
Attack Discovery now investigates and validates threats, turning a wall of raw alerts into a short list of real attacks and moving teams closer to Alert Zero, a state where the queue is worked down to the attacks that

Attack Discovery now investigates and validates threats, turning a wall of raw alerts into a short list of real attacks and moving teams closer to Alert Zero, a state where the queue is worked down to the attacks that really matter.


<a xmlns="http://www.w3.org/1999/xhtml" rel="nofollow" href="https://cts.businesswire.com/ct/CT?id=smartlink&amp;url=https%3A%2F%2Fwww.elastic.co%2F%3Futm_source%3Dpress-release%26utm_medium%3Dbusinesswire%26utm_campaign%3D2026-o11y-metrics-launch-pr&amp;esheet=54580906&amp;newsitemid=20260731122228&amp;lan=en-US&amp;anchor=Elastic&amp;index=1&amp;md5=8ace9c38bb86d175ce3d30123e9497c7" shape="rect">Elastic</a> (NYSE:<a class="ticker" href="https://www.benzinga.com/quote/ESTC">ESTC</a>), the Search AI Company, today announced major advances to its agentic security operations platform ahead of Black Hat USA 2026, led by a significantly expanded Attack Discovery, broader endpoint protection, and enhanced native workflow automation.


AI-driven attacks are making an already persistent SOC challenge even more urgent. Even well-equipped teams spend their shifts working through a queue of alerts that grows faster than they can clear it. Elastic&#39;s latest updates help organizations move toward Alert Zero, a state where agents and analysts work together to reduce the queue to only the attacks that actually matter, so analysts spend their time on the threats that deserve their judgment.


At the center of this announcement is a major advancement of Attack Discovery. Previously, it correlated alerts into a consolidated view of an attack. Now it goes further and acts as an autonomous triage agent, conducting its own investigation before flagging anything as an attack. It hunts raw events, checks entity risk scores, and corroborates evidence beyond the initial alerts. Analysts open a short list of validated threats instead of a wall of raw alerts. When Attack Discovery finds a gap in detection coverage, it drafts a new rule to close the gap and routes it to an analyst for approval. Alongside Attack Discovery, a companion alert analysis workflow runs in parallel, filtering likely false positives before they reach the investigation stage, with rationale analysts can review and tune.


&#34;Security teams are not losing because they lack tools; they&#39;re losing because the tools generate more work than the team can absorb,&#34; said Mike Nichols, general manager, Security, Elastic. &#34;Elastic Security is built by people who&#39;ve sat in the SOC and worked the queue. These updates go after one of the biggest sources of analyst burnout, which are alerts that shouldn&#39;t be alerts in the first place. Removing this overwhelming data barrier means teams can focus their attention where it’s needed most – real threats.&#34;


To enhance endpoint defenses, Elastic now automatically generates and instantly deploys YARA rules to protect against vulnerable driver exploits, a technique attackers use to reach the kernel via signed, trusted drivers with known flaws. This real-time functionality is critical, as AI-driven attacks can propagate across a network in under a minute. Windows on ARM devices, including Surface laptops, are now fully supported by Elastic Defend, bringing ARM-based endpoints into the same protection as the rest of a fleet at no per-device cost.


Elastic Workflows, the platform&#39;s native automation layer, also gains significant updates, including plain-language workflow generation, full version history with one-click rollback, a visual graph view, and human-in-the-loop approval routing to tools like Slack. Workflows runs natively within the Elasticsearch platform, extending across search, observability, and security. Automation runs where your security data already lives, rather than as a bolt-on integration.


The updates reinforce each other. Stronger prevention at the endpoint keeps alerts from being raised in the first place. The ones that remain arrive validated instead of raw. Automation keeps prevention and investigation moving at machine speed, while analysts stay on the decisions that need a human. The result is a SOC moving steadily closer to Alert Zero. That is what an agentic SOC looks like when it is built to help the people in it, rather than replace them.


