Exabeam’s October 1, 2026 announcement expands its Agentic SOC capabilities across its cloud New-Scale platform and on-premises LogRhythm SIEM environment. The approach pairs AI-assisted investigation and AI-activity monitoring with a stated role for analysts in reviewing context and controlling response. These are vendor-described capabilities, not an independent assessment of effectiveness.
What is an agentic SOC?
An agentic SOC uses AI agents to carry out bounded security-operations tasks—such as collecting context, searching related data, and helping triage alerts—within an analyst-led workflow. It is not necessarily an autonomous SOC in which AI makes and executes every response decision. Exabeam describes its model as adding speed and investigative scale while retaining human judgment and control; that is the company’s intended operating model, not a guarantee for every configuration.
As an Amazon Associate I earn from qualifying purchases.
Exabeam describes New-Scale as a cloud-native SIEM and analytics platform for threat detection, investigation, and response, with context-aware risk scoring, playbooks, visualizations, cloud collectors, and site collectors for on-premises log and context collection. Its New-Scale Fusion data sheet describes SIEM, UEBA, Agent Behavior Analytics (ABA), and automated response within the platform. Exabeam New-Scale Fusion data sheet
How does Exabeam’s AI-assisted investigation work?
Nova AI and Related Cases
Exabeam says Nova AI now works across the platform as a persistent investigator: as incidents unfold, it gathers context, runs secondary searches, and retrieves entity profiles. Related Cases groups connected incidents so analysts can inspect a wider pattern rather than treating each alert as an isolated event. The announcement describes these functions; it does not establish how they perform against other products in independent testing. Exabeam announcement, October 1, 2026
#1 Best Overall
- APPLIANCE ONLY: Hardware unit sold without a service subscription — security services, firmware updates and support are NOT included and must be purchased separately to activate protection.
- PERFORMANCE: Up to 2.5 Gbps firewall inspection, 1 Gbps threat prevention and 1.2 Gbps IPSec VPN throughput driven by SonicWall's patented Reassembly-Free Deep Packet Inspection (RFDPI) engine.
- CONNECTIVITY: 8x1GbE + 2x1G SFP in a desktop form factor; zero-touch deploy and manage on-box or via cloud Network Security Manager (NSM).
- THREAT PROTECTION: SonicOS 8 delivers intrusion prevention, gateway anti-malware, application control, TLS/SSL decryption, Capture ATP multi-engine sandboxing (RTDMI) and reputation-based content & DNS filtering with an active service subscription.
- BUILT FOR SMALL BUSINESS & BRANCH: Secure SD-WAN, IPSec and SSL VPN plus Zero-Trust Network Access through Cloud Secure Edge keep distributed sites and remote workers protected.
Guided investigations in AI coding assistants
The Exabeam Agentic SOC Plugin for Anthropic Claude Code and OpenAI Codex is described as offering guided workflows for alert triage, case prioritization, and natural-language investigation. Exabeam calls it the first in a planned series of skills for its Agent Skills Marketplace. That gives teams another interface for investigation, but the announcement does not provide a complete deployment specification or settle which features are available under each customer configuration; verify current availability with Exabeam.
Executive and program reporting
Executive Digest presents security metrics, while Outcomes Navigator Overrides lets teams tailor risk scoring and separate compliance metrics across business units. The value of those controls depends on how each organization defines risk, configures business-unit boundaries, and validates its reporting; the announcement does not describe a legal or regulatory certification.
How does Exabeam monitor AI agent activity?
Monitoring AI use is a central part of the announcement, not merely an extension of alert triage. Exabeam says its Claude Enterprise integration normalizes prompts, tool calls, and actions into a timeline, then applies event-time analysis and behavior-based correlation to identify rogue agents and behavioral drift. Its New-Scale Fusion data sheet identifies telemetry coverage for Claude, ChatGPT, Gemini, and Microsoft Copilot, as well as bring-your-own-AI and open agent telemetry. It also says an MCP server provides enterprise agents monitored access to case data, risk scores, and investigation summaries. New-Scale Fusion data sheet
Free tools Windows power users keep installed
One-click scans. No signup required.
In practice, teams evaluating this capability should establish which AI platforms and non-human identities they need to see, what telemetry each source provides, and how anomalies will be reviewed. “Monitored access” and behavioral correlation describe product capabilities; they do not by themselves prove that every relevant action will be captured or that a detected anomaly is malicious.
