Sekoia describes Elevate as the agentic artificial intelligence layer of its security operations platform. The difference compared with a conventional artificial intelligence assistant is that the system is not limited to answering questions asked by a user, but can initiate and execute a sequence of tasks intended to investigate an alert. According to Sekoia's documentation, the agent can collect evidence from different sources, correlate it, incorporate threat intelligence, and produce a verdict accompanied by information that allows the process to be reviewed. In this way, the company seeks to have artificial intelligence take on part of the preparatory work traditionally performed by human analysts.<\/p>\n\n\n\n
The concept of agentic AI has gained relevance because it represents an evolution from generative models used solely to produce text, summarize information, or answer queries. An agent can receive a goal and use different tools to work toward it, always within the permissions and procedures that have been defined. In Sekoia's case, this means that an alert can trigger an investigation that combines different data sources and specific procedures before presenting a result. However, the usefulness of this approach depends on the quality of the available data, the rules used for investigations, and the mechanisms that allow analysts to review the results.<\/p>\n\n\n\n Sekoia maintains that Elevate can investigate alerts without necessarily waiting for an analyst to open each one. The company's technical documentation indicates that the agent can assess whether an alert appears to correspond to legitimate activity or a threat, collect evidence, and produce a result with an explanation in understandable language. A history of the actions and steps carried out during the investigation is also recorded, allowing the professional to review the procedure afterward. This design seeks to combine automation with human oversight, rather than suggesting that artificial intelligence should completely replace the security team.<\/p>\n\n\n\n One of the most notable figures from the launch of Sekoia Elevate is the volume of investigations conducted during the early access program. Sekoia states that, before the product's general availability, Elevate was used by more than 2,000 customers and hundreds of SOC analysts in production environments. The company also reports that during this period, the agents conducted more than 425,000 autonomous investigations. These figures come from information provided by Sekoia and should be understood as results reported by the company itself, rather than as an independent measurement that can guarantee that all organizations will achieve exactly the same performance.<\/p>\n\n\n\n Sekoia also states that some major managed security service providers, both in Europe and the United States, observed investigations that were up to five times faster during technology testing. This figure may be significant for companies that manage the security of numerous customers, because MSSPs must process large volumes of alerts and maintain reasonable response times. However, a reduction in time reported by certain participants does not necessarily mean that the same improvement will exist in every environment. The characteristics of each infrastructure, the amount of information available, the type of threats, and the platform's configuration can have a considerable influence on the results.<\/p>\n\n\n\n The company has also indicated that Elevate can produce a documented verdict in approximately 99 seconds on average. This figure should be interpreted with the same caution, because it corresponds to the conditions and data of the program communicated by Sekoia and does not constitute a guarantee that any cybersecurity investigation can be completed within that period. A simple and well-documented alert may require much less work than a complex incident involving multiple systems, users, and information sources. The value of the figure lies primarily in demonstrating the speed Sekoia aims to achieve through the automation of certain investigations.<\/p>\n\n\n\n The automation of investigations does not necessarily eliminate the need for cybersecurity specialists. On the contrary, one of the principles highlighted by Sekoia is that analysts can review, challenge, correct, or replace the conclusions generated by the agents. This is particularly important because an automated decision can be affected by incomplete information, incorrect data, or circumstances that were not considered by the investigation procedure. Keeping the professional involved in the process allows artificial intelligence to be used as a support tool without automatically turning its results into irreversible decisions.<\/p>\n\n\n\n Traceability is another important element of this approach. Sekoia states that Elevate records the queries executed by its agents and the evidence used to support their conclusions, allowing the analyst to understand how the result was constructed. This mechanism can be useful for reviewing an incident after it has occurred, identifying errors, and documenting the reasons that led to a particular classification. It may also be valuable for organizations that need to retain records of their investigations for operational, regulatory, or auditing purposes.