Proofpoint Unveils SOC Analyst Agent, Merging OpenAI’s Expertise for Enhanced Threat Investigation
Sunnyvale, California – September 3, 2026 – Proofpoint, Inc., a distinguished leader in human and agent cybersecurity, has announced the introduction of the Proofpoint SOC Analyst Agent. This innovative tool integrates Proofpoint’s security knowledge with advanced AI capabilities from OpenAI, aimed at empowering security teams to investigate threats more efficiently within their security data environment. This marks the first instance of a capability derived from the OpenAI Daybreak Defense Network, specifically designed to optimize investigation workflows by transforming natural language inquiries into structured, actionable findings, all while ensuring that critical security decisions remain in human hands.
The cybersecurity landscape has become increasingly complicated, with security teams encountering a deluge of alerts and data from various tools and workflows. A 2025 Data Security Landscape report from Proofpoint revealed that over half (54%) of organizations are already leveraging AI-enhanced capabilities to manage and investigate alerts. Despite this, security operations centers (SOCs) continue to grapple with the challenge of connecting signals from diverse security systems, establishing context, and determining which threats necessitate immediate attention. The SOC Analyst Agent is set to alleviate some of this investigative burden, offering defenders a streamlined pathway from disparate signals to informed decision-making.
Daniel Rapp, Chief Data and AI Officer at Proofpoint, emphasized the challenges faced by security teams in a complex environment. He stated, "The challenge for security teams is to cut through the noise to quickly identify which signals matter and reach a defensible decision fast enough to act." Rapp highlighted that the SOC Analyst Agent amalgamates expert security knowledge with OpenAI’s advanced AI reasoning to facilitate swift movement from investigation to action, while ensuring that humans retain control over critical security decisions.
In corroboration of this mission, McCall McIntyre, Head of Global Cyber Partnerships at OpenAI, articulated the initiative’s goal. McIntyre noted, "Our goal through the OpenAI Daybreak Defense Network is to give defenders the advantage of frontier AI, safely." He elaborated on how the Proofpoint SOC Analyst Agent illustrates the potential of frontier AI in enabling defenders to act more swiftly while maintaining control, enhancing the speed and clarity of investigations.
The functionality of the SOC Analyst Agent revolves around its ability to plan investigations and draw context from a multitude of connected Proofpoint security data sources. This includes alerts, logs, data loss prevention incidents, and user risk signals. Users will be able to utilize natural language queries to synthesize findings and resolve security issues much more efficiently than the previous norm of switching between various consoles or crafting individual queries.
The agent is structured around three fundamental capabilities designed to expedite and enhance the investigative process:
-
Accelerate Investigations: Analysts can expedite their investigations into security events by utilizing natural language queries across connected Proofpoint products, significantly minimizing the manual effort traditionally required to gather context.
-
Automate Recurring Analysis: Teams are empowered to set up scheduled workflows for routine actions such as threat hunts, data security investigations, and escalation reporting, ensuring that results are systematically routed to the appropriate analysts.
- Maintain Analyst Control: Recommendations made by the agent are directly traceable to the underlying source data. This traceability allows analysts to validate findings before making crucial decisions, ensuring that the agent does not autonomously initiate significant account changes or remediation actions.
The SOC Analyst Agent is the inaugural offering from Proofpoint as part of its collaboration with the Daybreak Defense Network, which began in June 2026. This partnership aims to leverage OpenAI’s cyber-tuned AI models across Proofpoint’s diverse products, services, and workflows.
In addition to the new SOC Analyst Agent, Proofpoint is exploring broader applications for OpenAI’s Daybreak models within its comprehensive security portfolio. This includes advancements in threat research, data security, and AI security. Future developments may leverage AI reasoning to assist threat researchers in following confirmed malicious activities across networks, thus enhancing overall detection capabilities and fostering a closed-loop strategy for data and AI security that transitions smoothly from detection to investigation and ultimately to a recommended remedial action subject to human approval.
Currently, the SOC Analyst Agent is available in a private preview phase for selected beta customers, with general availability anticipated by the end of Q3 2026.
For more insights and information, further details can be found in the dedicated blog post here.
About Proofpoint, Inc.
Proofpoint, Inc. stands as a global leader in human and agent cybersecurity, dedicated to securing connections between people, data, and AI agents across platforms such as email, cloud, and collaborative tools. The company partners with over 80 of the Fortune 100 and more than 14,000 large enterprises, alongside millions of smaller organizations, in their efforts to thwart threats, prevent data breaches, and enhance resilience in both personnel and AI workflows. Proofpoint’s united collaboration, data, and AI security platforms empower organizations of all sizes to safeguard their employees and facilitate the secure and confident adoption of AI technologies. More information can be accessed at www.proofpoint.com.