TENEX.ai previews new tools after AI attack overwhelmed SOC alerts

TENEX.ai says a July live-fire exercise showed how an AI-driven attack can bury defenders under alert volume, and it is now previewing three new security operations tools built from that engagement. The company says the products are designed to help teams see more telemetry, investigate every alert and keep detections current as attacks scale.

Why it matters: - AI-driven attacks can overwhelm security operations centers with alert volume faster than humans can triage it. - TENEX.ai is positioning its platform around that problem, with tools built to investigate every alert and surface data defenders could not previously see. - The company says the approach shifts defense from filtering down to looking across all available evidence.

What happened: - TENEX.ai previewed three new products on its Agentic Security Operations Platform: TENEX Telemetry, Alert Screen and Threat Loop. - The company built the products from a live AI attack engagement in July against a global institution's production environment. - The exercise involved 26,000 AI agents, 17 million offensive actions, more than 25,000 services and 38 validated paths to exploitation. - The defenders faced 231 billion events, and one in every 13,338 was the attacker. - TENEX.ai triaged all 101,169 alerts generated during the attack and rebuilt all 38 attack paths with evidence.

The details: - TENEX Telemetry is designed to make real-time telemetry available across a customer's SIEM and connected sources by choosing the collection, query and routing approach for each source. - TENEX Telemetry keeps data in the SIEM, EDR and NDR where it already lives and correlates it with telemetry that was not previously stored. - Alert Screen investigates every alert, attaches evidence and produces a verdict with human oversight. - Alert Screen reports a median time to verdict under one minute and is live today. - When evidence runs out, Alert Screen sends the case to a person. - Threat Loop uses threat intelligence and analyst decisions to improve detection and response. - Threat Loop feeds tested rules, detections, resolutions and new agents back into the platform. - Threat Loop hunts across accessible sources, including data already in a customer's existing tools. - TENEX.ai says no code goes into a customer's environment without a named analyst signing off.

Between the lines: - The company is arguing that the core security problem is no longer just noise reduction, but scale itself. - TENEX.ai says much of the evidence needed during the exercise never reached the SIEM or generated an alert, which suggests traditional pipelines missed critical context. - The company is also trying to shift the economics of detection, saying its architecture keeps defense costs from rising with attacker volume. - TENEX.ai says it prices for outcomes rather than raw token volume and absorbs the compute cost of reviewing alerts itself.

What's next: - Alert Screen is live today for eligible customers with an active Google Cloud SecOps or Microsoft Sentinel deployment. - TENEX Telemetry and Threat Loop are in preview with design partners through the end of 2026. - Full launch for those two products is planned for the first half of 2027. - TENEX.ai plans to make all three tools available to Agentic Overwatch and Agentic MDR customers as they reach general availability. - The company is also offering a keynote walkthrough and Capture the Flag exercise at the event page.

The bottom line: - TENEX.ai is betting that security operations needs to be rebuilt for AI-scale attacks, not tuned around alert filtering alone. - The company says its new products are meant to give analysts a verdict on every alert, more usable telemetry and detections that adapt as quickly as attackers do.