Intezer adds automated response workflows to AI SOC

Intezer has launched Workflows within its AI SOC platform, adding automated response tools to its existing alert investigation system.

The product lets security teams build and customise response processes in the same platform they use to triage and investigate alerts. Organisations can automate actions after an investigation without relying on a separate Security Orchestration, Automation, and Response system.

Teams can trigger steps such as closing alerts, isolating hosts, updating tickets, and notifying analysts once a verdict is reached. Those actions run with the investigation context already gathered in the platform, rather than through external integrations or manual handling.

Security operations teams increasingly use automation to manage high alert volumes, but many still separate investigation from response. In that model, analysts may need to switch tools after reaching a conclusion on an alert, adding time and operational complexity.

Response shift

Intezer is positioning Workflows as a way to bring the response stage into the same environment where analysis takes place. Users can create workflow logic directly in the platform, and actions are reflected back into the relevant alert or case, with each run logged for audit and troubleshooting.

The product also includes a natural-language workflow creation function. Users can describe the workflow they want in plain language through Intezer's MCP, then review, refine, test, and activate the resulting workflow within the platform.

For managed security service providers, the tool can automate customer communications and route actions by tenant. That addresses a common operational task for providers managing multiple customer environments from a shared system.

Intezer linked the launch to findings from its AI SOC Report 2026, which found that nearly 1% of real incidents were traced back to alerts initially classified at the lowest severity levels. For an enterprise generating 450,000 alerts a year, that would equate to about 54 real threats annually, or around one a week, that could go uninvestigated.

Intezer uses those figures to argue for examining every alert rather than relying on partial coverage. It says automation built on limited investigation can miss lower-severity threats if those alerts do not receive enough scrutiny before response decisions are made.

Market context

The launch comes as cyber security suppliers race to add more automation to security operations centres, driven by growing alert volumes and the increasing use of artificial intelligence by attackers. Vendors across endpoint, network, and security analytics markets are trying to reduce the manual work required from analysts, particularly for routine triage and remediation tasks.

Intezer's approach centres on combining automated investigation with direct response actions. The company says Workflows completes that model by extending the platform beyond triage and analysis into the remediation steps that follow an investigation outcome.

"As attackers scale with AI, security teams need security operations that can operate at machine scale," said Itai Tevet, Chief Executive Officer and Co-founder of Intezer.

"By combining forensic-depth investigation with custom, automated response, teams can execute remediation and close the loop faster. Workflows brings response into the same environment where investigation already happens, helping organizations extend AI-driven security operations across the full SOC lifecycle," Tevet said.

Workflows is currently available in early access to selected customers. Intezer's customer success team will also help users move existing SOAR playbooks into the new system.

Intezer sells an AI-led security operations platform that it says investigates all alerts and escalates less than 2% for human review. Its customers include NVIDIA, MGM Resorts, Equifax, Salesforce, and Ferguson.