-Goc1 [A6] HarkX — "HarkX: Day 1 at the ETCISO Annual Conclave was a memorable start for HarkX and the launch of TigrX!" — https://www.linkedin.com/posts/harkx_harkx-tigrx-etciso-activity-7504166992174563328-gba8 [A8] HarkX — "HarkX: We’re at the ETCISO Annual Conclave, Booth #61." — https://www.linkedin.com/posts/harkx_harkx-tigrx-strix-activity-7504028370213453824-7TwS [A7] AISOC — "AISOC: Compliance isn't just about having controls in place." — https://www.linkedin.com/posts/aisoccloud_cybersecurity-compliance-governance-activity-7504116670160896000-NJMZ [A25] Daylight Security — "Daylight Security: Daylight Security is now available on Google Cloud Marketplace ☀️" — https://www.linkedin.com/posts/daylightsecurity_daylight-security-is-now-available-on-google-activity-7503479969935831040-Tth5 [A31] Cylerian — "Cylerian: Endpoint-level DNS filtering, folded into the platform you already run because your stack doesn't need another appliance; it needs fewer." — https://www.linkedin.com/posts/cylerian_endpoint-level-dns-filtering-folded-into-activity-7503196090087710720-QyUR [A32] Cylerian — "Cylerian: Endpoint-level DNS filtering, folded into the platform you already run because your stack doesn't need another appliance; it needs fewer." — https://www.linkedin.com/posts/cylerian_endpoint-level-dns-filtering-folded-into-activity-7503195080879579137-HyON [A33] Cotool — "Cotool: This week we unified Detection and Response into a single Agents workspace, where agents have a new and improved edit + detail experience." — https://www.linkedin.com/posts/cotool-ai_this-week-we-unified-detection-and-response-activity-7503128233870016512-gwaD [A35] Embed Security — "Embed Security: AI can accelerate alert investigations." — https://www.linkedin.com/posts/embed-security_cybersecurity-agenticai-secops-activity-7503105392328069121-wMM2 [A41] Mars Security — "Mars Security: 🚀 A new Mars invasion: automatic, intel-based, real-time detection engineering." — https://www.linkedin.com/posts/marssec_a-new-mars-invasion-automatic-intel-based-activity-7503062978796158979-A9Yw [A23] Bricklayer AI — "Bricklayer AI: Today we're announcing MCP support in Bricklayer." — https://www.linkedin.com/posts/bricklayerai_today-were-announcing-mcp-support-in-bricklayer-activity-7503486321714163712-t4Jf [A3] Anvilogic — "Anvilogic: Under six hours." — https://www.linkedin.com/posts/anvilogic_detectionengineering-credentialtheft-agenticsecops-activity-7504206633791827969-bGDd [A16] Anvilogic — "Anvilogic: Anvilogic is now listed in Claude's Connectors Directory." — https://www.linkedin.com/posts/anvilogic_agenticsecops-mcp-soc-activity-7503845048053186560-IUuR [A20] System Two Security — "detections.ai: The detection you’re about to write may already exist." — https://www.linkedin.com/posts/detectionsai_how-to-find-and-track-community-detections-activity-7503496741908819968-icU0 [A1] Spectrum Security — "Spectrum Security: Anthony Jirouschek on our Delta team has new research out on MCP." — https://www.linkedin.com/posts/spectrum-sec_mcp-server-attacks-six-ways-a-malicious-activity-7504227626786668544-SW2a [A2] System Two Security — "detections.ai: Shai-Hulud is back on npm." — https://www.linkedin.com/posts/detectionsai_grand-theft-auto-vi-hype-leads-to-malware-activity-7504212261352304641-aD0c [A4] Simbian — "Simbian: Simbian tested 25 LLMs across 100,000+ real attack events to see if they could actually investigate an attack." — https://www.linkedin.com/posts/simbian_the-llm-security-test-three-open-weight-activity-7504192138109444097-80yr [A9] Simbian — "Simbian: The old phishing average was a 12% click rate." — https://www.linkedin.com/posts/simbian_inside-a-phishing-investigation-activity-7503919854094045184-3lzq [A10] exaforce — "Exaforce: Most phishing kits are off-the-shelf." — https://www.linkedin.com/posts/exaforce_cybersecurity-threatintelligence-phishing-activity-7503918328474701824-CoPX [A13] Prophet Security — "Prophet Security: Three of the four attack patterns in our inaugural quarterly threat report share a critical trait: the attacker's access survived a password reset." — https://www.linkedin.com/posts/prophetsecurity_three-of-the-four-attack-patterns-in-our-activity-7503885598076772352-dcjb [A15] 7ai — "7AI: CRXfiltrate ran for 16 months inside authenticated corporate sessions and never produced an analyst-visible alert." — https://www.linkedin.com/posts/seven-ai_cybersecurity-threathunting-cybrseccon-activity-7503860410098544640-JTIu [A17] Intezer — "Intezer: A question worth asking before your next MDR renewal." — https://www.linkedin.com/posts/intezer-labs_a-question-worth-asking-before-your-next-activity-7503818753139335169-3aRM [A24] Wirespeed — "Wirespeed ⚡️: If you don't want your kids falling in with the wrong crowd, let us introduce you to one among threat actors: BEC subculture." — https://www.linkedin.com/posts/wirespeedsecurity_if-you-dont-want-your-kids-falling-in-with-activity-7503486225555726336-qcKa [A45] Kai Security — "Kai: CVE-2026-82329 was patched on August 28." — https://www.linkedin.com/posts/kai-security_cve-2026-82329-was-patched-on-august-28-activity-7502738465285898240-7MRm [A47] Eventus Security — "Eventus Security: Eventus Threat Watch | Alert #23" — https://www.linkedin.com/posts/eventus-security_malicious-eventusthreatwatch-cybersecurity-activity-7502613020766912512-8GLN [A39] Spectrum Security — "Spectrum Security: Two companies running the same SIEM, and one had 16.9% of its detection rules broken while the other had 45.7%." — https://www.linkedin.com/posts/spectrum-sec_two-companies-running-the-same-siem-and-activity-7503092787198865408-UVR6 [A14] Method Security — "Method Security: Method and Palantir Technologies are announcing the Cardinal Program: a consortium of AI, infrastructure, and security partners to strengthen national cyber resilience." — https://www.linkedin.com/posts/method-security_method-and-palantir-technologies-are-announcing-activity-7503869285383974912-xRXo [C38] newsable.asianetnews.com — "Palantir Builds Out AI Ecosystem With NVIDIA, Fujitsu, Method Security" — https://newsable.asianetnews.com/markets/palantir-builds-out-ai-ecosystem-with-nvidia-fujitsu-method-security-articleshow-xzg47is [A19] Andesite — "Andesite AI: Welcome back to Andesite's monthly newsletter, The Decision Fabric, focused on AI and the modern SOC." — https://www.linkedin.com/posts/andesiteai_the-decision-fabric-vol-10-activity-7503797956672815104-Xd-l [A18] WiseBee — "WiseBee: We’re thrilled to share that WiseBee is now part of Anthropic’s Cyber Verification Program!" — https://www.linkedin.com/posts/wisebee-ai_were-thrilled-to-share-thatwisebeeis-now-activity-7503808916623921152-xctv [C52] WiseBee — "WiseBee Joins Anthropic’s Cyber Verification Program" — https://wisebee.ai/blog/news-media/wisebee-joins-anthropics-cyber-verification-program/?utm_source=rss&utm_medium=rss&utm_campaign=wisebee-joins-anthropics-cyber-verification-program [A36] Mate Security — "Mate: Mate was selected as an early supporter of OpenAI's Call for Collective Action on Cyber Defense, joining Palo Alto Networks, ServiceNow, Google, Amazon Web Services (AWS), and additional industry leaders." — https://www.linkedin.com/posts/mate-security_mate-was-selected-as-an-early-supporter-of-activity-7503103837461856256-ENYR [A40] Rilian — "Rilian: A flooded CVE list is not a security posture." — https://www.linkedin.com/posts/riliantech_a-flooded-cve-list-is-not-a-security-posture-activity-7503087002502991872-0ijO [A42] Torq — "Torq: Merlin Cyber has named Torq a key partner for federal AI SOC modernization, bringing the Torq AI SOC Platform to agencies." — https://www.linkedin.com/posts/torqio_merlin-cyber-has-named-torq-a-key-partner-activity-7503060844013031424-FBWe [C13] Bluesky — "@newsen.bsky.social: Merlin Partners with Torq to Enhance Federal AI SOC Capabilities #United_States #Tysons_Corner #MERLIN #AI_SOC #Torq" — https://bsky.app/profile/newsen.bsky.social/post/3muyz7sjrky2k [A12] Wirespeed — "Wirespeed ⚡️: We helped another Coalition policyholder avoid a cyber attack!✅😁" — https://www.linkedin.com/posts/wirespeedsecurity_we-helped-another-coalition-policyholder-activity-7503897660001513472-Dv5A [A26] Spectrum Security — "Spectrum Security: 66% faster." — https://www.linkedin.com/posts/spectrum-sec_66-faster-thats-the-reduction-sep2-measured-activity-7503470018144198657-bioa [A28] 7ai — "7AI: Before bringing agentic security to customers, DXC Technology ran it across its own global security operations." — https://www.linkedin.com/posts/seven-ai_how-dxc-cut-soc-investigation-time-675-activity-7503444649836163074-OIKq [A38] Backline AI — "Backline AI: Some vulnerabilities carry a label nobody wants to write down: unfixable." — https://www.linkedin.com/posts/backline-ai-inc_agentic-remediation-case-study-activity-7503093552286064640-EeWz [A21] Mate Security — "Mate: Welcome Noam Bar-Lev!" — https://www.linkedin.com/posts/mate-security_welcome-noam-bar-lev-excited-to-welcome-activity-7503496589206847488-Spcy [A22] Artemis Security — "Artemis Security: Kevin Gandhi has joined Artemis as a security analyst." — https://www.linkedin.com/posts/goartemis_kevin-gandhi-has-joined-artemis-as-a-security-activity-7503490023279808512-aHOb [A30] Mars Security — "Mars Security: 👽 New life on Mars 👽" — https://www.linkedin.com/posts/marssec_new-life-on-mars-meet-tammy-tsadok-activity-7503359756896727040-PdyL [A44] RedCarbon — "RedCarbon: We're excited to welcome Alberto Barahona to #RedCarbon as our new Pre Sales Engineer." — https://www.linkedin.com/posts/redcarbon_redcarbon-activity-7502991620171079680-Mp7q [A29] Conifers AI — "Conifers.ai: 🏆 Proud that Conifers.ai has been named one of Israel's 25 most promising startups of 2026 by N12 News Israel, Israel's Channel 12 news site." — https://www.linkedin.com/posts/conifers-ai_n12-activity-7503432112985755648-tSyy [A34] Opnova — "Opnova: This was year one." — https://www.linkedin.com/posts/opnovaai_opnova-identitygovernance-founders-activity-7503123306204782592-1GeO [C4] Bluesky — "@blackhatnews.tokyo: Gartner Predicts: 70% of SOCs to Pilot AI Agents, Only 15% to Achieve Success Gartner's report 'Validate the Promises of AI SOC Agents With These Key Questions' reveals that analyst Craig..." — https://bsky.app/profile/blackhatnews.tokyo/post/3mv2rjdsfx62u [C8] Bluesky — "@hacker.at.thenote.app: Gartner: 70% of SOCs will pilot AI agents" — https://bsky.app/profile/hacker.at.thenote.app/post/3mv4msavkxc25 [C61] helpnetsecurity.com — "Gartner: 70% of SOCs will pilot AI agents. Only 15% will see results" — https://www.helpnetsecurity.com/2026/09/09/prophet-security-evaluating-ai-soc-agents/ [C3] Bluesky — "@artia13city.bsky.social: Zscaler integrates its Agentic SOC into the Zero Trust model to strengthen cybersecurity. Read the full article at:" — https://bsky.app/profile/artia13city.bsky.social/post/3mv6w4cjfbc2v [C5] Bluesky — "@blackhatnews.tokyo: Zscaler Agentic SOCは、AIエージェントとゼロトラストのテレメトリを組み合わせる Zscalerは、セキュリティ運用への新たなアプローチとなる「Zscaler Agentic…" — https://bsky.app/profile/blackhatnews.tokyo/post/3mv3eizqdwl2t [C6] Bluesky — "@briefing-block.bsky.social: Zscaler's Agentic SOC can isolate compromised users through existing