Intezer has introduced Workflows, a new native automation and response builder integrated directly into its platform, aiming to streamline security operations by eliminating the need for separate Security Orchestration, Automation, and Response (SOAR) systems. The company announced the feature on August 19, 2026, positioning it as a way for security teams to create and customize response workflows within the same environment where alerts are triaged and investigated.
The new capability allows organizations to automate post-investigation actions, such as closing alerts, notifying analysts, isolating hosts, or updating tickets, directly within the Intezer AI SOC. This integration is designed to bridge the gap between alert investigation and remediation, which often relies on standalone SOAR platforms, custom integrations, or manual processes. Intezer emphasizes that Workflows enables actions to run immediately, leveraging the full context of the investigation.
According to Intezer CEO Itai Tevet, the integration of forensic-depth investigation with custom, automated response is crucial for security teams to operate at "machine scale" in response to AI-driven attacker tactics. The company's 2026 AI SOC Report highlighted that nearly 1% of real incidents originated from alerts initially classified at the lowest severity levels. For an enterprise generating 450,000 alerts annually, this translates to approximately 54 real threats per year that could potentially go uninvestigated if relying on partial alert coverage.
Intezer Workflows provides security teams with control over actions taken once an investigation yields a verdict. Key features include the ability to build response logic directly within the Intezer platform, eliminating the need for a separate SOAR. These workflows can trigger actions across the security stack, such as host isolation or ticket updates, based on investigation outcomes, without requiring additional API integrations or polling.
Users can create workflows using natural language descriptions through Intezer's MCP, which then generates the workflow for review, refinement, testing, and activation. The system ensures that all evidence, data, and organizational context gathered during the investigation are carried into the response phase. Each workflow run is logged within the relevant alert or case, providing an audit trail for troubleshooting. For Managed Security Service Providers (MSSPs), Intezer Workflows also offers automation for customer communications and per-tenant routing, processes that typically demand manual effort.
