Proofpoint Brings OpenAI GPT Cyber Models to Security Operations for Faster Threat Investigation
New Proofpoint SOC Analyst Agent combines Proofpoint security expertise with OpenAI Daybreak models to help analysts investigate threats, connect security signals and determine next steps through actionable findings
Proofpoint, Inc., a global leader in human and agent cybersecurity, today introduced the Proofpoint SOC Analyst Agent, an agentic AI capability built to help security teams investigate threats faster across Proofpoint security data. The first Proofpoint capability to emerge from the OpenAI Daybreak Defense Network, the SOC Analyst Agent brings OpenAI Daybreak models into Proofpoint investigation workflows to turn natural-language questions into structured, traceable findings and recommended next steps while keeping consequential security decisions in human hands.
Also Read: IT Tech Pulse Exclusive Interview with Ken Claffey Chief Executive Officer and President of VDURA
Security teams face a growing prioritization challenge as alerts and security data multiply across tools and workflows and increasingly turn to AI to manage the volume and complexity of security operations. According to Proofpoint’s 2025 Data Security Landscape report, more than half (54%) of organizations already use AI-enhanced capabilities to triage and investigate alerts. Yet, SOC teams still need to connect signals across security systems, establish context, and determine what deserves attention next. Proofpoint’s SOC Analyst Agent helps reduce the investigative burden and gives defenders a faster path from fragmented signals to informed action.
“The challenge for security teams is to cut through the noise to quickly identify which signals matter and reach a defensible decision fast enough to act,” said Daniel Rapp, Chief Data and AI Officer at Proofpoint. “The Proofpoint SOC Analyst Agent brings together our security expertise and data with advanced AI reasoning from OpenAI to give analysts a faster path from investigation to action, while keeping people in control of consequential security decisions.”
“Our goal through the OpenAI Daybreak Defense Network is to give defenders the advantage of frontier AI, safely,” said McCall McIntyre, Head of Global Cyber Partnerships, OpenAI. “Proofpoint’s SOC Analyst Agent shows how frontier AI can help defenders move faster without giving up control. By combining Proofpoint’s security data and human-behavior expertise with OpenAI’s Daybreak models, analysts can turn fragmented signals into clearer findings, faster investigations, and recommended next steps they can trust.”
The SOC Analyst Agent plans investigations and draws context from connected Proofpoint security data, including alerts, logs, data loss prevention events, and user risk signals. Instead of switching between consoles or writing individual queries, Proofpoint analysts use natural language to synthesize findings and resolve issues faster.
The agent is designed around three core capabilities:
- Accelerate investigations: Analysts can investigate security events using natural language across connected Proofpoint products, reducing the manual work required to assemble context.
- Automate recurring analysis: Teams can configure scheduled workflows for activities such as threat hunts, data security investigations, and escalation reporting, with results routed to the appropriate analysts.
- Keep analysts in control: Findings are traceable to underlying source data, allowing analysts to validate recommendations. The agent does not independently make account changes, contain threats, or initiate other consequential remediation actions.
The SOC Analyst Agent is the first capability Proofpoint is bringing to market through the Daybreak Defense Network, which it joined in June 2026 to apply OpenAI’s cyber-tuned models across its products, services, and workflows.
Proofpoint is also exploring how OpenAI Daybreak models can support additional defensive security workflows across its portfolio, including threat research, data security and AI security. Future work could include using AI reasoning to help threat researchers trace confirmed malicious findings across the network, strengthening detection coverage, and building a closed-loop approach to data and AI security that moves from detection to investigation to a recommended fix for human review.
The Proofpoint SOC Analyst Agent is currently in private preview with select beta customers. General availability is expected by the end of Q3 2026.
Write to us [wasim.a@demandmediaagency.com] to learn more about our exclusive editorial packages and programmes.