Availability


Attack Discovery updates, alert analysis workflow enhancements, Elastic Defend vulnerable driver coverage, Windows on ARM support, and Elastic Workflows updates are available to Elastic Security customers. Elastic will be demonstrating all capabilities live at Black Hat USA 2026, booth # 3444, August 3-6, 2026, at the Mandalay Bay Convention Center, Las Vegas. Elastic is also a Blue Tier sponsor of Blue Team Village at DEFCON 33. For more information, visit <a xmlns="http://www.w3.org/1999/xhtml" rel="nofollow" href="https://cts.businesswire.com/ct/CT?id=smartlink&amp;url=http%3A%2F%2Felastic.co%2Fsecurity&amp;esheet=54580906&amp;newsitemid=20260731122228&amp;lan=en-US&amp;anchor=elastic.co%2Fsecurity&amp;index=2&amp;md5=814a12b54ec9ed29ed0b3702d4c30178" shape="rect">elastic.co/security</a>.


Where to find Elastic at Black Hat and DEF CON:

<ul xmlns="http://www.w3.org/1999/xhtml" class="bwlistdisc">
<li xmlns="http://www.w3.org/1999/xhtml">
Elastic will be at Black Hat USA 2026, booth # 3444, August 3-6, 2026 at the Mandalay Bay Convention Center, Las Vegas.

</li>
<li xmlns="http://www.w3.org/1999/xhtml">
Sober Speakeasy with Sober in Cyber
 Tuesday, August 4 &#x7C; 7:00–9:30 PM PT &#x7C; The Mob Museum Underground Speakeasy
 An alcohol-free networking evening for infosec professionals, sober or sober-curious. Open to all Black Hat attendees.

</li>
<li xmlns="http://www.w3.org/1999/xhtml">
Blitz &amp; Defend: An Executive Evening with Elastic and AWS
 Wednesday, August 5 &#x7C; 6:30–8:30 PM PT &#x7C; Allegiant Stadium
 A behind-the-scenes reception and tour of the Raiders locker room, hosted by Elastic and AWS for security and technology executives.

</li>
<li xmlns="http://www.w3.org/1999/xhtml">
GDIT Sip &amp; Cipher
 Wednesday, August 5 &#x7C; 6:00–9:00 PM PT &#x7C; Toca Madera
 A cybersecurity networking reception with Elastic among the sponsors.

</li>
<li xmlns="http://www.w3.org/1999/xhtml">
InnovatHERs: Women Shaping Tomorrow
 Thursday, August 6 &#x7C; 7:00–9:00 AM PT &#x7C; Hosted with WiCyS
 A breakfast to celebrate and connect women in cybersecurity, in partnership with Women in CyberSecurity.

</li>
<li xmlns="http://www.w3.org/1999/xhtml">
DEFCON: Blue Team Village
 Thursday–Sunday, August 6–9
 Security people go to Black Hat because they have to. They go to DEF CON because they want to. That&#39;s why Elastic is proud to be a Blue Tier sponsor of Blue Team Village and home to the SOC, DFIR, and incident response communities.

</li>
</ul>
Additional Materials

<ul xmlns="http://www.w3.org/1999/xhtml" class="bwlistdisc">
<li xmlns="http://www.w3.org/1999/xhtml">
Learn more in the blogs:
<ul xmlns="http://www.w3.org/1999/xhtml" class="bwlistcircle">
<li xmlns="http://www.w3.org/1999/xhtml">
<a xmlns="http://www.w3.org/1999/xhtml" rel="nofollow" href="https://cts.businesswire.com/ct/CT?id=smartlink&amp;url=https%3A%2F%2Fwww.elastic.co%2Fsecurity-labs%2Felastic-security-black-hat-defcon-2026&amp;esheet=54580906&amp;newsitemid=20260731122228&amp;lan=en-US&amp;anchor=Elastic+goes+all-in+on+Hacker+Summer+Camp+at+Black+Hat+and+DEF+CON+in+Las+Vegas&amp;index=3&amp;md5=380d8c1a94bc874ab4fc4bf4e13fe27a" shape="rect">Elastic goes all-in on Hacker Summer Camp at Black Hat and DEF CON in Las Vegas</a>

