Coder Legion - Recent posts tagged threatdetection

Blumira's Hearth Turns Security Investigations from Hours Into Minutes With AI Reasoning

Wed, 19 Aug 2026 14:53:42 +0000

Security teams already know the real problem isn't a lack of tools. It's the time it takes to move between them. A detection fires in one product, the context lives in three others, and by the time someone's pieced together what actually happened, the window to respond fast has already narrowed.

Blumira is launching Hearth, an AI command center built to close that gap. It's not a replacement for the company's existing SIEM or its Kindling triage engine — it's a separate layer that sits on top of a team's full stack, Blumira or not, and reasons across it.

Why triage isn't the hard part

Most detection products can already take some kind of action on their own — kill a process, isolate a machine. According to Blumira CEO Matt Warner, that's the easy half. The hard half is coordinating a response across every tool a team runs, especially when none of those tools were built to talk to each other.

That's the distinction Blumira is drawing between Kindling, which handles alert triage inside the platform, and Hearth, which extends investigation, response, and follow-up across a team's entire toolset. Ask Hearth to run a full DFIR investigation, and it pulls from five sources at once: stored logs, direct API connections, daily environment risk analysis, memory from past investigations, and the accumulated knowledge the team has generated through prior use. Warner says the goal is to make that kind of investigation something a user can trigger with a single ask, rather than something that requires stitching data together by hand.

Autonomy with a leash

The part likely to draw the most scrutiny from security teams is how much Hearth is allowed to do on its own. Blumira's answer is a risk-tiered system. Low-risk actions — sending an email, posting to Teams — can move without much friction. Medium-risk actions, like disabling a user or adding a hash to a CrowdStrike blocklist, get more scrutiny. High-risk, harder-to-reverse actions — deleting files, deleting users — require explicit human approval every time. Warner puts the underlying rule simply: disable a user rather than delete one, whenever the situation allows it.

That framing tracks with what Warner says he's hearing from midmarket and channel customers: they're less worried about AI taking automated action than they used to be, particularly for identity-based threats, where a fast reversible action beats waiting on a human who might not be watching in time.

Working outside the Blumira stack

Blumira is positioning Hearth as usable even by organizations that don't run any Blumira products at all. Warner's example: a company running Microsoft Sentinel for SIEM, M365 for identity, CrowdStrike for endpoint detection, and Oracle for cloud. A CrowdStrike detection on its own might not carry enough context to act on. Hearth pulls in the M365 identity data for that same user, and if the pattern matches something like a ClickFix attack, it can recommend resetting credentials, isolating the host, and flagging the incident as more serious — all without anyone having pre-mapped how those tools relate to each other.

Built for MSPs managing more than one environment

For managed service providers, the pitch is fleet-wide visibility: ask which clients in a portfolio are exposed to a given CVE, and get an answer across every environment at once instead of opening a dashboard per client. Blumira says tenant boundaries are enforced through its own access mapping combined with role-based access control, so each user's data access is scoped to what they're provisioned to see — a detail that matters as much for compliance as it does for accuracy.

Blumira has started onboarding MSPs onto Hearth and says the biggest shift they're reporting is the ability to do fleet-wide discovery and research with far less manual effort, cutting into how often they need to bring in outside incident response help for that last stretch of an investigation.

An early reaction from the field

Stephen Biasotto, lead systems engineer at Nettology, offered one of the more grounded endorsements available in security marketing right now: "A lot of products are throwing AI in just to say they have it. Hearth is cool and it's actually useful. I like the way Blumira designs things — the ideas make sense, the product works, and it's easy to use."

What it costs

Hearth is a separate product from Blumira's core platform, though it integrates natively with it. Existing Blumira customers get a lower price, but Warner says Hearth is available to any team, regardless of what else is in their stack.

For engineering and security teams already drowning in tool sprawl, the appeal isn't the AI label — it's whether Hearth actually cuts the time between "something happened" and "here's what we did about it." Blumira's early MSP feedback suggests it's moving that needle. Whether it holds up at scale, and with harder numbers behind it, is worth watching as more teams put it to use.

Torq SOC Brain: Why Reasoning From Precedent Beats Retrieving It

Tue, 28 Jul 2026 13:00:00 +0000

Most autonomous SOC vendors describe "self-learning" the same way. Pull up cases that resemble the one in front of you, hand them to an LLM, and let it summarize what happened last time. That's retrieval dressed up as intelligence. It's useful, but it's not judgment.

Torq is drawing a sharper line with SOC Brain, a new layer of its AI SOC Platform launching at Black Hat USA 2026. Rather than fetching precedent and stopping there, the system is built to reason from it — building a case for what a specific customer's SOC would actually decide, based on how that SOC has decided before.

"Every cybersecurity vendor claims their AI is self-learning, but virtually none are," said Ofer Smadari, CEO and co-founder of Torq. "What the majority do is simply pass cases and hand them to an LLM at the point of decision. That's nothing more than executing based on memory. Self-learning means reaching new conclusions from that history, and that's much harder to build."

Three capabilities, one idea

SOC Brain breaks into three pieces, each solving a different part of the same problem: how do you get an AI system to make calls a human analyst would trust, without waiting years for it to learn an environment the slow way?

Torq Recall handles the deterministic side. It retrieves relevant historical cases using matching on security observables — IPs, file hashes, URLs, hostnames — then ranks them by relevance and analyzes how past analyst decisions should shape the current verdict. It reads analyst notes, flags conflicting precedent, and adjusts its confidence based on how strong the evidence actually is.

Torq Reflex is where the reasoning compounds. It continuously trains a dedicated AI model on a SOC team's confirmed verdicts and corrections, learning that organization's specific approach to risk and evidence. Torq says it matches analyst-corrected verdicts 85% of the time immediately, with accuracy improving from there. High-confidence alerts get automated; uncertain ones still go to a human.

Torq Retrospect solves the cold-start problem that trips up most of these systems. It imports resolved incidents from a customer's existing security tools before deployment, so SOC Brain isn't learning an organization's judgment in real time on live alerts. Years of institutional history become available to Recall and Reflex from day one.

Private by architecture, not by setting

Every customer gets their own SOC Brain, trained exclusively on their analysts, their incidents, their policies, their history. Torq says it never pools customer data or trains one organization's model on another's experience — and that this isolation is built into the architecture rather than toggled on through configuration.

"With Torq SOC Brain and its Torq Recall, Torq Reflex, and Torq Retrospect capabilities, the Torq AI SOC Platform truly learns how a SOC thinks, even from the years of history that predate a Torq deployment," Smadari said. "That's the difference between automation that treats every investigation as if it were on its own and the industry's first SOC that actually gets smarter and more accurate with each completed investigation."

Torq is also positioning SOC Brain around auditability and oversight rather than pure autonomy — explainable decisions, confidence-based automation with a human still in the loop, and outcomes built to hold up against regulatory scrutiny like the EU AI Act.

The question worth asking every vendor

The bigger claim underneath all three capabilities is that an autonomous SOC shouldn't behave like a generic model with a search index bolted on. It should behave as it has actually worked at your company. Recall confirms the facts. Reflex learns the judgment. Retrospect makes sure that judgment doesn't start from zero.

For security teams evaluating autonomous SOC platforms, that's the distinction worth pressing on: is the system retrieving cases, or reasoning from them the way your own analysts would? Those are very different products that can sound identical in a demo.

Torq SOC Brain demos will be available to qualified attendees at the Torq booth at Mandalay Bay Convention Center during Black Hat USA, August 3–6.