controls, reducing the gap between diagnosis and action" — https://bsky.app/profile/briefing-block.bsky.social/post/3mv3hsa2fcs2s [C9] Bluesky — "@hacker.at.thenote.app: Zscaler Agentic SOC combines AI agents with zero trust telemetry Zscaler has announced Zscaler Agentic SOC, a new approach to security operations…" — https://bsky.app/profile/hacker.at.thenote.app/post/3mv5tvxvt3c25 [C10] Bluesky — "@hendryadrian.bsky.social: Zscaler Agentic SOC uses AI agents, zero trust telemetry, and expert validation to detect, investigate, and stop AI-driven attacks at machine speed.…" — https://bsky.app/profile/hendryadrian.bsky.social/post/3mv3igewfpk2c [C16] Bluesky — "@persberichten.com: Zscaler introduceert Agentic SOC om AI-gestuurde dreigingen te beperken Agentic SOC combineert exposuremanagement en SOC-workflows met…" — https://bsky.app/profile/persberichten.com/post/3mv3q6erqwe2r [C24] Bluesky — "@stocktitan.net: #ZS Zscaler launches Agentic SOC to contain AI-Driven Threats…" — https://bsky.app/profile/stocktitan.net/post/3mv2xpm7neh24 [C49] securitybrief.in — "Zscaler launches Agentic SOC to fight AI-driven attacks" — https://securitybrief.in/story/zscaler-launches-agentic-soc-to-fight-ai-driven-attacks [C59] globenewswire.com — "Zscaler launches Agentic SOC to contain AI-Driven Threats" — https://www.globenewswire.com/fr/news-release/2026/09/09/3358327/0/en/zscaler-launches-agentic-soc-to-contain-ai-driven-threats.html [C60] globenewswire.com — "Zscaler launches Agentic SOC to contain AI-Driven Threats" — https://www.globenewswire.com/news-release/2026/09/09/3358327/0/en/zscaler-launches-agentic-soc-to-contain-ai-driven-threats.html [C76] X — "Zscaler launched an Agentic SOC built around specialised agents for detection, investigation and response. Its bet: machine-speed attacks need security workflows designed for agents from the start. More AI news daily - follow along. #Cybersecurity #AIAgents #Zscaler" — https://x.com/asteris_ai/status/2097746864493731967 [C47] securitybrief.in — "How security leaders should measure AI SOC performance" — https://securitybrief.in/story/how-security-leaders-should-measure-ai-soc-performance [C51] thenewstack.io — "How much control should AI get? A CISO roundtable takes on SOC autonomy" — https://thenewstack.io/ai-agents-soc-autonomy/ [C65] Secure.com Blog — "When an AI SOC Gets It Wrong: False Negatives, Risk, and What Comes Next" — https://www.secure.com/blog/soc/what-happens-when-an-ai-soc-misses-a-real-threat/ [C66] Secure.com Blog — "XDR vs. SIEM vs. SOAR: Understanding the Modern Security Stack" — https://www.secure.com/blog/soc/xdr-vs-siem-vs-soar/ [C28] D3 Security — "The 10 Best Agentic SOC Platforms for MDR Providers in 2026" — https://d3security.com/blog/agentic-soc-for-mdr-providers/ [C29] D3 Security — "How to Catch an AI SOC Analyst Bluffing" — https://d3security.com/blog/catch-ai-soc-analyst-bluffing/ [C30] D3 Security — "Agentic Investigation for Identity Alerts: A Field Comparison" — https://d3security.com/blog/identity-alert-triage/ [C31] D3 Security — "We Read 1,000 SOC Job Postings. Security Teams Are Hiring Three Builders for Every Analyst." — https://d3security.com/blog/soc-hiring-2026/ [C32] D3 Security — "What Is Agentic MDR? Three Architectures Hide Behind One Label" — https://d3security.com/blog/what-is-agentic-mdr/ [C36] HawkEye — "HawkEye AI Is Listed on SecOps Unpacked’s AI SOC Capability Map, Here’s What Backs It Up" — https://hawk-eye.io/2026/09/hawkeye-ai-is-listed-on-secops-unpackeds-ai-soc-capability-map-heres-what-backs-it-up/?utm_source=rss&utm_medium=rss&utm_campaign=hawkeye-ai-is-listed-on-secops-unpackeds-ai-soc-capability-map-heres-what-backs-it-up

References