</li>
<li xmlns="http://www.w3.org/1999/xhtml">
<a xmlns="http://www.w3.org/1999/xhtml" rel="nofollow" href="https://cts.businesswire.com/ct/CT?id=smartlink&amp;url=https%3A%2F%2Fwww.elastic.co%2Fsecurity-labs%2Fagentic-soc-alert-triage-alertzero&amp;esheet=54580906&amp;newsitemid=20260731122228&amp;lan=en-US&amp;anchor=Alert+Zero%3A+AI-driven+alert+triage+and+attack+investigation+for+the+agentic+SOC&amp;index=4&amp;md5=e3c67bca925695e7eee84758e35cb33b" shape="rect">Alert Zero: AI-driven alert triage and attack investigation for the agentic SOC</a>

</li>
<li xmlns="http://www.w3.org/1999/xhtml">
<a xmlns="http://www.w3.org/1999/xhtml" rel="nofollow" href="https://cts.businesswire.com/ct/CT?id=smartlink&amp;url=https%3A%2F%2Fwww.elastic.co%2Fsecurity-labs%2Fvulnerable-driver-detection-elastic-defend-byovd&amp;esheet=54580906&amp;newsitemid=20260731122228&amp;lan=en-US&amp;anchor=What%27s+new+in+Elastic+Defend%3A+800%2B+vulnerable+driver+rules%2C+automated+troubleshooting%2C+and+ARM+support&amp;index=5&amp;md5=6dbd2657761136656b8ab1a765a80ba8" shape="rect">What&#39;s new in Elastic Defend: 800+ vulnerable driver rules, automated troubleshooting, and ARM support</a>

</li>
<li xmlns="http://www.w3.org/1999/xhtml">
<a xmlns="http://www.w3.org/1999/xhtml" rel="nofollow" href="https://cts.businesswire.com/ct/CT?id=smartlink&amp;url=https%3A%2F%2Fwww.elastic.co%2Fsearch-labs%2Fblog%2Fai-workflow-automation-natural-language&amp;esheet=54580906&amp;newsitemid=20260731122228&amp;lan=en-US&amp;anchor=One+prompt%2C+a+complete+workflow%3A+Elastic%27s+AI+agent+writes+your+automation+for+you&amp;index=6&amp;md5=6ffd946fe3f1ede9867166123f627ff2" shape="rect">One prompt, a complete workflow: Elastic&#39;s AI agent writes your automation for you</a>

</li>
</ul>

</li>
</ul>
About Elastic


Elastic (NYSE:<a class="ticker" href="https://www.benzinga.com/quote/ESTC">ESTC</a>), the Search AI Company, integrates its deep expertise in search technology with artificial intelligence to help everyone transform all of their data into answers, actions, and outcomes. The Elasticsearch Platform — the foundation for its search, observability, and security solutions — is used by thousands of companies, including more than 50% of the Fortune 500. Learn more at elastic.co.


Elastic and associated marks are trademarks or registered trademarks of elasticsearch B.V. and its subsidiaries. All other company and product names may be trademarks of their respective owners.