<\/p>\n\n\n\n Transparency becomes even more important when artificial intelligence is incorporated into processes related to enterprise security. A tool that simply provides a result without explaining where it came from can make it more difficult to identify errors and complicate oversight. Sekoia attempts to address this issue by providing an investigation trail that can be examined by professionals. Nevertheless, the fact that a platform records its steps does not, by itself, mean that all of its conclusions are correct, which is why human oversight and the quality of the sources remain essential factors.<\/p>\n\n\n\n For years, the evolution of enterprise cybersecurity has focused on increasing the ability to detect suspicious behavior. Security platforms collect logs and telemetry from devices, servers, applications, networks, and other systems, and subsequently generate alerts when they identify patterns that may be related to a threat. The problem arises when an organization has to decide what to do with thousands or millions of potential signals. Sekoia proposes that the next stage consists not only of automating the generation of alerts, but also part of the investigation required to determine which ones deserve attention.<\/p>\n\n\n\n This distinction is important because an alert does not necessarily constitute a security incident. Apparently unusual behavior may be the result of legitimate activity, a specific configuration, or a normal change within the infrastructure. Determining this requires incorporating context and cross-checking different information sources. Sekoia Elevate attempts to perform this correlation automatically, so that analysts receive a structured investigation instead of having to start manually from the initial signal.<\/p>\n\n\n\n This approach may change the distribution of work within a SOC. Instead of spending a significant part of the working day looking for basic data for each alert, analysts could focus on investigating confirmed incidents, making decisions, and responding to situations that require expertise. This transformation does not necessarily mean that human work will disappear, but rather that the nature of that work may change. Sekoia presents precisely this evolution as a shift from the manual collection of information toward security decision-making.<\/p>\n\n\n\n One of Sekoia's central arguments is that the performance of an artificial intelligence agent does not depend exclusively on the model being used. The company maintains that the system surrounding the model plays a fundamental role, particularly in areas such as cybersecurity. This system includes threat intelligence, security data, customer-specific context, memory of previous investigations, integrations, and procedures that tell the agent how it should act. From this perspective, the AI model is one component within a broader infrastructure.<\/p>\n\n\n\n This approach also explains why a specialized platform can differentiate itself from a general-purpose artificial intelligence tool. A language model may be capable of interpreting text or generating responses, but it does not automatically know a company's assets, internal policies, logs, or the relationships between its different systems. A security platform must connect the model to these information sources and define what actions it can perform. Sekoia is specifically seeking to build this connection within its security operations platform.<\/p>\n\n\n\n The company also states that Elevate is independent of specific models and can select the most appropriate model for each task. This strategy is intended to prevent the entire platform from depending on a single artificial intelligence technology and to allow new models to be incorporated as the market evolves. However, the true usefulness of this architecture will have to be observed in practice and will depend on factors such as the quality of the models used, how their updates are managed, and the controls applied to the information they process.<\/p>\n\n\n\n Sekoia's development is taking place at a time of transformation for security operations centers. Traditional SOCs have relied heavily on human teams that review alerts generated by multiple tools and determine which ones require deeper investigation. As the number of connected devices and the amount of available telemetry increase, maintaining this model exclusively through human intervention can become difficult to scale. Artificial intelligence therefore emerges as an alternative for processing certain volumes of information more quickly.<\/p>\n\n\n\n Sekoia is not the only company attempting to apply AI agents to cybersecurity, but its proposal specifically focuses on making automated investigation an integrated part of operations. The platform seeks to leverage the security data an organization already collects and use it to conduct investigations continuously. In theory, this could reduce delays caused by backlogs of pending alerts. In practice, the outcome will depend on the platform's ability to properly distinguish relevant signals from legitimate activity.