1. A11 Arambh Labs — Arambh Labs: Most SIEMs don't have a detection problem. https://www.linkedin.com/posts/arambhlabs_most-siems-dont-have-a-detection-problem-activity-7503908787729190913-bFCH
2. A46 Imperum — Imperum: Imperum Virtus Cerebrum is now live! https://www.linkedin.com/posts/imperumio_imperum-virtus-cerebrum-is-now-live-activity-7502659934757642240-Goc1
3. A5 Imperum — Imperum: A big thank you to the cybersecurity community! https://www.linkedin.com/posts/imperumio_imperum-cybersecurityllm-v10-activity-7504175071750582273-nvi6
4. A6 HarkX — HarkX: Day 1 at the ETCISO Annual Conclave was a memorable start for HarkX and the launch of TigrX! https://www.linkedin.com/posts/harkx_harkx-tigrx-etciso-activity-7504166992174563328-gba8
5. A8 HarkX — HarkX: We’re at the ETCISO Annual Conclave, Booth #61. https://www.linkedin.com/posts/harkx_harkx-tigrx-strix-activity-7504028370213453824-7TwS
6. A7 AISOC — AISOC: Compliance isn't just about having controls in place. https://www.linkedin.com/posts/aisoccloud_cybersecurity-compliance-governance-activity-7504116670160896000-NJMZ
7. A25 Daylight Security — Daylight Security: Daylight Security is now available on Google Cloud Marketplace ☀️ https://www.linkedin.com/posts/daylightsecurity_daylight-security-is-now-available-on-google-activity-7503479969935831040-Tth5
8. A31 Cylerian — Cylerian: Endpoint-level DNS filtering, folded into the platform you already run because your stack doesn't need another appliance; it needs fewer. https://www.linkedin.com/posts/cylerian_endpoint-level-dns-filtering-folded-into-activity-7503196090087710720-QyUR
9. A32 Cylerian — Cylerian: Endpoint-level DNS filtering, folded into the platform you already run because your stack doesn't need another appliance; it needs fewer. https://www.linkedin.com/posts/cylerian_endpoint-level-dns-filtering-folded-into-activity-7503195080879579137-HyON
10. A33 Cotool — Cotool: This week we unified Detection and Response into a single Agents workspace, where agents have a new and improved edit + detail experience. https://www.linkedin.com/posts/cotool-ai_this-week-we-unified-detection-and-response-activity-7503128233870016512-gwaD
11. A35 Embed Security — Embed Security: AI can accelerate alert investigations. https://www.linkedin.com/posts/embed-security_cybersecurity-agenticai-secops-activity-7503105392328069121-wMM2
12. A41 Mars Security — Mars Security: 🚀 A new Mars invasion: automatic, intel-based, real-time detection engineering. https://www.linkedin.com/posts/marssec_a-new-mars-invasion-automatic-intel-based-activity-7503062978796158979-A9Yw
13. A23 Bricklayer AI — Bricklayer AI: Today we're announcing MCP support in Bricklayer. https://www.linkedin.com/posts/bricklayerai_today-were-announcing-mcp-support-in-bricklayer-activity-7503486321714163712-t4Jf
14. A3 Anvilogic — Anvilogic: Under six hours. https://www.linkedin.com/posts/anvilogic_detectionengineering-credentialtheft-agenticsecops-activity-7504206633791827969-bGDd
15. A16 Anvilogic — Anvilogic: Anvilogic is now listed in Claude's Connectors Directory. https://www.linkedin.com/posts/anvilogic_agenticsecops-mcp-soc-activity-7503845048053186560-IUuR
16. A20 System Two Security — detections.ai: The detection you’re about to write may already exist. https://www.linkedin.com/posts/detectionsai_how-to-find-and-track-community-detections-activity-7503496741908819968-icU0
17. A1 Spectrum Security — Spectrum Security: Anthony Jirouschek on our Delta team has new research out on MCP. https://www.linkedin.com/posts/spectrum-sec_mcp-server-attacks-six-ways-a-malicious-activity-7504227626786668544-SW2a
18. A2 System Two Security — detections.ai: Shai-Hulud is back on npm. https://www.linkedin.com/posts/detectionsai_grand-theft-auto-vi-hype-leads-to-malware-activity-7504212261352304641-aD0c
