Agentic artificial intelligence cybersecurity automation company Swimlane Inc. today announced the expansion of the company’s AI security operations center to support automatic routing for security investigations.

The new capability enables routing of incoming alerts to different paths: deterministic automation, AI-assisted investigation or agentic automation.

The company said the front-end triage capability allows the system to quickly assess the complexity of the work and the level of AI involvement needed to assist the alert. Swimlane’s AI-assisted system helps security teams handle cybersecurity-related events and uses its AI to up-level their investigation capability, without defaulting every task to expensive AI models.

“As AI consumption continues to rise, the next generation of the SOC will not be able to run every task through AI by default. It will know which work actually needs AI,” explained co-founder and Chief Executive Cody Cornell. 

Cornell went on to say that at the scale of hundreds of thousands of investigations, $5 to $10 for each investigation piles up quickly. The objective of Swimlane routing each alert to the appropriate model – small or large – for the appropriate level of reasoning is to provide the correct layer of assistance for the security team, without breaking the bank.

Of course, if the router sends what looked like a simple alert to deterministic automation but it was actually the tip of the iceberg, the security team can still route it to a higher-reasoning model. This means the team always remains in control and the AI under the hood remains a tool, not a replacement for human ingenuity or judgment.

“Customers can expand what their SOC can handle without replacing an analyst-capacity problem with an AI-spend problem,” Cornell said.

What the new router does for teams

Swimlane said the new router helps prevent everything from getting baked by a high-reasoning AI model. Not every alert requires an expensive agentic AI evaluation. Sometimes it’s just an alert and can go onto the pile, since that’s the nature of false positives, but sometimes it’s part of a trend and should be examined and then surfaced for the team, with the reasoning explained.

When that happens, the agent goes into action and the SOC learns what alerts the team wants evaluated. It turns these into repeatable playbooks. This creates a continuous, adaptable and configurable cycle that can be fully automated, keeping the AI budget focused on the complex work while maintaining scale where the investigators do their work.

Swimlane said the problem arises because, although AI-driven platforms promise to reduce tedious manual labor and investigation work, they also send what could be done with deterministic scripts to generative AI models. This means an expensive AI model crunches something as simple as a text search or does work that could have been done with a six-line Python script. This is a potential tradeoff of several thousand percent in costs for an outcome where the generative AI could provide a wildly different answer.

The company said the vision behind the AI-first SOC was to give security professionals control over the extent of their investigations behind the scenes and manage their tools by having an orchestrator watch incoming alerts and guide them to the appropriate “bucket,” leading to real financial impact.

One healthcare customer investigating more than 180 threats a day achieved 90% in cost savings by using intelligent routing. It reserved agentic AI evaluation for only the most complex 10% of threats across investigations.

“Swimlane pairs the speed and predictability of automation with AI where reasoning and judgment create real value,” said Cornell.

Image: SiliconANGLE/Ideogram