<\/p>\n\n\n\n The growth of artificial intelligence is also related to attacker behavior. Reuters noted in connection with the launch of Sekoia that malicious actors are increasingly turning to AI agents and that cybersecurity companies are developing their own automated tools in response. This does not mean that all current threats are autonomous or that artificial intelligence has replaced the traditional techniques used in attacks. Rather, it means that AI is progressively being incorporated on both sides of the technological confrontation and that defenders need to adapt their capabilities to this new scenario.<\/p>\n\n\n\n Managed security service providers may be one of the groups most interested in this type of technology. An MSSP can manage the security of numerous companies simultaneously, meaning that the number of alerts it must process can grow rapidly. Automating repetitive investigations could allow specialists to spend more time on complex incidents and response activities. Sekoia has specifically stated that some providers from Europe and the United States participated in Elevate's testing and reported significant reductions in investigation times.<\/p>\n\n\n\n The possibility of expanding the capacity of a SOC without proportionally increasing the number of analysts is one of the main promises of automation. This can be particularly relevant for organizations that have difficulty hiring or retaining highly qualified specialists. An agent can work continuously and process alerts outside business hours, while professionals intervene when an investigation requires validation or a specific response. However, this model requires clear limits to be established regarding which decisions can be automated and which must remain under human control.<\/p>\n\n\n\n There are also risks associated with scalability. If a provider uses the same automation across many customers, a configuration error or incorrect interpretation could be replicated across multiple environments. Therefore, the growth of automation must be accompanied by control mechanisms, testing, oversight, and the ability to quickly review decisions produced by the system. Technology can increase a provider's operational capacity, but it does not eliminate the need for appropriate governance processes.<\/p>\n\n\n\n The use of artificial intelligence in cybersecurity also raises questions related to privacy and the protection of sensitive information. Security investigations may contain user logs, addresses, device names, application data, information about vulnerabilities, and other elements that an organization may not necessarily want to share with third parties. Sekoia states that Elevate's computing and AI run on its own infrastructure and that customer data is not sent to external large language model providers. This is a feature communicated by the company and should be evaluated based on the specific architecture, contracts, and policies of each implementation.<\/p>\n\n\n\n Control over data is particularly important in regulated sectors or companies that handle strategic information. An artificial intelligence system connected to security tools may have access to a considerable amount of internal information. Therefore, organizations must determine what data the agent can access, what actions it can perform, and which records must be retained. Sekoia presents its platform as an open solution integrated with existing security environments, but each customer must establish its own access and governance policies.<\/p>\n\n\n\n The security of the artificial intelligence itself must also be considered. An agent capable of accessing data and performing certain actions becomes a component that must be protected against misuse. Permissions, credentials, integrations, and the instructions used by the system form part of the organization's security attack surface. The adoption of AI does not eliminate traditional threats; instead, it adds new elements that must be managed within the overall protection strategy.<\/p>\n\n\n\n The launch of Sekoia Elevate shows how artificial intelligence is entering a new phase within enterprise cybersecurity. Rather than being limited to generating summaries or answering questions, Sekoia's agents are designed real challenge will be to determine how this technology evolves when it is used continuously across different sectors, infrastructures, and threat scenarios. The speed of an investigation is important, but so are the accuracy of its conclusions, the quality of the evidence, data protection, and the ability of a specialist to oversee and correct the result. Sekoia has opted for a model in which automation and human intervention coexist, with mechanisms designed to record evidence and keep analysts involved reviewing infrastructures, systems, networks, access, data, processes, and response capabilities, in addition to selecting the appropriate tools for each environment. In this area, ITD Consulting can help organizations assess their