19. A4 Simbian — Simbian: Simbian tested 25 LLMs across 100,000+ real attack events to see if they could actually investigate an attack. https://www.linkedin.com/posts/simbian_the-llm-security-test-three-open-weight-activity-7504192138109444097-80yr
20. A9 Simbian — Simbian: The old phishing average was a 12% click rate. https://www.linkedin.com/posts/simbian_inside-a-phishing-investigation-activity-7503919854094045184-3lzq
21. A10 exaforce — Exaforce: Most phishing kits are off-the-shelf. https://www.linkedin.com/posts/exaforce_cybersecurity-threatintelligence-phishing-activity-7503918328474701824-CoPX
22. A13 Prophet Security — Prophet Security: Three of the four attack patterns in our inaugural quarterly threat report share a critical trait: the attacker's access survived a password reset. https://www.linkedin.com/posts/prophetsecurity_three-of-the-four-attack-patterns-in-our-activity-7503885598076772352-dcjb
23. A15 7ai — 7AI: CRXfiltrate ran for 16 months inside authenticated corporate sessions and never produced an analyst-visible alert. https://www.linkedin.com/posts/seven-ai_cybersecurity-threathunting-cybrseccon-activity-7503860410098544640-JTIu
24. A17 Intezer — Intezer: A question worth asking before your next MDR renewal. https://www.linkedin.com/posts/intezer-labs_a-question-worth-asking-before-your-next-activity-7503818753139335169-3aRM
25. A24 Wirespeed — Wirespeed ⚡️: If you don't want your kids falling in with the wrong crowd, let us introduce you to one among threat actors: BEC subculture. https://www.linkedin.com/posts/wirespeedsecurity_if-you-dont-want-your-kids-falling-in-with-activity-7503486225555726336-qcKa
26. A45 Kai Security — Kai: CVE-2026-82329 was patched on August 28. https://www.linkedin.com/posts/kai-security_cve-2026-82329-was-patched-on-august-28-activity-7502738465285898240-7MRm
27. A47 Eventus Security — Eventus Security: Eventus Threat Watch | Alert #23 https://www.linkedin.com/posts/eventus-security_malicious-eventusthreatwatch-cybersecurity-activity-7502613020766912512-8GLN
28. A39 Spectrum Security — Spectrum Security: Two companies running the same SIEM, and one had 16.9% of its detection rules broken while the other had 45.7%. https://www.linkedin.com/posts/spectrum-sec_two-companies-running-the-same-siem-and-activity-7503092787198865408-UVR6
29. A14 Method Security — Method Security: Method and Palantir Technologies are announcing the Cardinal Program: a consortium of AI, infrastructure, and security partners to strengthen national cyber resilience. https://www.linkedin.com/posts/method-security_method-and-palantir-technologies-are-announcing-activity-7503869285383974912-xRXo
30. C38 Palantir Builds Out AI Ecosystem With NVIDIA, Fujitsu, Method Security https://newsable.asianetnews.com/markets/palantir-builds-out-ai-ecosystem-with-nvidia-fujitsu-method-security-articleshow-xzg47is
31. A19 Andesite — Andesite AI: Welcome back to Andesite's monthly newsletter, The Decision Fabric, focused on AI and the modern SOC. https://www.linkedin.com/posts/andesiteai_the-decision-fabric-vol-10-activity-7503797956672815104-Xd-l
32. A18 WiseBee — WiseBee: We’re thrilled to share that WiseBee is now part of Anthropic’s Cyber Verification Program! https://www.linkedin.com/posts/wisebee-ai_were-thrilled-to-share-thatwisebeeis-now-activity-7503808916623921152-xctv
33. C52 WiseBee Joins Anthropic’s Cyber Verification Program https://wisebee.ai/blog/news-media/wisebee-joins-anthropics-cyber-verification-program/?utm_source=rss&utm_medium=rss&utm_campaign=wisebee-joins-anthropics-cyber-verification-program
