Netskope One AgentSkope uses AI agents to automate alert triage, streamline SOC and NOC workflows, and reduce SIEM data ingestion costs.
Netskope this week introduced an AI-driven platform layer to ease the operational burden on security and network operations, as enterprises struggle to manage alert volumes and infrastructure complexity.
Netskope One AgentSkope is an agentic AI framework designed to automate security and network operations workflows within Netskope’s SASE platform. The platform can automate tasks such as alert triage and investigation, and policy management, according to Netskope, which reports that 40% of alerts go uninvestigated in security operations centers (SOC) and network operations centers (NOC) due to a lack of resources.
“We built AgentSkope to act as an autonomous force multiplier, providing a shared architectural foundation that allows organizations to easily deploy AI agents capable of executing end-to-end workflows,” Sanjay Beri, co-founder and CEO at Netskope, in a statement. “By abstracting away operational complexity and removing internal development bottlenecks, we are empowering security and network leaders to drastically reduce manual troubleshooting, free up their skilled staff for strategic initiatives, and adapt their defenses at the speed of business.”
AgentSkope embeds AI agents directly into Netskope One’s data layer, enabling them to analyze and act on information without exporting data to external systems, according to Netskope.
“In the face of a rapidly expanding, AI-fueled threat landscape, CIOs and CISOs must invest in agentic security automation as a force multiplier to enhance skilled human resources.” Pete Finalle, research manager, security and trust at IDC, said in a statement. “The ability to intelligently triage threats, help manage the increasing scope and scale of modern threats, and keep up with new AI models/agents can no longer remain a manual process.”
AgentSkope is integrated into the Netskope One platform, and the company says the design allows customers to configure agents within a single interface and ensures they can access all relevant data sources without additional integrations.
“Netskope AI agents are specifically designed with platform workflows in mind and deeply embedded within the architecture,” said Rich Davis, director of product and solutions marketing at Netskope, in an interview with Network World. Running agents directly on data sources reduces the need to move large volumes of data to other systems, he added. “Agents can handle the repetitive triage and investigation work so human analysts can focus on higher-value decisions.”
The new agents use natural language interfaces and are designed to execute multi-step workflows, from investigation through remediation recommendations, according to Netskope. With this release, Netskope is launching six agents:
- DLP AISecOps Agent: Automates DLP alert triage, reducing false positives and surfacing priority cases.
- Insider Threat AISecOps Agent: Correlates user behavior and DLP data to identify insider risks.
- Private Access AIOps Agent: Audits access settings and generates policies based on usage patterns.
- DEM Data Intelligence Agent: Converts telemetry data into actionable troubleshooting insights.
- DEM Insights Agent: Highlights performance issues and trends across digital environments.
- CCI Insights Agent: Enables natural language queries of cloud and SaaS risk data.
Netskope is also emphasizing the need for human oversight, alongside the growing use of automation. Agents can autonomously gather data, triage risks, and even initiate workflows such as creating IT service tickets or notifying analysts, but they will not take final action.
“Once the investigation is complete, the agent will wait for a member of the security team to review its findings and direct it to take action,” Netskope’s Davis said. “This provides the balance between time savings and human control.”
AgentSkope and the DLP AISecOps, CCI Insights, Private Access AIOps, DEM Data Intelligence, and DEM Insights agents are all generally available, with the Insider Threat AISecOps Agent currently in private preview. Netskope said it plans to expand its agent portfolio on a monthly basis.
