Swimlane has expanded Swimlane AI SOC with intelligent automation routing designed to support end-to-end agentic security investigations. The new capability evaluates incoming alerts and routes each to the appropriate workflow—deterministic automation, AI-assisted investigation, or fully agentic investigation. By applying AI based on the complexity of each task, Swimlane helps security teams scale investigation capacity while avoiding unnecessary AI model costs.
AI Where It Matters, Automation Everywhere Else
Security teams are being asked to investigate more alerts with the same headcount, at the exact moment token costs across the industry are climbing. Many AI SOC platforms respond by pushing every task through a model, regardless of whether the task needs one. Swimlane takes a different approach: intelligent routing decides, alert by alert, whether the job needs automation, AI assistance, or a fully agentic investigation, and sends it down that path automatically. Additionally, Swimlane’s AI SOC capability supports model selection to optimize AI costs and allows customers to bring their own model (BYOM)
“As AI consumption continues to rise, the next generation of the SOC will not be able to run every task through AI by default. It will know which work actually needs AI,” said Cody Cornell, Co-Founder and CEO of Swimlane. “When you’re processing hundreds of thousands of investigations, spending five or ten dollars in tokens for each investigation doesn’t scale. Swimlane pairs the speed and predictability of automation with AI where reasoning and judgment create real value, so customers can expand what their SOC can handle without replacing an analyst-capacity problem with an AI-spend problem.”
A More Sustainable Path to the Agentic SOC
With Swimlane AI SOC, security teams stop paying AI prices for work automation already does well, sending well-understood alert types straight to automation for maximum speed, scale and predictability at a fraction of the cost of AI tokens. Unknown alert types are handled either by fully agentic investigations where Hero reaches a verdict with zero human configuration or touch, or through AI-assisted investigations where analysts remain in control but AI handles the investigation work, provides context and recommends the next action.
This balance of automation and AI translates into immediate financial impact. For example, a Swimlane healthcare customer who was investigating about 180 threats a day achieved 90% of cost savings by using intelligent routing to reserve agentic AI for only the most complex 10% of threats across their entire investigation workload.
Over time, repeated investigations get validated and codified into known automation paths. The system becomes more scalable and more efficient as it learns from the work it has already done.
New capabilities include:
- Intelligent Automation Routing: A new routing layer within the Investigation & Response Agent evaluates each alert and directs it to deterministic automation, AI-assisted investigation or fully agentic investigation based on the level of judgment required and the organization’s confidence in the outcome.
- Fully Agentic Investigations: For alerts an organization trusts, the Investigation & Response Agent handles the entire investigation with zero configuration. Trigger it from a webhook or an API call, and the agent takes it from there, no playbook required.
- Self-Learning Optimizations: Swimlane AI SOC learns as it investigates, letting teams codify knowledge gained from unknown alerts into repeatable playbooks. This creates a continuous optimization cycle in which investigations evolve from AI-driven to fully automated, keeping AI budget focused on complex work while maximizing the scale of standard automation.
Built to Avoid the Tradeoffs of AI-First and Automation-Only Platforms
Traditional SOAR platforms are effective for deterministic processes but can require significant expertise to build and maintain. AI-first SOC products can reduce manual investigation work, but often depend on model-driven processing even when a known automation path would be more efficient. Swimlane combines both approaches in one governed platform and dynamically selects the right one for each alert.
The same architecture gives enterprises the control required to operate AI safely at scale, including analyst oversight, transparent case management and the ability to govern how investigations are executed across security functions.
Additional Hero AI Innovations
The Turbine release also expands how security practitioners build and manage automation through Hero AI, helping teams increase development capacity without requiring specialized platform expertise.
- Intelligent Visualization Agent: Users describe the report or visualization they need in plain language, and Hero AI instantly generates the visualization, displays it in a live preview and applies the result directly to a dashboard or case.
- Data Ingestion Agent: A deep agent connects Turbine to new ingestion sources, reducing the manual work required to build and maintain integrations.
- Enhanced Playbook Generator Agent: Hero AI now asks clarifying questions and provides real-time progress updates while creating or modifying playbooks, improving first-pass accuracy and reducing rework.
- Hero AI Model Selection: Customers can select a specific AWS Bedrock model for each Hero AI agent, allowing teams to align model cost, performance and availability with the requirements of the task.
“Turbine is evolving from a platform security teams build on to a platform they can simply ask,” said Srikant Vissamsetti, Chief Operating Officer at Swimlane. “Hero AI removes technical barriers across the platform, while intelligent routing ensures customers use AI with purpose. Together, these capabilities help security teams build faster, investigate more and maintain control over how AI is applied.”
Learn more at: swimlane.com
Related Posts:
Swimlane AI SOC for MSSPs Expands AI-Driven Security Operations
