CYBERSHIELD AI: Wizard Cyber's agentic SOC platform reaches a verdict in 3.5 minutes — humans still sign off

Wizard Cyber is handing the night shift to AI agents — but keeping the verdict with people. The London managed security provider launched CYBERSHIELD AI on November 6, an agentic platform in which specialised AI agents carry the triage and investigation workload of a security operations centre, while a senior analyst signs off every consequential decision.

The pitch is aimed at a bottleneck every security team knows: alert queues grow faster than headcount, and the work that suffers first is the patient, complete investigation of the alert that turns out to be real. Most automation so far has attacked the queue by closing things faster. Wizard Cyber says it built CYBERSHIELD AI on a different premise — that the bottleneck is investigative depth, and depth is what an agent can be made to do consistently, at three in the morning as reliably as at three in the afternoon.

What CYBERSHIELD AI does

CYBERSHIELD AI runs a roster of agent roles spanning five SOC functions, drawing on 250+ named analyst skills and 300+ AI tools. Rather than a single model answering a single prompt, each agent holds a defined role and a defined set of capabilities, and the work is distributed across them the way it would be across a staffed shift. On the vendor's own site, the platform is organised into three squads — Blue for defence and response, Red for adversary hunting, Green for detection engineering — coordinated by a SOC Manager agent.

Every alert enters the same multi-stage investigation pipeline. The pipeline includes a completeness gate — a checkpoint that will not allow an investigation to reach a verdict on partial evidence. Where the evidence is not there, the investigation continues or escalates; it does not close early to keep the queue moving. Related incidents are grouped into a case, and a case can be marked as a campaign where the pattern warrants it, so connected activity is investigated as one story rather than as a series of unrelated alerts.

The decision stays with policy and with people

The close-or-escalate decision is made by policy and by customer decision templates, not by the model. Autonomy is configurable, per agent and per tenant, so each customer sets how much the platform does on its own and where a human takes over. On the managed service, senior analyst sign-off is the default. Every investigation produces a full report, an escalation write-up where the case is escalated, a closing statement, and a drafted email — so the reasoning behind a verdict is written down and reviewable, not locked inside the system that produced it.

Each customer environment is isolated, and there is no cross-customer learning: nothing observed in one tenant informs the handling of another. That matters for a platform whose selling point is that it learns your estate — the learning stays inside your walls.

“The thing we kept coming back to is that speed is not the hard part. Getting to a defensible answer is the hard part, and doing it the same way at three in the morning as at three in the afternoon is harder still,” said Adam Jones, CTO and co-founder of Wizard Cyber, and the principal designer and architect of CYBERSHIELD AI. “So we built the platform around the investigation rather than around the queue. The agents do the work. The completeness gate stops an investigation closing before it should. And the decision to close or escalate is made by policy and by the customer’s own decision templates — not by the model, and not by a confidence score nobody outside the building can interrogate. A senior analyst signs it off. That accountability is the product, as much as the automation is.”

Speed, measured — and what to watch

Across the platform, Wizard Cyber reports an average time to verdict of 3 minutes 30 seconds, and 7 minutes 50 seconds where an incident needs Advanced Investigation — investigation times that would be difficult to sustain by hand at volume. The company says both figures are measured across its own SOC, with both clocks starting the moment a signal reaches the platform. They are vendor-reported numbers, not independently audited, and the release gives no false-positive rates or comparison against a human-only baseline — the two figures that would let a buyer judge whether the speed costs accuracy.

CYBERSHIELD AI is available now in three packages — Core, Complete and Command. Microsoft Sentinel is the only hard requirement; Wizard Cyber builds the tooling to fit the rest of the estate as part of the managed service. The platform can also run as a single-tenant deployment in the customer's own Azure, hosted by Wizard Cyber or self-hosted. Pricing was not disclosed, and the demo on offer is a working investigation shown end to end by an analyst, not a slide deck.

The launch lands in a week when security AI is moving fast. OpenAI launched GPT-6 Cyber on November 5, a model built to find and validate exploitable vulnerabilities that scored 48.5% on ExploitGym — and CrowdStrike shipped agentic adversary emulation the day before, an AI red team that attacks, hardens, then re-attacks to prove the fix. The contrast is the story: the frontier labs are building models that find vulnerabilities, while vendors like Wizard Cyber are building the agent teams that have to live with the alerts those models generate. The UK's own cyber chief warned this week that AI malware is “highly likely” in a ransomware attack on critical infrastructure by 2028 — the queue, in other words, is only going to get longer. Wizard Cyber's bet is that the answer is not faster closing, but investigations a human can still defend.