34. A36 Mate Security — Mate: Mate was selected as an early supporter of OpenAI's Call for Collective Action on Cyber Defense, joining Palo Alto Networks, ServiceNow, Google, Amazon Web Services (AWS), and additional industry leaders. https://www.linkedin.com/posts/mate-security_mate-was-selected-as-an-early-supporter-of-activity-7503103837461856256-ENYR
35. A40 Rilian — Rilian: A flooded CVE list is not a security posture. https://www.linkedin.com/posts/riliantech_a-flooded-cve-list-is-not-a-security-posture-activity-7503087002502991872-0ijO
36. A42 Torq — Torq: Merlin Cyber has named Torq a key partner for federal AI SOC modernization, bringing the Torq AI SOC Platform to agencies. https://www.linkedin.com/posts/torqio_merlin-cyber-has-named-torq-a-key-partner-activity-7503060844013031424-FBWe
37. C13 @newsen.bsky.social: Merlin Partners with Torq to Enhance Federal AI SOC Capabilities #United_States #Tysons_Corner #MERLIN #AI_SOC #Torq https://bsky.app/profile/newsen.bsky.social/post/3muyz7sjrky2k
38. A12 Wirespeed — Wirespeed ⚡️: We helped another Coalition policyholder avoid a cyber attack!✅😁 https://www.linkedin.com/posts/wirespeedsecurity_we-helped-another-coalition-policyholder-activity-7503897660001513472-Dv5A
39. A26 Spectrum Security — Spectrum Security: 66% faster. https://www.linkedin.com/posts/spectrum-sec_66-faster-thats-the-reduction-sep2-measured-activity-7503470018144198657-bioa
40. A28 7ai — 7AI: Before bringing agentic security to customers, DXC Technology ran it across its own global security operations. https://www.linkedin.com/posts/seven-ai_how-dxc-cut-soc-investigation-time-675-activity-7503444649836163074-OIKq
41. A38 Backline AI — Backline AI: Some vulnerabilities carry a label nobody wants to write down: unfixable. https://www.linkedin.com/posts/backline-ai-inc_agentic-remediation-case-study-activity-7503093552286064640-EeWz
42. A21 Mate Security — Mate: Welcome Noam Bar-Lev! https://www.linkedin.com/posts/mate-security_welcome-noam-bar-lev-excited-to-welcome-activity-7503496589206847488-Spcy
43. A22 Artemis Security — Artemis Security: Kevin Gandhi has joined Artemis as a security analyst. https://www.linkedin.com/posts/goartemis_kevin-gandhi-has-joined-artemis-as-a-security-activity-7503490023279808512-aHOb
44. A30 Mars Security — Mars Security: 👽 New life on Mars 👽 https://www.linkedin.com/posts/marssec_new-life-on-mars-meet-tammy-tsadok-activity-7503359756896727040-PdyL
45. A44 RedCarbon — RedCarbon: We're excited to welcome Alberto Barahona to #RedCarbon as our new Pre Sales Engineer. https://www.linkedin.com/posts/redcarbon_redcarbon-activity-7502991620171079680-Mp7q
46. A29 Conifers AI — Conifers.ai: 🏆 Proud that Conifers.ai has been named one of Israel's 25 most promising startups of 2026 by N12 News Israel, Israel's Channel 12 news site. https://www.linkedin.com/posts/conifers-ai_n12-activity-7503432112985755648-tSyy
47. A34 Opnova — Opnova: This was year one. https://www.linkedin.com/posts/opnovaai_opnova-identitygovernance-founders-activity-7503123306204782592-1GeO
48. C4 @blackhatnews.tokyo: Gartner Predicts: 70% of SOCs to Pilot AI Agents, Only 15% to Achieve Success Gartner's report 'Validate the Promises of AI SOC Agents With These Key Questions' reveals that analyst Craig... https://bsky.app/profile/blackhatnews.tokyo/post/3mv2rjdsfx62u
49. C8 @hacker.at.thenote.app: Gartner: 70% of SOCs will pilot AI agents https://bsky.app/profile/hacker.at.thenote.app/post/3mv4msavkxc25
50. C61 Gartner: 70% of SOCs will pilot AI agents. Only 15% will see results https://www.helpnetsecurity.com/2026/09/09/prophet-security-evaluating-ai-soc-agents/
51. C3 @artia13city.bsky.social: Zscaler integrates its Agentic SOC into the Zero Trust model to strengthen cybersecurity. Read the full article at: https://bsky.app/profile/artia13city.bsky.social/post/3mv6w4cjfbc2v