<img xmlns="http://www.w3.org/1999/xhtml" alt="" src="https://cts.businesswire.com/ct/CT?id=bwnews&amp;sty=20260731122228r1&amp;sid=benz2&amp;distro=nx&amp;lang=en" style="width:0;height:0"></img>View source version on businesswire.com: <a xmlns="http://www.w3.org/1999/xhtml" href="https://www.businesswire.com/news/home/20260731122228/en/" rel="nofollow">https://www.businesswire.com/news/home/20260731122228/en/</a>
Media Contact 
 Elastic PR
 <a xmlns="http://www.w3.org/1999/xhtml" rel="nofollow" href="mailto:PR-team@elastic.co" shape="rect">PR-team@elastic.co</a>

ESTC

Elastic Advances the Agentic SOC, Bringing Security Teams Closer to Alert Zero

Elastic expands Attack Discovery and ARM support ahead of Black Hat 2026

<section class="insight" data-version="1">
 <section data-block="information">
 <h3>Information</h3>
 Attack Discovery now investigates and validates threats, turning a wall of raw alerts into a short list of real attacks and moving teams closer to Alert Zero, a state where the queue is worked down to the attacks that
 </section>

 <section data-block="ai-summary-paragraph">
 <h3>AI Summary</h3>
 Elastic unveiled updates to its agentic security platform ahead of Black Hat USA 2026, including autonomous Attack Discovery triage, expanded endpoint protection with ARM support, and enhanced native workflow automation. The changes move SOCs toward Alert Zero and could boost Elastic Security ARR, though no revenue figures were disclosed.
 </section>

 <section data-block="ai-summary-bullets">
 <h3>Key Points</h3>
 <ul><li>Attack Discovery becomes autonomous triage, shrinking alert queues. Advances toward Alert Zero.</li><li>Endpoint defenses gain instant YARA rules for driver exploits. Windows on ARM now supported.</li><li>Elastic Workflows enables plain-language automation and version history. Rollbacks with one-click.</li><li>Automation runs where data already lives, not bolt-on. Integrates across search, observability, security.</li><li>Black Hat 2026 demo boosts product visibility. Booth 3444; Aug 3–6.</li></ul>
 </section>

 <section data-block="companies-mentioned">
 <h3>Companies Mentioned</h3>
 <ul><li>Elastic (ESTC): Announces major Security updates; potential impact on ARR and retention.</li><li>Amazon.com, Inc. (AMZN): AWS sponsorship of Black Hat activities; potential ecosystem link.</li><li>Microsoft Corporation (MSFT): Windows on ARM support implies deeper Windows ecosystem alignment.</li></ul>
 </section>

 <section data-block="category">
 <h3>Industry News</h3>
 Industry News: reflects significant product upgrades in Elastic&#039;s security platform and event-driven marketing ahead of Black Hat.
 </section>

 <section data-block="market-moving">
 <h3>Market-Moving</h3>
 <ul><li>Product upgrades ahead of Black Hat may lift Elastic Security bookings.</li><li>ARM/Windows on ARM expansion broadens endpoint market reach.</li><li>No explicit revenue guidance; near-term earnings impact unlikely.</li><li>High-profile event presence for Elastic could spark sentiment upside.</li></ul>
 </section>

 <section data-block="key-facts">
 <h3>Key Facts</h3>
 <ul><li>Attack Discovery updates enable autonomous triage and gap-closing rules.</li><li>Companion alert analysis workflow filters false positives before investigation.</li><li>Elastic Defend adds 800+ vulnerable-driver rules and ARM/Windows support.</li><li>Windows on ARM devices, including Surface laptops, are now supported.</li><li>Availability to Elastic Security customers; Black Hat USA 2026 Aug 3–6; booth 3444.</li></ul>
 </section>

 <section data-block="trading-thesis">
 <h3>Trading Thesis</h3>
 Bullish over the next 1–2 quarters as security platform upgrades broaden addressable market.
 </section>
</section>



Attack Discovery now investigates and validates threats, turning a wall of raw alerts into a short list of real attacks and moving teams closer to Alert Zero, a state where the queue is worked down to the attacks that really matter.


