Elastic becomes the corporate memory of OpenAI's agents: fewer tokens, more accuracy

By Zendoric · July 31, 2026.

Elastic and OpenAI have expanded their alliance so that Elasticsearch — Elastic's search and data analytics engine — acts as a context layer for OpenAI's models. The idea, according to both companies, is to let enterprises build production-ready AI agents, not just demos, on three fronts: agents aware of the company's context, agentic observability, and agent-run security operations.

The division of labor is clear: OpenAI provides the reasoning — the models that decide what to do — while Elastic provides information retrieval, access governance and the operational data layer. It is the division of labor taking hold across the industry: the model is no longer the only bottleneck; so is orderly, secure, up-to-date access to a company's real knowledge.

That knowledge lives mostly in unstructured data: internal documents, support tickets, system logs, metrics and security alerts. Elastic combines lexical search (by keyword) and vector search (by meaning), semantic reranking, filters and access control in a single platform, so that an agent only "sees" what the user invoking it would have permission to see. In its internal tests, Elastic says it reached a recall (the share of relevant results the system manages to retrieve) of 0.89 while maintaining that per-user data protection.

The most striking figure is technical: in an experiment on the BrowseComp-Plus dataset (used to measure information retrieval systems), so-called Knowledge Indicators — a feature Elastic expects to bring to general availability soon — cut input token usage by up to 75% (tokens being the units of text a model processes, which determine much of the cost of each query) compared with a standard RAG system. RAG, or retrieval-augmented generation, is the technique that lets a model consult an external database before answering, instead of relying solely on what it learned in training. According to Elastic, accuracy rose from 60% to 92% in that same experiment. If those numbers hold up outside the lab, we are talking about agents that are considerably cheaper to run and more reliable at the same time — the combination that usually decides whether an enterprise AI pilot makes it to production or stays on a slide.

The other leg of the announcement is security. Within Elastic Security, the Attack Discovery feature uses OpenAI models to correlate isolated alerts into coherent attack chains, mapped against MITRE ATT&CK (the industry's reference catalog of cyberattack tactics and techniques). According to data provided by Elastic itself, Visa cut detection triage time on mainframe systems from 10 to 20 minutes down to just seconds, and Airtel reports triage up to 40% faster. Elastic is also taking part in OpenAI's Daybreak Cyber Partner program to integrate the GPT-5.5 Cyber models, designed specifically for cybersecurity tasks.

Broadly speaking, this move fits something we have been observing for months: competition in enterprise AI has shifted from the model to the infrastructure around it. We already saw it with Google's and Microsoft's push into agent distribution and standards: ground is gained by whoever controls the "plumbing" — where the data lives, who can touch it, how it is audited — and not only by whoever has the smartest model. Elastic is positioning itself there, as a memory and governance layer for other companies' agents, rather than competing head-on to build the model.

Our reading: for security and support teams this is good news, with caveats. In the short term, automating first-level alert triage — the most repetitive task in a security operations center — reduces the need for large teams dedicated to watching dashboards and dismissing false positives. That is real job destruction at that specific rung, and it is worth saying plainly. But it also frees analysts for the work that demands judgment: reconstructing the full attack chain, deciding the response, talking to the business. It is the same pattern we have been documenting sector by sector: administrative and repetitive work is automated first; expert judgment gains value afterward. In the long run, a world where cybersecurity and technical support no longer depend on armies of people manually reviewing alerts is a world with more human capacity available for problems that genuinely matter. The condition for that transition to be reasonable is that the hours saved translate into reskilling, not just headcount cuts.