Can AI security operations run on-premises?
Exabeam’s announcement also describes new capabilities for its on-premises LogRhythm SIEM environment. It lists out-of-the-box generative-AI collectors for ChatGPT, Google Gemini, and GitHub Copilot, plus a community MCP server that lets teams query, investigate, and triage security data using local generative AI models without moving data outside their environment. The announcement also names an in-place Elasticsearch-to-OpenSearch migration and a self-service reporting engine with AI governance and audit-ready compliance reporting. Exabeam announcement, October 1, 2026
Keeping data and model workloads local may suit organizations with strict infrastructure or data-location requirements, but it does not alone establish compliance. Compliance depends on the full deployment, controls, data handling, and applicable obligations; the announcement does not claim a regulatory certification. Exabeam’s documentation describes New-Scale as cloud-native while supporting site collectors for on-premises log and context collection, so “cloud” and “on-premises” can also refer to different parts of a deployment rather than mutually exclusive choices. Exabeam documentation
Rank #3
- APPLIANCE ONLY: Hardware unit sold without a service subscription — security services, firmware updates and support are NOT included and must be purchased separately to activate protection.
- PERFORMANCE: Up to 5 Gbps firewall inspection, 2.5 Gbps threat prevention and 2.5 Gbps IPSec VPN throughput driven by SonicWall's patented Reassembly-Free Deep Packet Inspection (RFDPI) engine.
- CONNECTIVITY: 8x1GbE + 2x5G SFP+ + 2x10G SFP in a desktop form factor; zero-touch deploy and manage on-box or via cloud Network Security Manager (NSM).
- THREAT PROTECTION: SonicOS 8 delivers intrusion prevention, gateway anti-malware, application control, TLS/SSL decryption, Capture ATP multi-engine sandboxing (RTDMI) and reputation-based content & DNS filtering with an active service subscription.
- BUILT FOR DISTRIBUTED & HIGH-END SMB: Secure SD-WAN, IPSec and SSL VPN plus Zero-Trust Network Access through Cloud Secure Edge keep distributed sites and remote workers protected.
How should an organization evaluate the deployment path?
The announcement does not provide a complete deployment or pricing specification. A practical evaluation should map the organization’s data and workflow requirements before treating either deployment as a fit.
Recommended Free Tools
- Data and AI workload location: Decide whether logs, case data, and the AI models used for investigation must remain on local infrastructure, or whether the cloud New-Scale approach fits the organization’s controls.
- AI activity sources: Inventory the assistants, agents, and non-human identities that need monitoring. Confirm which integrations and collectors cover those sources in the intended environment.
- Investigation workflow: Determine whether analysts will work through Nova AI, guided Claude Code or Codex workflows, local-model queries through the LogRhythm MCP server, or a combination.
- Review and response boundaries: Specify which steps may gather context or recommend action, which require analyst approval, and which automated responses are permitted. Do not assume the product’s stated human-control model automatically matches local policy.
- Reporting and audit needs: Map executive metrics, business-unit risk scoring, audit trails, and compliance reporting to the organization’s actual obligations. Product reporting features are not equivalent to certification.
Ask Exabeam to confirm feature availability, prerequisites, integration coverage, migration details, and operational responsibilities for the specific deployment. Its documentation describes New-Scale’s platform components and collection options, but the announcement does not establish a universal architecture or implementation timeline. Exabeam documentation
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What do Exabeam’s speed and adoption figures establish?
Exabeam says its own security operations team averaged approximately 10 minutes per case, compared with five hours for a human analyst, in a measurement reported in the October 1, 2026 announcement. This is a company-reported result, not an independent benchmark; the announcement does not establish that the comparison generalizes to other teams, case types, or operating conditions.
The same announcement says the Open Agent and AI Security Community had more than 10,000 downloads since launching in June 2026, and that Exabeam is trusted by more than 3,000 enterprises worldwide. Both are company-reported figures, not independently verified measures of product effectiveness or customer outcomes.
Does AI investigation replace a security analyst?
Exabeam’s announced model is designed to shift analyst time away from repetitive context-gathering and toward judgment, prioritization, and decisions about response. That is consistent with the capabilities described—secondary searches, entity context, connected cases, and guided investigation—but the announcement does not demonstrate that analysts can be removed or quantify the impact across organizations. Teams should treat AI findings as inputs to a defined review process and validate the quality of outputs in their own environment.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