<a xmlns="http://www.w3.org/1999/xhtml" rel="nofollow" href="https://cts.businesswire.com/ct/CT?id=smartlink&amp;url=https%3A%2F%2Fwww.elastic.co%2F%3Futm_source%3Dpress-release%26utm_medium%3Dbusinesswire%26utm_campaign%3D2026-o11y-metrics-launch-pr&amp;esheet=54580906&amp;newsitemid=20260731122228&amp;lan=en-US&amp;anchor=Elastic&amp;index=1&amp;md5=8ace9c38bb86d175ce3d30123e9497c7" shape="rect">Elastic</a> (NYSE:<a class="ticker" href="https://www.benzinga.com/quote/ESTC">ESTC</a>), the Search AI Company, today announced major advances to its agentic security operations platform ahead of Black Hat USA 2026, led by a significantly expanded Attack Discovery, broader endpoint protection, and enhanced native workflow automation.


AI-driven attacks are making an already persistent SOC challenge even more urgent. Even well-equipped teams spend their shifts working through a queue of alerts that grows faster than they can clear it. Elastic&#39;s latest updates help organizations move toward Alert Zero, a state where agents and analysts work together to reduce the queue to only the attacks that actually matter, so analysts spend their time on the threats that deserve their judgment.


At the center of this announcement is a major advancement of Attack Discovery. Previously, it correlated alerts into a consolidated view of an attack. Now it goes further and acts as an autonomous triage agent, conducting its own investigation before flagging anything as an attack. It hunts raw events, checks entity risk scores, and corroborates evidence beyond the initial alerts. Analysts open a short list of validated threats instead of a wall of raw alerts. When Attack Discovery finds a gap in detection coverage, it drafts a new rule to close the gap and routes it to an analyst for approval. Alongside Attack Discovery, a companion alert analysis workflow runs in parallel, filtering likely false positives before they reach the investigation stage, with rationale analysts can review and tune.


&#34;Security teams are not losing because they lack tools; they&#39;re losing because the tools generate more work than the team can absorb,&#34; said Mike Nichols, general manager, Security, Elastic. &#34;Elastic Security is built by people who&#39;ve sat in the SOC and worked the queue. These updates go after one of the biggest sources of analyst burnout, which are alerts that shouldn&#39;t be alerts in the first place. Removing this overwhelming data barrier means teams can focus their attention where it’s needed most – real threats.&#34;


To enhance endpoint defenses, Elastic now automatically generates and instantly deploys YARA rules to protect against vulnerable driver exploits, a technique attackers use to reach the kernel via signed, trusted drivers with known flaws. This real-time functionality is critical, as AI-driven attacks can propagate across a network in under a minute. Windows on ARM devices, including Surface laptops, are now fully supported by Elastic Defend, bringing ARM-based endpoints into the same protection as the rest of a fleet at no per-device cost.


Elastic Workflows, the platform&#39;s native automation layer, also gains significant updates, including plain-language workflow generation, full version history with one-click rollback, a visual graph view, and human-in-the-loop approval routing to tools like Slack. Workflows runs natively within the Elasticsearch platform, extending across search, observability, and security. Automation runs where your security data already lives, rather than as a bolt-on integration.


The updates reinforce each other. Stronger prevention at the endpoint keeps alerts from being raised in the first place. The ones that remain arrive validated instead of raw. Automation keeps prevention and investigation moving at machine speed, while analysts stay on the decisions that need a human. The result is a SOC moving steadily closer to Alert Zero. That is what an agentic SOC looks like when it is built to help the people in it, rather than replace them.


Availability


Attack Discovery updates, alert analysis workflow enhancements, Elastic Defend vulnerable driver coverage, Windows on ARM support, and Elastic Workflows updates are available to Elastic Security customers. Elastic will be demonstrating all capabilities live at Black Hat USA 2026, booth # 3444, August 3-6, 2026, at the Mandalay Bay Convention Center, Las Vegas. Elastic is also a Blue Tier sponsor of Blue Team Village at DEFCON 33. For more information, visit <a xmlns="http://www.w3.org/1999/xhtml" rel="nofollow" href="https://cts.businesswire.com/ct/CT?id=smartlink&amp;url=http%3A%2F%2Felastic.co%2Fsecurity&amp;esheet=54580906&amp;newsitemid=20260731122228&amp;lan=en-US&amp;anchor=elastic.co%2Fsecurity&amp;index=2&amp;md5=814a12b54ec9ed29ed0b3702d4c30178" shape="rect">elastic.co/security</a>.


