Tanium, the Autonomous IT company, is relaunching Tanium Security Operations for a new kind of attacker, AI that enables adversaries to move like trusted administrators using the tools already on every machine, blending into normal activity, and spreading across thousands of endpoints at a speed and scale no analyst can match.
Tanium Security Operations detects that behavior at the endpoint level, responds at the scale of the threat, and puts expert-level hunting in the hands of every analyst, according to the company.
"AI has changed who the attacker is and how fast they move. The next breach won't look like malware. It will look like one of your own administrators," said Harman Kaur, chief technology officer at Tanium. "We have spent years learning what normal looks like on every endpoint our customers run. Now we use that to catch what doesn't belong and stop it everywhere at once. That is what security operations has to become in the AI era."
Tanium Security Operations runs on the same platform and real-time data IT teams already use to manage every endpoint. With the relaunch, detection, response, and hunting are no longer separate steps handed from tool to tool. They run as one continuous loop.
“The AI-fueled threat landscape has changed the dynamics of security operations,” said Dave Gruber, chief analyst at Omdia. “Speed is more important than ever before, as attack execution speeds out pace current security operations mechanisms and processes. Agentic capabilities can speed detection and response, but without access to near real-time telemetry and response, agentic SOC capabilities still lag attacker activities. Tanium's approach of grounding detection and hunting in real-time endpoint state addresses one of the most persistent gaps in enterprise SOC architectures.”
For organizations that want experts on their side, Tanium HuntIQ pairs Tanium threat hunters with the same platform and AI.
HuntIQ hunters work directly in customer environments to find threats, strengthen detections, and support incident response, and can build a hunt before a patch or CVE exists, as they did for the FalconFlank zero-day. What they learn feeds back into the platform, so every hunt that follows starts smarter, the vendor said.
For more information about this news, visit www.tanium.com.