Swimlane has expanded its AI SOC platform with intelligent automation routing that directs security investigations to the appropriate level of AI or deterministic automation, helping organizations control AI costs as alert volumes grow.
Matching investigations to the right level of AI
According to Swimlane, the new capability aims to address the sharp rise in alerts facing security teams, particularly as more investigation tasks are pushed to AI models by default, a shift that can become costly at scale.
The capability evaluates each incoming alert and directs it to one of three execution paths: deterministic automation, AI-assisted investigation, or fully agentic investigation.
“As AI consumption continues to rise, the next generation of the SOC will not be able to run every task through AI by default. It will know which work actually needs AI,” said Cody Cornell, co-founder and chief executive officer at Swimlane.
“When you’re processing hundreds of thousands of investigations, spending five or ten dollars in tokens for each investigation doesn’t scale. Swimlane pairs the speed and predictability of automation with AI where reasoning and judgment create real value, so customers can expand what their SOC can handle without replacing an analyst-capacity problem with an AI-spend problem.”
By matching the level of AI involvement to the work required, Swimlane says it can help security teams increase investigation capacity without defaulting every task to a costly AI model.
Additionally, Swimlane’s AI SOC capability supports model selection to further optimize AI costs and allow customers to bring their own model (BYOM)
Reducing AI costs through intelligent routing
Swimlane envisions its new AI SOC offering as a way for security teams to reduce AI costs by balancing existing automation with artificial intelligence.
Well-understood alert types are sent directly to automation for maximum speed, scale, and predictability at a fraction of the cost of AI tokens. Unknown alert types are handled either through fully agentic investigations or AI-assisted investigations, in which analysts remain in control while AI handles the investigative work.
Over time, Swimlane says repeated investigations can be validated and codified into known automation paths, creating a system that it argues is more scalable and efficient.
In its press release, Swimlane highlighted a healthcare customer that investigates about 180 threats per day and reported 90% cost savings after using intelligent routing to reserve agentic AI for the most complex 10% of its investigation workload.
Turning repeated investigations into automation
The expanded AI SOC includes several capabilities designed to route and optimize investigations:
- Intelligent Automation Routing: A new routing layer within the Investigation & Response Agent evaluates each alert and directs it to deterministic automation, AI-assisted investigation, or fully agentic investigation based on the level of judgment required and the organization’s confidence in the outcome.
- Fully Agentic Investigations: For alerts an organization trusts, the Investigation & Response Agent handles the entire investigation with zero configuration. Trigger it from a webhook or an API call, and the agent takes it from there, no playbook required.
- Self-Learning Optimizations: Swimlane AI SOC learns as it investigates, letting teams codify knowledge gained from unknown alerts into repeatable playbooks. This creates a continuous optimization cycle in which investigations evolve from AI-driven to fully automated, keeping AI budget focused on complex work while maximizing the scale of standard automation.
Hero AI expands across the Turbine platform
Alongside its expanded Swimlane AI SOC, the company is also unveiling additional Hero AI capabilities designed to increase development capacity without requiring specialized platform expertise.
These include:
- Intelligent Visualization Agent: Users describe the report or visualization they need in plain language, and Hero AI instantly generates it, displays a live preview, and applies the result directly to a dashboard or case.
- Data Ingestion Agent: A deep agent connects Turbine to new ingestion sources, reducing the manual work required to build and maintain integrations.
- Enhanced Playbook Generator Agent: Hero AI now asks clarifying questions and provides real-time progress updates while creating or modifying playbooks, improving first-pass accuracy and reducing rework.
- Hero AI Model Selection: Customers can select a specific AWS Bedrock model for each Hero AI agent, allowing teams to align model cost, performance, and availability with task requirements.
“Turbine is evolving from a platform security teams build on to a platform they can simply ask,” said Srikant Vissamsetti, chief operating officer at Swimlane.
“Hero AI removes technical barriers across the platform, while intelligent routing ensures customers use AI with purpose. Together, these capabilities help security teams build faster, investigate more and maintain control over how AI is applied.”
The new capabilities are generally available now as part of the current Turbine release.
Meta’s water-positive AI data center pledge is facing industry scrutiny as questions emerge around its goal of restoring 200% of water consumption in high-water-stress areas. Read our Q&A with VVater CEO and Chairman Kevin Gast on why local conservation, water reuse, and efficiency will be critical to making the pledge meaningful.