From Hours of Investigation to Minutes of Action
Many security team knows the feeling. An alert arrives, but the real work is only beginning.
Analysts must pivot across email, identity, endpoint, browser, SIEM, and other tools to reconstruct an attack. SIEM and SOAR help aggregate alerts and orchestrate workflows, but they can only reason over the data sent to them—often missing critical email telemetry, message artifacts, behavioral intelligence, and human context held within security platforms. Analysts must then find and correlate that missing evidence themselves, costing valuable time while attackers continue to move.
The challenge isn't simply the number of alerts—it's the time, expertise, and manual effort required to investigate them.
That is why we are announcing the Satori Investigation Agent, an AI-powered agent that automates security investigations from evidence collection through response recommendations, helping analysts understand attacks in minutes instead of spending hours piecing them together manually.
An investigator that works alongside your SOC
The Investigation Agent is designed to perform much of the work an experienced analyst would normally do during an investigation. It can be launched manually by an analyst or automatically when suspicious activity warrants deeper investigation, such as anomalous account behavior, emerging attack patterns, or other signals that deserve closer scrutiny.
Once engaged, the agent reasons across Proofpoint's proprietary telemetry, and in the future, with data from connected security technologies—including identity, endpoint, browser, SIEM, web proxy, and other MCP-connected tools—to reconstruct the complete attack.
Instead of isolated alerts, analysts receive a comprehensive investigation that includes an attack timeline, blast radius, supporting evidence, and prioritized remediation guidance. For approved workflows, the Investigation Agent can also execute response actions, allowing organizations to accelerate containment while keeping humans in control.
Understanding the full scope of an attack
Modern attacks rarely stop with a single message or compromised user.
The Investigation Agent automatically expands every investigation to identify related campaigns, similar URLs, message variants, additional recipients, user interactions, browser activity, credential compromise, and downstream impact across connected security data. It builds a comprehensive blast radius by tracing how an attack propagated across users, devices, identities, and applications, identifying who was affected, what actions were taken, and where compromise may have spread beyond the initial alert.
Rather than asking analysts to manually connect dozens of signals across multiple products, the agent presents a complete picture of how an attack unfolded, the full extent of its impact, and the highest-priority response actions. Security teams gain faster answers, greater confidence, and dramatically reduced investigation time.
For example, when a high-severity account takeover alert is triggered, the Threat Investigation Agent automatically begins collecting and correlating evidence across email, URLs, identity, mailbox and endpoint activity. It can uncover the full attack chain—from the original phishing message and credential theft to a hidden mailbox rule and subsequent outbound phishing—and determine the blast radius across affected users and messages. The agent then produces a timeline, root causes, and recommended response. Governed actions, such as removing malicious messages, blocking URLs and deleting mailbox rules, can be executed automatically, while higher-impact actions, such as resetting credentials or revoking sessions, can be held for analyst approval. The result is a complete investigation and coordinated response that would otherwise require analysts to manually gather and connect evidence across multiple tools.
Every investigation makes protection stronger
Investigations shouldn't end when an incident is closed.
Every completed investigation contributes to community network effect, Satori's continuous learning capability that transforms investigation outcomes into stronger protection for all. Whether the investigation began with a false positive, false negative, customer submission, or analyst inquiry, the resulting intelligence helps identify detection gaps and improve future protections.
By continuously learning from investigations across the broader community, Proofpoint dramatically accelerates how quickly new threats can be recognized and blocked Instead of treating investigations as isolated events, they become part of an ever-improving detection system that benefits every customer.
Built to complement your SOC—not replace it
The Investigation Agent is not another SIEM or SOAR platform. Those technologies orchestrate workflows and aggregate alerts, but they can only reason over the data available to them—often missing the deep email telemetry, message artifacts, behavioral intelligence, and attack expertise needed to reconstruct sophisticated human-targeted attacks.
The Investigation Agent specializes in those investigations. It combines data from connected security tools with Proofpoint intelligence derived from billions of emails, native threat telemetry and artifacts, human behavior, and techniques observed across related campaigns. Through MCP-enabled connections, external systems and AI agents can tap into this rich investigative context—helping determine root cause, attacker intent, and blast radius without forcing analysts to leave their existing SOC environment.
Pricing and availability
The Investigation Agent will be available in early 2027 and consumed through Satori's flexible credit-based consumption model, allowing organizations to scale investigations based on demand while aligning usage with business priorities.
As part of the broader Satori platform, the Investigation Agent will help security teams shift from manually assembling evidence to reviewing complete investigations, accelerating response, improving detection, and giving analysts more time to focus on the decisions that matter most.