Cybersecurity vendor Proofpoint said this week it has introduced an AI agent that lets security analysts investigate threats in plain English, the first product to come out of its partnership with OpenAI's Daybreak Defense Network.
The tool, called the SOC Analyst Agent, is built on OpenAI's cyber-tuned Daybreak models and is designed to turn a natural-language question from an analyst into a structured, source-linked set of findings, according to a press release from Proofpoint. Rather than manually pulling together alerts, log data, data-loss-prevention events and user risk scores, an analyst can ask the agent a question and receive findings tied back to the underlying data, along with recommended next steps.
Investigation, not automatic response
Proofpoint has been explicit that the agent is meant to speed up investigation, not to take enforcement actions on its own. Daniel Rapp, the company's chief data and AI officer, framed the problem it is meant to solve as one of triage under pressure. "The challenge for security teams is to cut through the noise to quickly identify which signals matter and reach a defensible decision fast," Rapp said in the announcement.
The company cited its own 2025 Data Security Landscape report in noting that 54% of organizations already use some form of AI-enhanced capability to triage and investigate security alerts, a figure the company is using to argue that agentic tools are becoming standard equipment in security operations centers rather than a novelty.
Proofpoint joined OpenAI's Daybreak Defense Network in June, a program through which OpenAI licenses cyber-specialized versions of its models to security vendors. McCall McIntyre, OpenAI's head of global cyber partnerships, said the release shows "how frontier AI can help defenders move faster without giving up control," language that echoes a broader industry effort to position agentic security tools as assistants that keep a human in the loop for consequential decisions, following criticism of earlier AI security products that acted with less oversight.
What happens next
The SOC Analyst Agent is currently in private preview with a limited group of beta customers, and Proofpoint is targeting general availability by the end of the third quarter of 2026 — meaning the wider rollout could come within weeks. The company said it is also exploring additional uses for Daybreak models elsewhere in its portfolio, including threat research, data security and AI security products, suggesting this week's launch is the first of several planned integrations rather than a one-off release.
The launch adds Proofpoint to a growing list of security vendors racing to embed agentic AI into their platforms, a trend that is reshaping how enterprise security teams staff and structure their operations centers as vendors compete to demonstrate measurable reductions in investigation time.