Sekoia Elevate rende concreta la difesa informatica autonoma: dai dati di sicurezza al verdetto in 99 secondi

Sekoia launched Sekoia Elevate, an agentic-AI layer for autonomous SOC investigations that delivers auditable security verdicts in an average of 99 seconds. During early access, the product was deployed to more than 2,000 customers, completed over 425,000 autonomous investigations, and reportedly enabled managed-security providers to investigate incidents up to five times faster. The platform records agent queries and supporting evidence for analyst review, correction and auditability while remaining model- and security-tool-agnostic.

Analysis

This is more competitively relevant to SOC labor economics than to near-term public-equity estimates. If autonomous investigation becomes credible in managed-security workflows, MSSPs can expand analyst-to-customer ratios and defend gross margins despite security-talent inflation; the offset is that lower-tier alert-management vendors risk commoditization. For public platforms, the strategic value lies in owning the telemetry, identity graph and response workflow—not the underlying model—favoring scaled ecosystems such as PANW, CRWD and MSFT over point solutions whose differentiation is primarily detection UX.

The claimed auditability is the important adoption gate: regulated buyers will tolerate machine-generated triage before they tolerate autonomous containment. Over the next 1-3 months, the relevant catalyst is independent evidence of false-negative/false-positive performance, customer renewal behavior and MSSP seat expansion—not reported investigation volume. A material breach tied to an erroneous automated verdict, or evidence that human-review requirements remain unchanged, would cap labor savings and undermine the category multiple.

Contrarian view: market enthusiasm around "agentic SOC" likely overstates near-term headcount displacement. Security budgets are more likely to redeploy saved Tier-1 analyst hours into threat hunting, identity security and remediation, so revenue pools may shift toward platform vendors rather than shrink. Sekoia's model-agnostic positioning is strategically sensible, but it also limits pricing power unless proprietary intelligence and workflow data produce demonstrably superior outcomes; as a private-company launch, this alone is not a tradable public-market catalyst.

Key Decisions for Investors

• No standalone trade from this launch. Maintain a 1-3 month diligence watch on PANW, CRWD, MSFT and S for SOC-automation attach-rate disclosures, MSSP channel commentary and evidence that AI workflows raise platform retention or net revenue retention.
• Prefer a 6-18 month quality basket long PANW/CRWD versus short a diversified cybersecurity ETF proxy such as HACK only if quarterly results show automation-led operating-margin expansion without a deceleration in billings; target a 10-15% relative return, with exit if billings growth slows by more than 5 percentage points or AI-related R&D/sales expense absorbs the margin benefit.
• Monitor SentinelOne (S) as the higher-beta read-through: its valuation can re-rate if autonomous investigation improves enterprise win rates, but avoid initiating before proof of sustained ARR acceleration and improving FCF. Falsifier: continued large-enterprise churn or material services/support cost growth despite AI product adoption.
• For MSSP exposure, treat private-market customer references as an alert rather than a recommendation. A public beneficiary trade requires disclosed evidence that automation increases security revenue per analyst rather than merely enabling price concessions to customers.