UnderDefense

More than 100 integrations come ready to use. Queries run against the customer's SIEM, Splunk or Elastic, containment is automated, and results go to Microsoft Teams, Jira or Slack, or by email, so UnderDefense acts in those outside systems itself. Named integrations also include Microsoft Sentinel, Google Chronicle, IBM QRadar, CrowdStrike, SentinelOne, Palo Alto Networks, AWS, Azure, GCP and Okta. Containment isolates infected devices from the network with ready to use playbooks.

SourceUnderDefense, underdefense.com and the company-news agentic AI SOC launchread 2026-10-05

Six specialized AI Teammates pass an investigation along, from MITRE classification and SIEM index selection, through querying and validating evidence, to writing the verdict and routing it to workflows. They draw on 200+ agent skills and 400+ AI tools. Evidence gathering turns the investigation plan in a workbook into precise SIEM queries, and validation scores each piece of evidence as benign, suspicious or malicious before the verdict is written.

SourceUnderDefense, underdefense.com/company-news agentic AI SOC launchread 2026-10-05

MAXI builds a persistent knowledge map of the customer's environment that gets smarter with every investigation, and RAG is named in the MAXI stack. The Teammates draw on that map. It starts with the SIEM, where one Teammate picks the most relevant log indices from environments with hundreds of them. Detection logic is kept as code, and UnderDefense says agents, workflows, MCP and RAG together raise performance by more than 70%.

SourceUnderDefense, underdefense.com/maxi-ai, underdefense.com and the company-news agentic AI SOC launchread 2026-10-05

Analysts validate and tune, verdicts come with a confidence level and a narrative meant for human review, and ChatOps asks affected employees through Slack or Teams to confirm suspicious activity such as a login attempt. Containment is automated within minutes through predefined playbooks, and no approval step comes before a response action goes through. UnderDefense says people are still needed to tune, verify and trust the system, while the AI handles 80% of Tier 1 and Tier 2 work.

SourceUnderDefense, underdefense.com/maxi-ai and underdefense.comread 2026-10-05

UnderDefense holds SOC 2 Type I, audited by Prescient Assurance. It now also holds ISO/IEC 27001:2022 certification covering MAXI MDR and MAXI Compliance AI, and says its SOC 2 Type II examination is in its final stage. MAXI Compliance AI has a view only Auditor role under role based access control, but UnderDefense names no SSO, roles or user access controls for the MAXI AI SOC itself.

SourceUnderDefense, underdefense.com/company-news SOC 2 post and underdefense.com/blog ISO 27001 postread 2026-10-05

Every step of the AI SOC layer is auditable, and each investigation ends in a verdict, a confidence level and a narrative for review or regulatory documentation, the agents' own record of their steps. Validation scores each piece of evidence as benign, suspicious or malicious, and the full investigation output goes to Microsoft Teams, Jira, Slack or email.

SourceUnderDefense, underdefense.com and the company-news agentic AI SOC launchread 2026-10-05

Apart from the persistent knowledge map the Teammates draw on, the agents have no memory, and nothing says what they keep or for how long. That map is built from the customer's SIEM indices and improves with every investigation.

SourceUnderDefense, underdefense.com/company-news agentic AI SOC launchread 2026-10-05

The on premises edition, sold as MAXI Agentic AI SOC On-Premise, runs entirely within the customer's own closed infrastructure, on any Kubernetes, data center or private cloud in any jurisdiction, including air gapped sites, with zero data leaving the perimeter. It is available now for enterprise customers worldwide. On prepared infrastructure, a full deployment finishes in under five minutes.

SourceUnderDefense, underdefense.com/company-news agentic AI SOC launchread 2026-10-05

Six AI Teammates are described by role but not named, with 200+ agent skills and 400+ AI tools behind them. They work inside UnderDefense's own investigation pipeline, not as agents a customer picks up one at a time. The platform ships with more than 700 investigation workbooks mapped to MITRE ATT&CK, and containment uses ready to use playbooks. UnderDefense's site gives no figure of 1,500+ correlation rules. MAXI Compliance AI, a separate product, automates evidence collection and security questionnaires for SOC 2, ISO 27001, HIPAA and PCI DSS.

SourceUnderDefense, underdefense.com/company-news agentic AI SOC launch and underdefense.comread 2026-10-05

A Teammate classifies each incoming alert against MITRE ATT&CK and investigates it around the clock, with automated containment within 5 minutes of detection, so each arriving alert starts the work. Classification works even when the detection rule carries no ATT&CK metadata, a full investigation takes about 2 minutes, and critical alerts carry a 20 minute response SLA.

SourceUnderDefense, underdefense.com/maxi-ai, underdefense.com and the company-news agentic AI SOC launchread 2026-10-05

Customers can bring their own AI model through Azure AI Foundry or AWS Bedrock, or run sovereign open source models hosted entirely inside their own perimeter, so the customer chooses the model. That choice comes with the on premises edition, which keeps all data inside the customer's network.

SourceUnderDefense, underdefense.com/company-news agentic AI SOC launchread 2026-10-05

UnderDefense publishes no public API, SDK or MCP server for building on MAXI. The MAXI page names MCP among its technologies without an endpoint or tools. Detection logic is managed as code, and results reach outside tools through the built in integrations.

SourceUnderDefense, underdefense.com/maxi-ai and underdefense.comread 2026-10-05

Customers get no way to test or evaluate the Teammates themselves. Analyst tuning is part of the service. UnderDefense reports investigations 153 times faster, 99% less noise and 99%+ MITRE ATT&CK coverage, and a 15 minute mean time to contain for its MDR service.

SourceUnderDefense, underdefense.com/maxi-ai and underdefense.comread 2026-10-05

The Teammates work through SIEM queries and integrations, and there is no browser or computer use. Endpoint containment, such as isolating an infected device, runs as an automated playbook action.

SourceUnderDefense, underdefense.com/maxi-ai and underdefense.comread 2026-10-05