Arctic Wolf launches AI oversight tools for security teams

Arctic Wolf has launched three security products focused on AI oversight and threat response. The announcements focus on visibility into AI use and earlier intervention in cyber attacks.

The company introduced SwarmView, Shadow AI Discovery and Aurora Adaptive Threat Protection as additions to its Aurora platform and security operations offering. Together, they aim to help customers understand how AI-driven security decisions are made, identify unsanctioned AI tools across their organisations, and stop attacks before they spread.

AI oversight

SwarmView is designed to show customers how Arctic Wolf's AI agents and human analysts work through a security investigation. Users can follow an investigation from the first signal to the final conclusion, see which agents took part, track the sequence of defensive actions, and identify when a case was passed to a human expert.

The move addresses a concern among security teams about how much trust they can place in AI-led decisions when the process behind them is hard to see. Arctic Wolf cited research from SANS showing that 40% of security leaders see transparency and trust in AI decisions as their main challenge in AI integration.

Nick Schneider, President and Chief Executive Officer at Arctic Wolf, said the product was intended to remove that opacity. "Organisations rely on AI for critical decisions, but they can't trust those decisions without transparency.

"For too long, security teams have been asked to trust outcomes without understanding how those outcomes were reached. SwarmView changes that. We're giving customers direct visibility into the people, agents, decisions and actions behind investigations, setting a new standard for accountability and trust in AI-powered security operations," Schneider said.

SwarmView sits inside the Arctic Wolf Portal and gives customers a direct view into its Aurora Agentic SOC. Arctic Wolf said its wider security operations system serves more than 11,000 customers, with AI agents and human staff jointly handling investigations and escalations.

Shadow AI

The second addition, Shadow AI Discovery, is intended to help companies identify which AI tools employees are using across their environment. It draws on network, identity and endpoint telemetry to create an inventory of sanctioned and unknown AI tools, allowing security teams to assess adoption patterns and possible data exposure risks.

The issue has become more pressing as businesses adopt generative AI services faster than governance processes can keep up. Arctic Wolf pointed to Cloud Security Alliance findings that 98% of organisations have experienced unsanctioned AI use, and to SANS research showing that 63% of practitioners lack visibility into where AI models are being used and what data they may expose.

Shadow AI Discovery is expected to be made available to Aurora Managed Detection and Response customers. The tool does not require additional deployments and can also support internal governance efforts by helping companies spot gaps that may require staff training.

Schneider said the wider problem for security teams is a lack of visibility across growing data volumes, threats and AI activity. "Security teams are under pressure to move faster while managing more data, more threats and more AI risk than ever before.

"Visibility is the foundation of security in the age of AI. The advancements we are introducing today to the Aurora Superintelligence Platform help customers understand how AI is being used across their environment so they can establish stronger management processes and act on insights in real time," Schneider said.

Earlier intervention

The third announcement, Aurora Adaptive Threat Protection, is an endpoint security product that aims to identify malicious intent earlier in an attack. Rather than depending on single indicators of compromise, it analyses how endpoint events unfold across processes, files, registries and API calls to judge whether otherwise normal-looking actions are combining into a harmful pattern.

According to Arctic Wolf, once malicious intent is confirmed, the system can interrupt the activity and reverse the attack chain. The product is designed to work alongside existing endpoint protection and endpoint detection and response tools, including third-party systems, rather than replace them.

This approach is intended to address attacks that rely on valid credentials, trusted software and gradual activity that blends into normal operations. Arctic Wolf said ransomware accounted for 44% of its incident response engagements over the past year, while credential theft remains a growing problem.

Dan Schiappa, President of Technology and Services at Arctic Wolf, said those changes in attacker behaviour required a different approach on endpoints. "Attackers often don't need malware to cause damage. They can use legitimate tools, trusted credentials and AI-driven automation to hide in plain sight, all at machine speed.

"That's why endpoint security needs to evolve. Endpoint detection and response does rich detection well, but that work needs to happen earlier. Aurora Adaptive Threat Protection shifts the mindset from a purely detection-and-response approach to a more pre-emptive one, identifying malicious intent and disrupting threats earlier in the attack chain," Schiappa said.

Alongside the three launches, Arctic Wolf also outlined new integrations for the Aurora platform, including links with Cloudflare, Imperva, Veeam, Datadog, Google Workspace, and several healthcare and industrial systems. The integrations are intended to widen the telemetry available to its security operations platform and extend detection and response coverage across customer environments.