Proofpoint has unveiled its SOC Analyst Agent built with OpenAI’s Daybreak cyber models to help security operations centre (SOC) teams investigate threats faster and turn fragmented alerts into traceable, actionable findings
The new agentic AI tool embeds OpenAI’s cyber-tuned large language models directly into Proofpoint’s investigation workflows to let analysts pose natural-language questions and receive structured outputs that connect signals across alerts, logs, data loss prevention (DLP) events, and user-risk indicators.
According to Proofpoint, more than half (54 percent) of organisations already use AI-enhanced tools to triage and investigate alerts, yet SOCs still struggle to correlate data across systems and prioritise what to act on next. SOC Analyst Agent is designed to reduce that investigative burden by automating parts of the analysis while keeping consequential decisions, such as containment or account changes, in human hands.
With the agent, analysts can query across connected Proofpoint products in natural language, cutting manual work to assemble context. Teams can schedule workflows for threat hunts, data security investigations and escalation reporting, with results routed to the right analysts. Findings are traceable to source data so analysts can validate recommendations as the agent does not independently execute remediation actions.
“The challenge for security teams is to cut through the noise to quickly identify which signals matter and reach a defensible decision fast enough to act,” said Daniel Rapp (top), Chief Data and AI Officer of Proofpoint.
“By combining Proofpoint’s security data and human-behavior expertise with OpenAI’s Daybreak models, analysts can turn fragmented signals into clearer findings, faster investigations and recommended next steps they can trust,” said McCall McIntyre, Head of Global Cyber Partnerships at OpenAI.
SOC Analyst Agent is currently in preview with select beta customers, with general availability expected by the end of Q3.
Entelechy Asia 