Arctic Wolf is expanding its AI-powered security capabilities with new tools designed to stop cyberattacks earlier, identify unauthorized AI usage, and provide greater transparency into automated security operations.
Announced at the company’s 2026 Security Operations Summit, the innovations include Aurora Adaptive Threat Protection, a new endpoint security offering; SwarmView, which provides visibility into AI-driven security investigations; and Shadow AI Discovery, which helps organizations identify AI tools operating across their environments.
Arctic Wolf also announced a partnership with Veeam to bring backup and recovery intelligence into its Aurora Superintelligence Platform.
For MSPs and MSSPs, the developments could create opportunities to expand managed security offerings around proactive threat prevention, AI governance, and security operations reporting without requiring customers to replace existing security investments.
Aurora Adaptive Threat Protection targets attacks earlier
Arctic Wolf introduced Aurora Adaptive Threat Protection, a next-generation endpoint security solution that unlocks AI-powered, intent-based detection to identify, disrupt, and reverse ransomware, credential theft, and other evasive attacks earlier in the attack chain.
The solution introduces a new approach to endpoint security built for today’s AI threat landscape.
Aurora Adaptive Threat Protection helps organizations by identifying malicious intent earlier in the attack lifecycle and helping stop attacks before they cause significant damage.
It’s designed to operate alongside existing endpoint protection (EPP) and detection and response (EDR) solutions, including third-party platforms and Aurora Endpoint Security, extending protection without requiring organizations to replace what they already have.
“Attacks often don’t need malware to cause damage. They can use legitimate tools, trusted credentials, and AI-driven automation to hide in plain sight, all at machine speed,” said Dan Schiappa, President of Technology and Services at Arctic Wolf. “That’s why endpoint security needs to evolve. Endpoint detection and response does rich detection well, but that work needs to happen earlier.”
“Aurora Adaptive Threat Protection shifts the mindset from a purely detection and response approach to a more preemptive approach, identifying malicious intent and disrupting threats earlier in the attack chain,” Schiappa adds.
Key capabilities include:
- Visibility into the entire attack story: The solution tracks the full history of endpoint activity to provide greater context around how attacks unfold, helping security teams identify and address threats that may otherwise appear as disconnected, legitimate actions.
- Prevents and rolls back attacks: Automatically reverses malicious activity throughout the attack chain to help restore normal business operations quickly and efficiently.
- Works with existing security investments: Enhances existing EPP and EDR investments by deploying alongside current solutions without the need to replace existing tools.
- Operates with initial performance impact: Provides endpoint protection without materially affecting endpoint performance, memory, or CPU utilization.
- Reduces SecOps overhead: Minimizes administrative burden by addressing threats earlier and rolling back attacks to a pre-attack state, saving security teams time on response and remediation.
SwarmView brings transparency to AI-driven security operations
Arctic Wolf also announced SwarmView, a new capability that brings experts directly to customers, providing visibility into how the Aurora Agentic SOC investigates, validates, and responds to modern threats.
SwarmView operates as a new capability in the Arctic Wolf Portal and allows customers to:
- Full investigation review: Follows investigations from the first signal to the final conclusion, showing which agents contributed, how they performed each step of the investigation, and how they validated each conclusion.
- Track the defense chain: Visibility into the events and actions taken at each stage helps customers understand the defense chain in one place.
- Grounded in unique customer context: Sees the customer context about the environment that was used in the decision-making process.
- Knows when human intervention occurred: sees where a decision was moved to a human expert and why that decision was made.
Arctic Wolf introduced the Swarm of Experts framework earlier this year, which combines a large team of specialized AI agents with experienced Arctic Wolf security analysis for rapid investigation and response while maintaining human oversight.
Shadow AI Discovery expands visibility into AI usage
The new Shadow AI Discovery feature uncovers and inventories sanctioned or unknown AI tools in use across an organization. It’ll be available soon to Aurora Managed Detection and Response (MDR) customers.
The feature is designed to identify AI tools in use across network, identity, and endpoint telemetry to create an inventory of AI activity, enable classification as sanctioned or unknown, and highlight potential data exposure risks without needing additional deployments.
Additionally, enhancements to the Aurora Security Assistant include new skills for access to insights across the Arctic Wolf portfolio. Customers will gain new information from Aurora Exposure Management. Aurora Threat Intelligence, and their security journeys to investigate faster and prioritize with context.
Arctic Wolf is also expanding the Aurora Superintelligence Platform with new integrations enabled by the platform’s Open Data Pipeline. The expanded integrations extend security coverage that includes:
- Web Application Firewalls (WAFs): New Cloudflare and Imperva integrations enable detection and active response for threats targeting web applications and services, helping customers respond faster to malicious activity.
- Backup and recovery: A new integration with Veeam will bring backup and recovery intelligence into the platform, extending visibility into backup infrastructure.
- Medical provider applications: New integrations with Epic Systems EHR, Claroty xDome Healthcare, and Imprivata ITDR.
- Additional integrations: ExtraHop Reveal(x) 360, Datadog, Proofpoint Essentials, 1Password, Google Workspace, Trend Vision One Endpoint Security, Palo Alto Cortex, and Claroty xDome Industrial.
Veeam integration connects backup and security intelligence
The integration of Veeam Data Platform events with the Arctic Wolf Aurora Superintelligence Platform and the Aurora Agentic SOC will allow organizations to extend visibility into critical backup infrastructure, reduce security blind spots, and improve detection, investigation, and responsiveness to cyber threats.
“Data and AI trust requires security and resilience to operate as one connected discipline,” said Michelle Graff, Senior Vice President for Global Partners and Channel at Veeam. “By bringing Veeam signals into Arctic Wolf’s security operations platform, we are giving organizations greater visibility into threats affecting their critical data and recovery environments.”
Graff adds: “This partnership helps customers strengthen the trusted, secure, and resilient data foundation they need to maintain business continuity and safely accelerate AI at scale.”
Existing Veeam Software customers using Arctic Wolf will see the partnership add managed security operations to a critical component of their resilience strategy.
“It’s really about being able to certify that these two solutions can share information, can alert one another around potential threats as well as what recovery actions to take. We want to reduce the time and improve the results,” said Dave Russell, SVP, Head of Strategy at Veeam.
What the new capabilities mean for MSPs and MSSPs
These latest innovations could give channel players more ways to expand security services around proactive threat prevention, AI governance, and transparent security operations.
The key opportunity is to help customers manage risk across a broader environment while making security outcomes easier to understand and deliver.
Aurora Adaptive Threat Protection creates opportunities to boost endpoint protection by disrupting and reversing attackers earlier without replacing existing EPP and EDR tools. MSPs and MSSPs could incorporate these capabilities into managed security offerings, while VARs could identify opportunities to complement customers’ existing security investments.
Shadow AI Discovery could also support new AI governance and security assessment services to help partners identify unauthorized AI tools, assess potential data exposure, and improve customers’ visibility into AI usage.
MSSPs could also utilize SwarmView’s investigation transparency to demonstrate how AI-driven security decisions are made and when human analysts intervene, while MSPs could improve customer reporting and security management.