The pitch is simple: security tools have spent twenty years producing better alerts, and SOC teams have grown to process them. As telemetry expands and attackers adopt AI, that model no longer scales. Elevate flips it — machines do the investigative work at speed, while security teams keep governance and control over the final decisions, according to Sekoia’s announcement.

How it works#

For each case, Elevate’s agents gather and correlate raw logs, detections, threat intelligence, runbooks and response context — the manual groundwork that normally absorbs analyst time. The output is a verdict backed by a traceable record of every query the agents ran and every piece of evidence behind the finding. Analysts can review, correct or override any conclusion, and every change is logged for incident review and audit. Each validated or corrected investigation also enriches the context available to the next one.

Graphic: 425,000 autonomous investigations completed in Early Access
Designed graphic for this article.

425,000 investigations before launch#

Elevate arrives with more field time than most GA launches. During Early Access in real production environments, it was deployed to more than 2,000 customers and hundreds of SOC analysts, and completed more than 425,000 autonomous investigations, correlating evidence across all connected data sources. Sekoia says leading managed security service providers in Europe and the US report up to a fivefold reduction in overall investigation time, alongside deeper and more consistent threat analysis.

Graphic: fivefold reduction in investigation time reported by MSSPs
Designed graphic for this article.

The analyst stays in charge#

“The alert economy is ending,” said Freddy Milesi, CEO of Sekoia. “The model alone is not the moat. What makes an agent effective in the SOC is the system around it: threat intelligence, customer context, memory and the ability to act. Elevate is that system in production, delivering autonomous cyber defense independent of any single stack or model.”

The platform is model-agnostic — it chooses the right model for each task — and open by design, working across the customer’s existing security stack rather than replacing it. “Elevate shifts the analyst’s role from data miner to decision-maker,” said Georges Bossert, Sekoia’s chief technology and product officer. “Our agents do the exhaustive groundwork from raw data and explain every step, so security teams can focus on the decisions that protect the business, without giving up control.”

Why now#

The autonomous SOC is becoming the most contested slice of AI cybersecurity. Alerts keep multiplying while analyst headcount stays flat, and buyers are no longer asking whether agents can investigate — they’re asking whether the investigation is auditable. Sekoia’s answer is European by design: all AI runs on its own infrastructure with no customer data sent outside, aimed at organizations prioritizing data residency and autonomy, per its product page.

If Elevate’s early-access numbers hold in production, the industry’s next bottleneck won’t be alert volume at all. It will be whether security teams are ready to hand the groundwork to machines — and spend their judgment on the verdicts that actually matter.

Sources