Proofpoint launches SOC Analyst agent in private preview, powered by OpenAI's Daybreak models

Proofpoint has unveiled the SOC Analyst Agent, an agentic artificial intelligence assistant designed to transform how security teams get from a raw alert to a defensible decision. The product grew out of an internal problem: Proofpoint's own Applied Services team, responsible for investigating and responding to incidents for the company's customers, needed a faster way to move between alerts scattered across multiple consoles without having to write a different query for each product. That same team built the tool to solve its own bottleneck, and Proofpoint is now offering it directly to its customers.

The company's underlying argument is that security teams do not have a data problem but a prioritization problem: alerts arrive faster than any human team can review them, and they are spread across a growing number of products, each with its own console and its own version of the truth. Proofpoint backs this up by citing its own '2026 AI and Human Risk Landscape Report', according to which nearly nine out of ten organizations worldwide have already taken AI assistants beyond the pilot stage, adding new surfaces that security teams must monitor just as analyst capacity has failed to grow at the same pace.

As for how it works, the approach is natural language: an analyst asks a question or describes a task with no need for query languages or jumping between consoles. The agent plans the investigation, pulls context from the connected security data sources within Proofpoint's platform — alerts, logs, data loss prevention (DLP) events and user risk signals — and returns a structured finding along with a recommended next step. In addition, any team member can create custom workflows that run on a schedule, for example for data security or abuse mailbox analysis, with automatic routing and notification to the relevant analysts.

The distinguishing element highlighted in the announcement is the incorporation of OpenAI's Daybreak models through what the company calls the 'Daybreak Defense Network', combining Proofpoint's security operations expertise and data with OpenAI's cyber reasoning capabilities geared toward authorized defensive work. Proofpoint justifies using a specialized model rather than a general-purpose one by arguing that the hard part of an investigation is not reading the data but inferring what an actor was trying to achieve and what they would do next: how a lure is crafted so that it works on the victim, how data is moved out of an environment without tripping a policy, or how a series of seemingly harmless actions ends up revealing malicious intent. According to the company, general-purpose models tend to avoid precisely that kind of reasoning about offensive techniques, whereas the Daybreak models are designed to support this type of authorized defensive analysis, helping to move from 'these alerts fired' to 'this is what the activity means and this is what to review next'.

That same ability to reason about how an attacker operates is, according to Proofpoint, why the agent's limits on action matter so much: it is given latitude to reason about how an attack works, but no latitude to act. The company insists this is a recommendation system, not a replacement for the human analyst. Every finding comes with a suggested next step, but the agent does not carry it out itself: any action beyond generating a finding or a report — account changes, containment or other remediation measures — is left to a human reviewer, in line with how the Applied Services team already operates today. The stated goal is to free up time from the manual work of gathering data across dashboards, so analysts spend more time on judgment and decision-making, always keeping a human in the loop.

Day to day, Proofpoint describes three use scenarios: for analysts, the console does not change but the workflow does, since they can ask in natural language and receive a finding with context already integrated from all connected products; for CISOs and team leads, information can arrive on a schedule — overnight threat hunts, daily escalation summaries — without depending on someone remembering to request a report; and for every investigation, traceability is guaranteed, since any finding can be audited back to the source data, so a recommendation can always be verified rather than simply trusted blindly.

On availability, the SOC Analyst Agent is currently in private preview with a growing number of beta customers, and Proofpoint puts general availability at the end of the third quarter of 2026, with the usual caveat that the timeline is subject to standard product release considerations. The company clarifies in its own FAQ that this is a Proofpoint product — not an OpenAI one: the Daybreak models supply part of the reasoning capability through the Daybreak Defense Network, but the product, the data connections, the workflows and the control policies remain Proofpoint's, and the company stresses that the actions the agent is permitted to take are limited by its own policies regardless of which model is doing the reasoning at any given moment. In this first phase, the private preview and beta are focused on data security — email DLP, insider threat management and cloud DLP — and the company says support for other products on its platform will arrive in the following quarter. Anyone wanting to see it in action should contact their Proofpoint Applied Services team.