Securonix Takes on Data Costs, Detection Gaps, and AI Agent Risk at Black Hat USA 2026
Agentic, Threat Intelligence, UEBA
Securonix Takes on Data Costs, Detection Gaps, and AI Agent Risk at Black Hat USA 2026
New capabilities help organizations control security data costs, strengthen Microsoft Sentinel detection coverage and response, and govern enterprise AI agent activity
LAS VEGAS, Nevada, August 3, 2026 — Securonix, Inc., a six-time Leader in the Gartner® Magic Quadrant™ for SIEM, today announced expanded cybersecurity cost reduction, expanded Threat Analytics for Microsoft Sentinel, and new Governed AI Agent Detection and Response capabilities at Black Hat USA 2026. The additions extend the Securonix Unified Defense SIEM platform to help enterprises and managed security providers control data costs, improve detection coverage and response, and govern risks created by enterprise AI adoption.
Security teams face three pressures at once. Telemetry volumes and SIEM costs continue to rise. Threats increasingly span identity, cloud, endpoint, application, and third-party environments. Enterprises are also deploying AI assistants, autonomous workflows, and digital workers that can access sensitive systems and act on behalf of users. Security leaders must address these pressures while preserving visibility, supporting existing technology investments, and improving outcomes without proportionally increasing staff or operational complexity. Securonix is addressing those priorities through Governed AI Agent Detection and Response for monitoring human and non-human identity risk, expanded Data Pipeline Manager licensing and the now-shipping Securonix DPM agent for greater control over security data economics, and deeper Threat Analytics for Microsoft Sentinel for enterprises, MSSPs, and MDR providers.
“Security operations cannot scale by continually adding more data, more tools, and more analyst effort,” said Toby Weiss, Chief Executive Officer of Securonix. “We are giving customers better control over the data they retain, stronger detection across the platforms they already use, and clear oversight of automated activity. That gives the SOC room to grow without losing control of cost, context, or risk.”
Strengthen Microsoft Sentinel Without Replacing It
Securonix has expanded Threat Analytics for Microsoft Sentinel, a lightweight, cloud-native analytics and intelligence layer designed to improve detection quality while keeping Microsoft Sentinel at the center of the SOC.
Threat Analytics applies behavior-driven analytics, industry-leading UEBA, advanced correlation, entity context, dynamic risk scoring, and continuously maintained and detection content to telemetry already available in Sentinel. Securonix analyzes the data and returns enriched, higher-confidence detections directly to Sentinel for triage, investigation, and response. Analysts continue working in their existing Sentinel workflows. Customers gain broader coverage and richer behavioral context without deploying additional endpoint agents, duplicating telemetry pipelines, building new customer-side pipelines, re-platforming the SOC, or operating a second SIEM.
“Sentinel customers have already made their platform choice,” said Simon Hunt, Chief Product Officer of Securonix. “We are adding depth where it counts: behavioral context, cross-source correlation, and risk-based prioritization. Analysts stay in Sentinel, while the detections reaching them carry more evidence and a clearer reason to act.”
With more than 2,400 continuously maintained out-of-the-box detections, Threat Analytics helps teams identify identity attacks, insider threats, ransomware, cloud compromise, and advanced persistent threats with greater context and confidence.
For MSSPs and MDR providers, the offering creates a path to differentiated managed detection services across multi-tenant environments, with faster onboarding, delivering enhanced monitoring with out-of-the box behavior-based detections and threat modeling, and streamlining content management easily across multiple customers. Threat Analytics for Microsoft Sentinel helps providers strengthen managed detection services without disrupting customer environments, replacing Microsoft Sentinel, or introducing a disconnected analyst workflow.
Detect and Govern Risk Across Enterprise AI Agents
Securonix is introducing new Governed AI Agent Detection and Response capabilities designed to help organizations identify and respond to abnormal or risky activity involving enterprise AI assistants, autonomous workflows, and digital workers. AI agents increasingly interact with users, identities, applications, sensitive data, tools, and business processes. Security teams need visibility into what those agents are doing, which resources they are accessing, and whether their behavior changes in ways that indicate misuse, compromise, or policy violations. Securonix applies behavioral analytics across human and non-human identities to detect abnormal agent activity, suspicious human-to-agent interactions, risky tool invocation, unusual prompt behavior, unauthorized AI adoption, and potential misuse or compromise, or policy violations. The capabilities support monitoring activity across enterprise AI environments, including Microsoft Copilot and other widely used AI assistants and developer tools. Findings preserve behavioral context; investigations remain explainable; response actions can be reviewed and audited; and human analysts retain oversight of consequential decisions.
“The moment an AI agent can access a mailbox, call an API, or change a business process, its behavior belongs in the security picture,” said Hunt “Analysts need to know what it touched, why it acted, and whether that activity fits policy. We are bringing that context into the same investigation and response process teams use every day.”
Control Security Data Costs Without Sacrificing Visibility
Securonix has expanded DPM licensing across eligible SIEM environments and is now shipping the Securonix DPM agent. Together, these capabilities give enterprises and service providers greater control over how telemetry is collected, routed, retained, and analyzed.
Many security data strategies force teams to choose between managing costs and preserving visibility. Securonix helps organizations align how telemetry is handled with its operational and security value. High-priority data can support real-time analytics and detection, while other telemetry remains available for investigation, threat hunting, compliance, and long-term retrieval. Analysts retain access to the data required for investigations. Security leaders gain more predictable economics. Enterprises and MSSPs can expand coverage without discarding telemetry that may later prove critical.
Securonix Data Pipeline Manager can help organizations reduce SIEM data costs by 30–50% by ensuring that only security-relevant data is processed through the Analytics Pipeline, while investigation and compliance data are routed through cost-efficient pipelines.
Behavioral Analytics Recognized by QKS Group
Securonix was named a Leader in the 2026 QKS SPARK Matrix™ for Insider Risk Management. The recognition reinforces Securonix’s behavioral analytics foundation for insider risk management. That same behavioral analytics foundation powers a broader portfolio of innovations, including Threat Analytics for Microsoft Sentinel, identity and entity analytics, and Governed AI Agent Detection and Response. With these new capabilities together, Securonix is helping organizations govern emerging AI agent activity, preserve access to valuable telemetry, and improve detection across existing environments without abandoning trusted platforms or adding unnecessary operational complexity.
Availability
Expanded DPM licensing is available for eligible SIEM environments, and the Securonix DPM agent is now shipping.
Securonix Threat Analytics for Microsoft Sentinel is available for enterprise SOCs, MSSPs, and MDR providers using Microsoft Sentinel.
Governed AI Agent Detection and Response capabilities are available as part of the Securonix Unified Defense SIEM platform.
About Securonix
Securonix is transforming security operations with the industry’s first Unified Defense SIEM with Agentic AI, built to decide and act across the threat lifecycle with a human-in-the-loop philosophy. Its cloud-native platform unifies detection, investigation, and response, while enabling Sam, the AI SOC Analyst, and a productivity-based AI operating model for the SOC, so organizations can measure and govern AI by the analyst work it delivers. Helping enterprises become Breach Ready and Board Ready, Securonix delivers accountable, outcome-driven security operations at scale. Recognized as a Leader in the Gartner® Magic Quadrant™ for SIEM and a Customers’ Choice by Gartner Peer Insights™, Securonix delivers trusted security operations for global enterprises. Learn more at www.securonix.com.
Media Contact
Sean Ferguson
Director, Corporate Marketing & Communications, Securonix
[email protected]