technology and security needs, identify opportunities for improvement, and design IT strategies aligned with their business objectives. To learn more about ITD Consulting's services and discuss how to strengthen an organization's technology and cybersecurity infrastructure, you can write to info@ to investigate alerts, correlate evidence, consult threat intelligence, and present conclusions that analysts can review. Sekoia states that its early access program involved more than 2,000 customers and enabled more than 425,000 autonomous investigations, while certain participating providers reported investigations that were up to five times faster. These results are relevant for understanding the company's proposal, although they should be considered data provided by Sekoia and not as a universal performance guarantee.<\/p>\n\n\n\n The real challenge will be to determine how this technology evolves when it is used continuously across different sectors, infrastructures, and threat scenarios. The speed of an investigation is important, but so are the accuracy of its conclusions, the quality of the evidence, data protection, and the ability of a specialist to oversee and correct the result. Sekoia has opted for a model in which automation and human intervention coexist, with mechanisms designed to record evidence and keep analysts involved in the decision-making process. In a context where digital attacks continue to evolve and artificial intelligence can be used by both defenders and attackers, this combination of automation, specialized knowledge, and oversight will become an increasingly relevant element.<\/p>\n\n\n\n For companies evaluating how to prepare for this new stage of cybersecurity, the incorporation of solutions such as those developed by Sekoia should also form part of a broader technology strategy. Enterprise protection requires reviewing infrastructures, systems, networks, access, data, processes, and response capabilities, in addition to selecting the appropriate tools for each environment. In this area, ITD Consulting can help organizations assess their technology and security needs, identify opportunities for improvement, and design IT strategies aligned with their business objectives. To learn more about ITD Consulting's services and discuss how to strengthen an organization's technology and cybersecurity infrastructure, you can write to<\/strong> info@itdconsulting.com<\/strong><\/a>.<\/strong><\/p>","protected":false},"excerpt":{"rendered":" Sekoia impulsa la inteligencia artificial para transformar la ciberseguridad. ITD Consulting te brinda un an\u00e1lisis de esta innovaci\u00f3n en seguridad.<\/p>","protected":false},"author":5,"featured_media":37525,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[16],"tags":[459,71,89,68,575],"class_list":["post-37521","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-noticias","tag-459","tag-ciberseguridad","tag-ia","tag-seguridad","tag-sekoia"],"_links":{"self":[{"href":"https:\/\/itdconsulting.com\/en\/wp-json\/wp\/v2\/posts\/37521","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/itdconsulting.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/itdconsulting.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/itdconsulting.com\/en\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/itdconsulting.com\/en\/wp-json\/wp\/v2\/comments?post=37521"}],"version-history":[{"count":1,"href":"https:\/\/itdconsulting.com\/en\/wp-json\/wp\/v2\/posts\/37521\/revisions"}],"predecessor-version":[{"id":37526,"href":"https:\/\/itdconsulting.com\/en\/wp-json\/wp\/v2\/posts\/37521\/revisions\/37526"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/itdconsulting.com\/en\/wp-json\/wp\/v2\/media\/37525"}],"wp:attachment":[{"href":"https:\/\/itdconsulting.com\/en\/wp-json\/wp\/v2\/media?parent=37521"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/itdconsulting.com\/en\/wp-json\/wp\/v2\/categories?post=37521"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/itdconsulting.com\/en\/wp-json\/wp\/v2\/tags?post=37521"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}![\"ITD](\"https:\/\/itdconsulting.com\/wp-content\/uploads\/2026\/10\/itd-consulting-backup-acronis-vds-vps-ciberseguridad-microsoft-365-Sekoia-ciberseguridad-1-1024x576.webp\")
<\/figure>\n\n\n\nMore Than 425,000 Investigations During Early Access<\/strong><\/h2>\n\n\n\n
The Analyst Retains a Fundamental Role<\/strong><\/h2>\n\n\n\n
From Threat Detection to Automated Investigation<\/strong><\/h2>\n\n\n\n
![\"ITD](\"https:\/\/itdconsulting.com\/wp-content\/uploads\/2026\/10\/itd-consulting-backup-acronis-vds-vps-ciberseguridad-microsoft-365-Sekoia-ciberseguridad-2-1024x683.webp\")
<\/figure>\n\n\n\nThe System Around Artificial Intelligence<\/strong><\/h2>\n\n\n\n
Sekoia and the Evolution of Security Operations Centers<\/strong><\/h2>\n\n\n\n
The Potential Impact on MSSPs<\/strong><\/h2>\n\n\n\n
Security, Privacy, and Data Control<\/strong><\/h2>\n\n\n\n
![\"ITD](\"https:\/\/itdconsulting.com\/wp-content\/uploads\/2026\/10\/itd-consulting-backup-acronis-vds-vps-ciberseguridad-microsoft-365-Sekoia-ciberseguridad-3-1024x577.webp\")
<\/figure>\n\n\n\n