Where to find Elastic at Black Hat and DEF CON:

<ul xmlns="http://www.w3.org/1999/xhtml" class="bwlistdisc">
<li xmlns="http://www.w3.org/1999/xhtml">
Elastic will be at Black Hat USA 2026, booth # 3444, August 3-6, 2026 at the Mandalay Bay Convention Center, Las Vegas.

</li>
<li xmlns="http://www.w3.org/1999/xhtml">
Sober Speakeasy with Sober in Cyber
 Tuesday, August 4 &#x7C; 7:00–9:30 PM PT &#x7C; The Mob Museum Underground Speakeasy
 An alcohol-free networking evening for infosec professionals, sober or sober-curious. Open to all Black Hat attendees.

</li>
<li xmlns="http://www.w3.org/1999/xhtml">
Blitz &amp; Defend: An Executive Evening with Elastic and AWS
 Wednesday, August 5 &#x7C; 6:30–8:30 PM PT &#x7C; Allegiant Stadium
 A behind-the-scenes reception and tour of the Raiders locker room, hosted by Elastic and AWS for security and technology executives.

</li>
<li xmlns="http://www.w3.org/1999/xhtml">
GDIT Sip &amp; Cipher
 Wednesday, August 5 &#x7C; 6:00–9:00 PM PT &#x7C; Toca Madera
 A cybersecurity networking reception with Elastic among the sponsors.

</li>
<li xmlns="http://www.w3.org/1999/xhtml">
InnovatHERs: Women Shaping Tomorrow
 Thursday, August 6 &#x7C; 7:00–9:00 AM PT &#x7C; Hosted with WiCyS
 A breakfast to celebrate and connect women in cybersecurity, in partnership with Women in CyberSecurity.

</li>
<li xmlns="http://www.w3.org/1999/xhtml">
DEFCON: Blue Team Village
 Thursday–Sunday, August 6–9
 Security people go to Black Hat because they have to. They go to DEF CON because they want to. That&#39;s why Elastic is proud to be a Blue Tier sponsor of Blue Team Village and home to the SOC, DFIR, and incident response communities.

</li>
</ul>
Additional Materials

<ul xmlns="http://www.w3.org/1999/xhtml" class="bwlistdisc">
<li xmlns="http://www.w3.org/1999/xhtml">
Learn more in the blogs:
<ul xmlns="http://www.w3.org/1999/xhtml" class="bwlistcircle">
<li xmlns="http://www.w3.org/1999/xhtml">
<a xmlns="http://www.w3.org/1999/xhtml" rel="nofollow" href="https://cts.businesswire.com/ct/CT?id=smartlink&amp;url=https%3A%2F%2Fwww.elastic.co%2Fsecurity-labs%2Felastic-security-black-hat-defcon-2026&amp;esheet=54580906&amp;newsitemid=20260731122228&amp;lan=en-US&amp;anchor=Elastic+goes+all-in+on+Hacker+Summer+Camp+at+Black+Hat+and+DEF+CON+in+Las+Vegas&amp;index=3&amp;md5=380d8c1a94bc874ab4fc4bf4e13fe27a" shape="rect">Elastic goes all-in on Hacker Summer Camp at Black Hat and DEF CON in Las Vegas</a>

