Securonix extends behavioural analytics to detect threats from AI agents

The new capability combines user and agent behaviour analytics with AI-supported SOC investigations, giving MSPs and security teams a way to investigate abnormal activity while keeping consequential response decisions under human control.

Securonix has introduced Advanced Behavioural Analytics (ABA), extending behavioural threat detection to enterprise AI agents as well as human users, with implications for managed security service providers (MSSPs) handling increasingly complex customer environments.

The new capability combines Agent and Entity Behaviour Analytics (AEBA) with User and Entity Behaviour Analytics (UEBA) to identify activity that may be permitted by existing access controls but deviates from expected behaviour.

It examines changes such as an AI agent accessing data outside its intended purpose, invoking an unexpected tool or changing its operating pattern, alongside suspicious user activity across systems and over time. Securonix says the capability is available now.

For MSPs and managed SOC providers, the challenge is not limited to identifying unauthorised access.

An account or AI agent may have legitimate credentials and permissions but still behave in ways that expose sensitive information or indicate a compromised identity.

Securonix's approach is to correlate activity with identity, permissions, data use, asset sensitivity, timing and threat context, helping analysts investigate developing risks rather than treating each event as an isolated alert.

“AI is compressing the time between initial access and business impact, while security leaders remain accountable for the decisions made under that pressure,” said Toby Weiss, chief executive officer of Securonix.

He said Advanced Behavioural Analytics helps analysts identify meaningful behavioural changes earlier while retaining control over how AI supports the response. Consequential response actions remain subject to human approval.

AI agents add to managed SOC workloads

Securonix is extending behavioural baselines and risk detection across users, identities, assets, applications, cloud environments and AI agents. The platform correlates signals across systems and over time to identify compromised identities, unusual access, privilege misuse, sensitive data exposure and abnormal agent activity.

The company is also expanding its catalogue of AI-threat policies to cover attack techniques including reconnaissance, exploit development, privilege escalation and data movement.

For managed security providers, the significance lies in the additional investigation required when customers introduce AI agents into their environments.

Security teams must assess whether an agent's access and actions remain consistent with its intended purpose, while distinguishing suspicious behaviour from legitimate changes in workloads, permissions and business activity.

That challenge is particularly relevant in cloud and Infrastructure-as-Code environments, where workloads can appear and disappear and identities change frequently.

Darren Humphries, group CISO at Acora, said understanding each customer's environment is one of the hardest parts of running a managed SOC because analysts must separate genuine threats from normal activity.

“Securonix Threat Analytics builds that behavioral baseline automatically, then uses risk scoring and evidence boards to show our analysts what matters and why,” Humphries said.

He said Acora's customers benefit from fewer false positives, faster investigations and quicker containment without losing the customer context needed for effective detection. The release does not quantify these reported improvements.

AI handles repeatable work, analysts retain control

Alongside the new analytics capability, Securonix outlined how its AI-supported SOC tools handle repeatable investigation tasks.

Sam, the company's AI SOC Analyst, performs Tier 1 and Tier 2 work across triage, investigation, evidence collection and case creation. The Agentic Mesh coordinates AI-supported workflows, while Agentic Guardrails keep actions within defined policies and make them visible and auditable.

The model is intended to help security teams absorb growing alert volumes without increasing headcount at the same rate. Analysts remain responsible for reviewing and approving consequential response actions.

Securonix also highlighted its Insider Intent Agent, which adds contextual and corroborating evidence to authorised insider-risk investigations. Rather than treating an individual message, or behavioural deviation as proof of malicious intent, the tool presents signals within the broader body of evidence for analysts to assess.

These capabilities address two connected operational requirements for MSPs, including managing the volume of work generated by security alerts and maintaining enough context to investigate threats across different customer environments.

However, the announcement does not provide comparative performance figures or quantify how much analyst time the tools save.

AI governance becomes part of the security proposition

Securonix has also achieved ISO/IEC 42001:2023 certification, which covers the AI management system used to govern AI across its product portfolio, including ThreatQ. The company said an external audit recorded no major findings.

The certification provides independent assurance of the company's AI management practices, including accountability, risk management and human oversight. It can also support customer due diligence during security, procurement and AI governance reviews.

Separately, Securonix surveyed 1,000 cybersecurity professionals globally during summer 2026 for its report, The Evolution of Cybersecurity Automation: Towards the AI-Governed SOC. The company said 96% of respondents considered cybersecurity automation important to their organisations, while 49% reported using AI in behavioural analytics with human approval.

The full report and methodology are due in November. The findings are global survey results and do not represent India-specific adoption levels.

The announcement highlights a growing requirement to monitor not only human users and conventional systems but also AI agents operating with authorised access.

Securonix is combining that visibility with AI-supported investigation and controlled response, although the release does not announce a new MSP programme, channel incentives or India-specific partner changes.