Security operations teams have a volume problem that hiring cannot solve. Alert queues grow faster than headcount, and the work that suffers first is the part that matters most: the patient, complete investigation of the alert that turns out to be real. On November 6, 2026, London-based managed security provider Wizard Cyber launched CYBERSHIELD AI, an agentic AI platform for security operations built on a different premise — that the bottleneck is not triage speed but investigative depth, and that depth is exactly what an agent can be made to do consistently.
The platform is live now for customers of Wizard Cyber’s managed security services, offered in three packages — Core, Complete and Command. It is the latest entry in a fast-moving race to put AI agents inside the security operations centre, and its design choices — a hard completeness gate, decisions made by policy rather than by the model, and a senior analyst’s sign-off as the default — say a lot about where the agentic SOC is heading.
The SOC’s Real Problem Is Investigation, Not Triage Speed
Most security automation to date has attacked the queue by closing things faster. More alerts triaged per hour, more false positives filtered, shorter mean time to close. CYBERSHIELD AI was built on the argument that this optimises the wrong thing. Closing an alert quickly is easy; reaching a defensible answer about whether it is real, what its scope is, and what should happen next is the hard part — and it is the part that breaks first when analysts are drowning in volume.
Wizard Cyber’s answer is to hand the investigation itself to agents. Rather than a single model answering a single prompt, CYBERSHIELD AI runs a roster of agent roles spanning five SOC functions, drawing on more than 250 named analyst skills and over 300 AI tools. Each agent holds a defined role and a defined set of capabilities, and work is distributed across them the way it would be across a staffed shift.
The roster is organised the way a real SOC is staffed. A SOC Manager Agent acts as the orchestration core, tasking the right agent at the right moment and enforcing the platform’s completeness gate. A Blue Squad handles defence — triage, investigation, response, reporting and stakeholder communications. A Red Squad thinks like the attacker, tracking threat actors, mapping adversary tactics to the customer’s environment and hunting for what never raised an alert. A Green Squad covers engineering and assurance: tuning noisy detection rules, tracking coverage against the MITRE ATT&CK framework, and correlating vulnerability data with real exposure.
How CYBERSHIELD AI Investigates: Agents, Skills, and the Completeness Gate
Every alert enters the same multi-stage investigation pipeline. Agents enrich it with user, device and asset context, filter false positives, correlate logs, endpoint, identity and cloud telemetry into a single timeline, and determine scope, root cause and impact. Where the evidence does not settle the question, the case moves to an Advanced Investigation, where agents form hypotheses and test them against the estate.
The pipeline’s defining feature is its completeness gate: a checkpoint that will not allow an investigation to reach a verdict on partial evidence. Where the evidence is not there, the investigation continues or escalates; it does not close early to keep the queue moving. Related incidents are grouped into a case, and a case can be marked as a campaign where the pattern warrants it, so connected activity is investigated as one story rather than a series of unrelated alerts.
Every investigation produces a full report, an escalation write-up where the case is escalated, a closing statement and a drafted email — so the reasoning behind a verdict is written down and reviewable, not locked inside the system that produced it. Each customer environment is isolated, with no cross-customer learning: nothing observed in one tenant informs the handling of another.
The Decision Stays With Policy — and With People
The most consequential design choice in CYBERSHIELD AI is who — or what — decides. The close-or-escalate decision is made by policy and by customer decision templates, not by the model. Autonomy is configurable per agent and per tenant, so each customer sets how much the platform does on its own and where a human takes over. On the managed service, senior analyst sign-off is the default.
Customers choose between three autonomy settings: fully autonomous operation inside limits they set, human approval at any stage they nominate, or autonomous operation above a confidence threshold they define — with work below that bar routed to an analyst. Guardrails and confidence scoring sit underneath all three.
“The thing we kept coming back to is that speed is not the hard part. Getting to a defensible answer is the hard part, and doing it the same way at three in the morning as at three in the afternoon is harder still,” said Adam Jones, CTO and co-founder of Wizard Cyber and the principal designer and architect of CYBERSHIELD AI. “So we built the platform around the investigation rather than around the queue. The agents do the work. The completeness gate stops an investigation closing before it should. And the decision to close or escalate is made by policy and by the customer’s own decision templates — not by the model, and not by a confidence score nobody outside the building can interrogate. A senior analyst signs it off. That accountability is the product, as much as the automation is.”
Paul Goldney, CEO of Wizard Cyber, called the launch “a fantastic milestone” and thanked customers who adopted the platform early and are working with the company as it continues to develop it.