</li>
<li xmlns="http://www.w3.org/1999/xhtml">
<a xmlns="http://www.w3.org/1999/xhtml" rel="nofollow" href="https://cts.businesswire.com/ct/CT?id=smartlink&amp;url=https%3A%2F%2Fwww.elastic.co%2Fsecurity-labs%2Fagentic-soc-alert-triage-alertzero&amp;esheet=54580906&amp;newsitemid=20260731122228&amp;lan=en-US&amp;anchor=Alert+Zero%3A+AI-driven+alert+triage+and+attack+investigation+for+the+agentic+SOC&amp;index=4&amp;md5=e3c67bca925695e7eee84758e35cb33b" shape="rect">Alert Zero: AI-driven alert triage and attack investigation for the agentic SOC</a>

</li>
<li xmlns="http://www.w3.org/1999/xhtml">
<a xmlns="http://www.w3.org/1999/xhtml" rel="nofollow" href="https://cts.businesswire.com/ct/CT?id=smartlink&amp;url=https%3A%2F%2Fwww.elastic.co%2Fsecurity-labs%2Fvulnerable-driver-detection-elastic-defend-byovd&amp;esheet=54580906&amp;newsitemid=20260731122228&amp;lan=en-US&amp;anchor=What%27s+new+in+Elastic+Defend%3A+800%2B+vulnerable+driver+rules%2C+automated+troubleshooting%2C+and+ARM+support&amp;index=5&amp;md5=6dbd2657761136656b8ab1a765a80ba8" shape="rect">What&#39;s new in Elastic Defend: 800+ vulnerable driver rules, automated troubleshooting, and ARM support</a>

</li>
<li xmlns="http://www.w3.org/1999/xhtml">
<a xmlns="http://www.w3.org/1999/xhtml" rel="nofollow" href="https://cts.businesswire.com/ct/CT?id=smartlink&amp;url=https%3A%2F%2Fwww.elastic.co%2Fsearch-labs%2Fblog%2Fai-workflow-automation-natural-language&amp;esheet=54580906&amp;newsitemid=20260731122228&amp;lan=en-US&amp;anchor=One+prompt%2C+a+complete+workflow%3A+Elastic%27s+AI+agent+writes+your+automation+for+you&amp;index=6&amp;md5=6ffd946fe3f1ede9867166123f627ff2" shape="rect">One prompt, a complete workflow: Elastic&#39;s AI agent writes your automation for you</a>

</li>
</ul>

</li>
</ul>
About Elastic


Elastic (NYSE:<a class="ticker" href="https://www.benzinga.com/quote/ESTC">ESTC</a>), the Search AI Company, integrates its deep expertise in search technology with artificial intelligence to help everyone transform all of their data into answers, actions, and outcomes. The Elasticsearch Platform — the foundation for its search, observability, and security solutions — is used by thousands of companies, including more than 50% of the Fortune 500. Learn more at elastic.co.


Elastic and associated marks are trademarks or registered trademarks of elasticsearch B.V. and its subsidiaries. All other company and product names may be trademarks of their respective owners.

<img xmlns="http://www.w3.org/1999/xhtml" alt="" src="https://cts.businesswire.com/ct/CT?id=bwnews&amp;sty=20260731122228r1&amp;sid=benz2&amp;distro=nx&amp;lang=en" style="width:0;height:0"></img>View source version on businesswire.com: <a xmlns="http://www.w3.org/1999/xhtml" href="https://www.businesswire.com/news/home/20260731122228/en/" rel="nofollow">https://www.businesswire.com/news/home/20260731122228/en/</a>
Media Contact 
 Elastic PR
 <a xmlns="http://www.w3.org/1999/xhtml" rel="nofollow" href="mailto:PR-team@elastic.co" shape="rect">PR-team@elastic.co</a>

Elastic unveiled updates to its agentic security platform ahead of Black Hat USA 2026, including autonomous Attack Discovery triage, expanded endpoint protection with ARM support, and enhanced native workflow automation. The changes move SOCs toward Alert Zero and could boost Elastic Security ARR, though no revenue figures were disclosed.

News insight

Elastic Advances the Agentic SOC, Bringing Security Teams Closer to Alert Zero

AI summary

Sentiment rationale

Key facts

Industry News