52. C5 @blackhatnews.tokyo: Zscaler Agentic SOCは、AIエージェントとゼロトラストのテレメトリを組み合わせる Zscalerは、セキュリティ運用への新たなアプローチとなる「Zscaler Agentic… https://bsky.app/profile/blackhatnews.tokyo/post/3mv3eizqdwl2t
53. C6 @briefing-block.bsky.social: Zscaler's Agentic SOC can isolate compromised users through existing controls, reducing the gap between diagnosis and action https://bsky.app/profile/briefing-block.bsky.social/post/3mv3hsa2fcs2s
54. C9 @hacker.at.thenote.app: Zscaler Agentic SOC combines AI agents with zero trust telemetry Zscaler has announced Zscaler Agentic SOC, a new approach to security operations… https://bsky.app/profile/hacker.at.thenote.app/post/3mv5tvxvt3c25
55. C10 @hendryadrian.bsky.social: Zscaler Agentic SOC uses AI agents, zero trust telemetry, and expert validation to detect, investigate, and stop AI-driven attacks at machine speed.… https://bsky.app/profile/hendryadrian.bsky.social/post/3mv3igewfpk2c
56. C16 @persberichten.com: Zscaler introduceert Agentic SOC om AI-gestuurde dreigingen te beperken Agentic SOC combineert exposuremanagement en SOC-workflows met… https://bsky.app/profile/persberichten.com/post/3mv3q6erqwe2r
57. C24 @stocktitan.net: #ZS Zscaler launches Agentic SOC to contain AI-Driven Threats… https://bsky.app/profile/stocktitan.net/post/3mv2xpm7neh24
58. C49 Zscaler launches Agentic SOC to fight AI-driven attacks https://securitybrief.in/story/zscaler-launches-agentic-soc-to-fight-ai-driven-attacks
59. C59 Zscaler launches Agentic SOC to contain AI-Driven Threats https://www.globenewswire.com/fr/news-release/2026/09/09/3358327/0/en/zscaler-launches-agentic-soc-to-contain-ai-driven-threats.html
60. C60 Zscaler launches Agentic SOC to contain AI-Driven Threats https://www.globenewswire.com/news-release/2026/09/09/3358327/0/en/zscaler-launches-agentic-soc-to-contain-ai-driven-threats.html
61. C76 Zscaler launched an Agentic SOC built around specialised agents for detection, investigation and response. Its bet: machine-speed attacks need security workflows designed for agents from the start. More AI news daily - follow along. #Cybersecurity #AIAgents #Zscaler https://x.com/asteris_ai/status/2097746864493731967
62. C47 How security leaders should measure AI SOC performance https://securitybrief.in/story/how-security-leaders-should-measure-ai-soc-performance
63. C51 How much control should AI get? A CISO roundtable takes on SOC autonomy https://thenewstack.io/ai-agents-soc-autonomy/
64. C65 When an AI SOC Gets It Wrong: False Negatives, Risk, and What Comes Next https://www.secure.com/blog/soc/what-happens-when-an-ai-soc-misses-a-real-threat/
65. C66 XDR vs. SIEM vs. SOAR: Understanding the Modern Security Stack https://www.secure.com/blog/soc/xdr-vs-siem-vs-soar/
66. C28 The 10 Best Agentic SOC Platforms for MDR Providers in 2026 https://d3security.com/blog/agentic-soc-for-mdr-providers/
67. C29 How to Catch an AI SOC Analyst Bluffing https://d3security.com/blog/catch-ai-soc-analyst-bluffing/
68. C30 Agentic Investigation for Identity Alerts: A Field Comparison https://d3security.com/blog/identity-alert-triage/
69. C31 We Read 1,000 SOC Job Postings. Security Teams Are Hiring Three Builders for Every Analyst. https://d3security.com/blog/soc-hiring-2026/
70. C32 What Is Agentic MDR? Three Architectures Hide Behind One Label https://d3security.com/blog/what-is-agentic-mdr/
71. C36 HawkEye AI Is Listed on SecOps Unpacked’s AI SOC Capability Map, Here’s What Backs It Up https://hawk-eye.io/2026/09/hawkeye-ai-is-listed-on-secops-unpackeds-ai-soc-capability-map-heres-what-backs-it-up/?utm_source=rss&utm_medium=rss&utm_campaign=hawkeye-ai-is-listed-on-secops-unpackeds-ai-soc-capability-map-heres-what-backs-it-up

Earlier briefings

• AI in the SOC — Week of 2026-09-14
• SOC Automation — Week of 2026-08-17