Securonix has announced several enhancements to its Unified Defense SIEM platform, introducing new capabilities for AI agent detection and response, expanding its Threat Analytics for Microsoft Sentinel, and offering more flexible data pipeline management to help reduce cybersecurity costs. These updates aim to address the growing pressures on security teams, including rising telemetry volumes, increasing SIEM costs, and the proliferation of AI assistants and autonomous workflows within enterprises.
The new Governed AI Agent Detection and Response capabilities are designed to monitor human and non-human identity risk associated with enterprise AI tools. As AI agents interact with sensitive systems, applications, and data, security teams require visibility into their activities to detect abnormal behavior, suspicious human-to-agent interactions, risky tool invocations, and unusual prompt usage. Securonix applies behavioral analytics to identify potential misuse, compromise, policy violations, or unauthorized AI adoption across various enterprise AI environments, including Microsoft Copilot. The system ensures that investigations maintain behavioral context, remain explainable, and allow for auditable response actions, with human analysts retaining oversight of critical decisions.
Securonix has also expanded its Threat Analytics for Microsoft Sentinel, a cloud-native analytics and intelligence layer intended to bolster detection quality for organizations already using Microsoft Sentinel. This offering integrates behavior-driven analytics, User and Entity Behavior Analytics (UEBA), advanced correlation, entity context, and dynamic risk scoring with existing Sentinel telemetry. Securonix processes this data and returns enriched, high-confidence detections directly to Sentinel, allowing analysts to continue working within their established workflows. This approach provides broader coverage and richer behavioral context without requiring additional endpoint agents, duplicate telemetry pipelines, or a complete re-platforming of the Security Operations Center (SOC). The service includes over 2,400 continuously maintained out-of-the-box detections to identify threats such as identity attacks, insider threats, ransomware, and cloud compromises. For Managed Security Service Providers (MSSPs) and Managed Detection and Response (MDR) providers, this offers a path to differentiated services across multi-tenant environments, with streamlined onboarding and content management.
To help control security data costs, Securonix has expanded Data Pipeline Manager (DPM) licensing for eligible SIEM environments and is now shipping the Securonix DPM agent. These capabilities provide organizations and service providers with greater control over how telemetry is collected, routed, retained, and analyzed. The goal is to allow organizations to align data handling with its operational and security value, directing high-priority data for real-time analytics and detection while making other telemetry available for investigation, threat hunting, compliance, and long-term retrieval through more cost-efficient pipelines. This strategy aims to reduce SIEM data costs by 30-50% by ensuring only security-relevant data is processed through the analytics pipeline, without sacrificing visibility for investigations.
The expanded DPM licensing and the Securonix DPM agent are currently available. Securonix Threat Analytics for Microsoft Sentinel is available for enterprise SOCs, MSSPs, and MDR providers utilizing Microsoft Sentinel. The Governed AI Agent Detection and Response capabilities are integrated into the Securonix Unified Defense SIEM platform.
