Proofpoint has introduced its new SOC Analyst Agent, which is an AI tool designed to speed up how analysts investigate threats across Proofpoint’s security data, and it’s notably the first product to come out of the company’s partnership with OpenAI’s Daybreak Defense Network.
Proofpoint’s own research found that more than half of organizations are already using AI to help triage security alerts, but the real bottleneck isn’t the AI; it’s connecting scattered signals across different tools, building context, and figuring out what actually deserves attention. In short, the challenge is cutting through the noise fast enough to make a decision you can actually defend. As such, the SOC Analyst Agent is built to close that gap by combining Proofpoint’s security data with OpenAI’s Daybreak reasoning models.
In practice, the agent lets analysts ask questions in plain language instead of jumping between consoles or writing custom queries. It pulls context from connected Proofpoint sources, including alerts, logs, data loss prevention events, and user risk signals, then turns that into structured findings and suggested next steps. It’s built around three main capabilities: speeding up investigations by synthesizing information automatically, automating recurring tasks like scheduled threat hunts or escalation reports, and critically, keeping humans in control. Every finding traces back to its source data so analysts can verify it themselves, and the agent won’t independently make account changes or take remediation action on its own.
McCall McIntyre, who heads Global Cyber Partnerships at OpenAI, framed the collaboration as giving defenders frontier AI capabilities without losing oversight, essentially speeding up the investigative process while keeping actual decision-making with people. Proofpoint says this is just the first capability coming out of the Daybreak partnership, with more defensive security workflows in the pipeline, including threat research and a more closed-loop approach to data and AI security that could eventually connect detection all the way through to a recommended fix for human review.
The SOC Analyst Agent is currently in private preview with select beta customers, with general availability expected by the end of Q3 2026.
