Panther Launches the Complete AI SOC Platform, Closing the Loop on Security Operations

AI agents embedded natively across the security operations lifecycle democratize senior-level expertise, accelerate every critical SOC workflow, and consolidate siloed tools and scattered context into a single, continuously improving system

Panther announced the general availability of its complete AI SOC Platform, a new category of security operations built around a closed loop. AI agents don’t just investigate alerts. They continuously learn the patterns and risk profile of your organization, improving over time like a skilled coworker who gets sharper with experience.

Enterprise security teams have spent years trying to solve the same problem by adding more tools, more analysts, and faster triage. Alert volume keeps growing. The same false positives keep recurring. And the expertise required to run an effective SOC remains stubbornly scarce.

The modern security stack wasn’t designed. It accumulated. Dozens of tools, each with its own narrow view of the environment, each missing the context that would make it truly effective. Panther’s agents have native access to the data lake, detection engine, and organizational knowledge, giving them the full context needed to investigate thoroughly, act autonomously, and incorporate every outcome back into the platform.

As AI takes on more of the investigative work, the nature of security operations shifts. Detections evolve from signals written for human analysts into living logic that guides AI reasoning. The result is a SOC that gets measurably smarter over time: detection accuracy improves, alert volume declines, and security expertise scales across the entire team.

“For years, the industry treated the SOC’s core challenge as a scale problem. But scale was never the real constraint. The SOC has always demanded human judgment — knowing which signals matter, knowing what context to pull and where to find it, making the right call on a borderline alert. That expertise just didn’t scale, until now. Today, analysts aren’t doing the work. They’re guiding it. Every decision they make gets encoded back into the platform, so the system learns how your team thinks and gets measurably smarter over time. That’s what closing the loop means.”

— Jack Naglieri, Founder and CEO, Panther

Also Read: CIO Influence Interview with Gihan Munasinghe, CTO of One Identity

The Complete AI SOC Platform

Key capabilities include:

• AI Alert Triage Agent: Autonomously investigates alerts by drawing on all available context—the data lake, historical alerts, detections, and more—to deliver a clear risk classification with transparent reasoning. The agent learns the unique patterns and risk profile of each customer’s environment, auto-resolving noise and escalating only what matters.
• Closed-Loop Detection Tuning: Every triage outcome becomes a label that automatically tunes detection logic over time. Alert volume doesn’t just get triaged faster — it shrinks. Investigation outcomes feed directly back into detection rules as reviewable code, so the system gets measurably smarter with every decision your team makes.
• AI Detection Builder: Converts threat hypotheses described in natural language into production-ready Python detections, delivered as GitHub pull requests with human review required before deployment. Output is real code in a real CI/CD pipeline.
• Proactive Threat Coverage: Scheduled AI runs analyze telemetry across the full data lake to surface threats beyond what pre-written rules cover, identifying gaps before they become incidents. Because Panther owns both the data lake and the detection engine, findings convert directly into production detections through the same closed-loop workflow.
• Conversational Investigation: Natural language queries across all normalized log sources, with the ability to reference detection logic directly — not just raw events. Analysts investigate incidents, hunt threats, and build detections without writing a query.
• Context Assembly via Model Context Protocol (MCP): Every investigation automatically pulls context from identity providers, ticketing systems, code repositories, and internal documentation — the environmental knowledge that lives outside any single security tool. MCP gives Panther’s AI agents the same cross-functional awareness a senior analyst builds over years on the job.
• Controlled Automation: High-confidence benign alerts close automatically with full audit trails. Detection improvements deploy through existing approval workflows. Every automated action is logged, reviewable, and auditable — designed for the trust requirements CISOs demand before granting AI operational authority.
• Python Detection-as-Code: Detections written in the language AI models understand best. Python-based detection logic, a SQL-queryable security data lake, and structured schemas give AI agents the ability to read, reason about, and propose specific changes to detection rules.