Speed, Measured: 3 Minutes 30 Seconds to a Verdict
Wizard Cyber publishes its numbers plainly: across the platform, the average time to verdict is 3 minutes 30 seconds, and 7 minutes 50 seconds where an incident needs Advanced Investigation. Both clocks start at the same point — the moment a signal reaches CYBERSHIELD AI — and both are measured across the company’s own SOC. Those are investigation times that would be difficult to sustain by hand at volume, arrived at through the same pipeline every time.
The figures matter because they reframe what speed means in a SOC. The platform is not claiming to close alerts faster; it is claiming to complete investigations faster, with the evidence attached. A verdict in three and a half minutes is only useful if the verdict can be defended, which is why the completeness gate and the written report sit at the centre of the design rather than at its edges.
Two Ways to Buy It: Platform or Managed Service
CYBERSHIELD AI is available in two delivery models built on the same agents. Organisations that already run a SOC can take the platform in their own single-tenant instance — hosted by Wizard Cyber or self-hosted in their own Azure, in any Azure region — with their analysts staying on the work that needs judgement while agents carry triage and investigation. Organisations that need a SOC can take the managed AI SOC service, run by Wizard Cyber’s 24/7 staffed SOC with named senior analysts owning the outcome.
Either way, Microsoft Sentinel is the only hard requirement. Wizard Cyber builds the tooling to fit the rest of the estate as part of the managed service, and the platform works across identity, endpoint, email, cloud and network tools — including Microsoft Defender XDR, Microsoft Entra, CrowdStrike, Okta, Proofpoint, AWS, Google Cloud, Palo Alto Networks, Mimecast, SentinelOne and Cloudflare — rather than requiring customers to standardise their environment first.
The demo is a working investigation shown end to end by an analyst, not a slide deck: a real adversary-in-the-middle case, replayed — investigated, scoped and contained — holding for human approval before anything executes.
What This Launch Says About the Agentic SOC in 2026
CYBERSHIELD AI arrives in a year when AI agents have moved from demos into the daily machinery of security work. The launch is notable less for any single capability than for the philosophy it encodes: agents do the work, policy makes the decision, and a named human signs it off. That is a deliberate answer to the trust problem that has slowed agentic security tools — not more autonomy, but autonomy with receipts.
Wizard Cyber is a managed security services provider that has been running Microsoft Sentinel since 2019 and is a Microsoft Solutions Partner for Security. The company operates multiple security operations centres, each staffed 24/7 in its own right, with senior analysts, incident responders, L3 analysts and AI developers on shift around the clock, and has a presence in the United Kingdom, the United States, Pakistan and Kuwait, including an office in the Microsoft Digital Innovation Centre in Kuwait. Wizard Cyber Security Ltd is certified to ISO 27001 and ISO 9001.
Whether the agentic SOC becomes the default will depend on whether platforms like this one can sustain their verdict times without quietly lowering the bar on evidence. CYBERSHIELD AI’s completeness gate is its bet that they can — and that the SOC of the near future is judged not by how fast it closes alerts, but by how reliably it reaches answers a human is willing to sign.
Related Reading and Sources
- Fortinet’s FortiAIGate secures distributed AI hubs with Equinix — read our coverage of Fortinet’s AI security gateway: https://inspireviraltimes.com/fortinet-fortiaigate-equinix-distributed-ai-hub-secure-ai/
- OpenAI’s GPT-6 Cyber finds hundreds of Linux kernel exploits — see how AI is changing offensive security research: https://inspireviraltimes.com/openai-gpt-6-cyber-ai-security-model-linux-exploits/
- Sophos Firewall v23 brings AI-era network protection — our look at Sophos’s latest firewall release: https://inspireviraltimes.com/sophos-firewall-v23-xgs-ai-era-network/
- Tencent’s Hy4 open-source AI model takes on defensive cybersecurity: https://inspireviraltimes.com/tencent-hy4-open-source-ai-defensive-cybersecurity/
- Wizard Cyber’s official CYBERSHIELD AI launch announcement: https://kingnewswire.com/wizard-cyber-launches-cybershield-ai-an-agentic-ai-soc-platf-26110650505/
- CYBERSHIELD AI product page on Wizard Cyber’s website: https://wizardcyber.com/
- Microsoft Learn: What is Microsoft Sentinel SIEM?: https://learn.microsoft.com/en-us/azure/sentinel/overview
