Swimlane’s AI SOC Recognition Signals a New Push for Governed Automation

Swimlane announced on November 12, 2026, that Frost & Sullivan named it a Visionary Leader in the 2026 Frost Radar for AI security operations center platforms. The recognition places the company in a fast-growing field built around using artificial intelligence to investigate and respond to cyber threats.

Swimlane received an innovation score of 4.45 out of five and a growth score of 4.30. Frost & Sullivan evaluated more than 60 AI SOC vendors and selected 24 growth and innovation leaders, while the broader market contains more than 80 vendors. The Visionary Leader category recognizes companies that combine innovation, growth and industry influence.

The timing reflects a practical problem for security teams. Skills shortages and alert fatigue have pushed teams to look beyond alert triage toward coordinated detection, investigation and response. The challenge is making that work faster without giving an automated system more freedom than a customer can control.

How Swimlane’s hybrid AI SOC works

Swimlane says its AI SOC, powered by Hero AI, can investigate and resolve known and novel incidents on its own, subject to approval gates set by each customer. The platform covers 16 security and IT domains, including endpoint, cloud, identity, email, threat intelligence, operational technology, connected devices, security information and event management, and vulnerability management.

Rather than requiring customers to duplicate records, agents query data in SIEM platforms, cloud services, on-premises data lakes and operational stores. The system pulls relevant evidence into an investigation record, while customers decide what Swimlane stores and how long it keeps that information.

Hero AI maps those sources and enriches alerts with threat intelligence, organizational context, investigation history, and the MITRE ATT&CK and D3FEND security frameworks. Swimlane says deep agents handle complex reasoning, while expert agents take on specialized tasks. Customers also choose model providers and deployment locations based on task complexity and cost.

That combination gives the platform two ways to handle work. The Investigation & Response Agent creates plans that analysts can review or override, then Hero AI can execute those plans or convert them into deterministic playbooks, which are fixed automation sequences for repeatable work.

Adaptive reasoning is reserved for novel threats, while recurring activity uses predictable, lower-cost execution. Swimlane reports that one healthcare customer handling about 180 threats a day reduced investigation costs by up to 90% through this hybrid approach. That result applies only to that customer, not to a platform-wide average.

Control and auditability remain central

Swimlane says every large-language-model interaction and agent action is auditable. Agents carry governed identities, role-based access controls and lifecycle controls, while tenant-isolated data and connectors separate customer environments.

Customers set the boundaries for model providers, deployment locations, autonomy, knowledge access and deterministic execution. Those controls define what the system can do without approval and give security teams a way to limit automated actions around sensitive investigations.

Lucas Ferreyra, an industry principal at Frost & Sullivan, said the placement reflected Swimlane’s vendor-neutral design, broad coverage, auditability and pairing of agents with automation. Those features address the trust problem at the center of AI SOC adoption: teams want autonomous operations, but they also need to understand and control each action.

Other AI security moves add to the momentum

Swimlane’s recognition arrived alongside several other security developments. Sekoia was recognized as an Innovator in Frost & Sullivan’s Frost Radar: AI SOC and received an innovation score of 4.25 out of five, its strongest innovation score to date. Its assessment highlighted a vendor-agnostic, integration-led approach to AI security operations, along with agentic capabilities and broad third-party integrations.

Criminal IP, the AI-powered threat intelligence and attack surface management platform developed by AI SPERA, launched the Criminal IP TI Feed app for Splunk on November 11, 2026. The app is available through Splunkbase and automatically correlates Criminal IP threat intelligence with firewall traffic logs collected in Splunk.

The integration helps security teams determine whether organizational assets communicated with malicious IP addresses and whether those sessions were successfully established. It expands Criminal IP’s Splunk ecosystem beyond individual IP lookups and fraud detection, helping SOC teams identify high-priority threats within existing Splunk workflows.

Huntress announced a wave of innovations across the Huntress Agentic Security Platform on November 5, 2026. The advancements span identity, endpoint, SIEM and security awareness, turning intelligence from real-world cyberattacks into proactive defenses for customers and partners. Huntress says the changes help businesses close security gaps before adversaries exploit them and disrupt attacks at machine speed.

The broader conversation also includes the risks that appear when AI agents can act across business systems. In an article dated Nov 12, 2026, Donna Dror, CEO at Usercentrics, described a scenario where an AI agent with access to a CRM sends a message to an entire customer list. The clock starts ticking when the first customer replies, raising direct questions about what the agent did, which actions can be reversed, who can stop it mid-workflow and what must be disclosed, and to whom.

Together, these developments point to a security market focused on useful automation with clear boundaries. AI SOC platforms are moving from alert handling toward investigation, response and prevention, but audit trails, approval gates and customer-controlled limits remain just as important as speed.

Stay connected via Google News

Follow us for the latest AI News