Elastic updates security platform with AI triage and endpoint tools

Elastic (NYSE: ESTC) announced updates to its security operations platform ahead of Black Hat USA 2026, including an expanded Attack Discovery feature, broader endpoint protection, and enhanced workflow automation.

The updated Attack Discovery now functions as an autonomous triage agent, hunting raw events, checking entity risk scores, and corroborating evidence before flagging threats. When it identifies a gap in detection coverage, it drafts a new detection rule and routes it to an analyst for approval. A companion alert analysis workflow runs in parallel to filter likely false positives before they reach the investigation stage.

"Security teams are not losing because they lack tools; they're losing because the tools generate more work than the team can absorb," said Mike Nichols, general manager of Security at Elastic. "These updates go after one of the biggest sources of analyst burnout, which are alerts that shouldn't be alerts in the first place."

On the endpoint side, Elastic now automatically generates and deploys YARA rules to protect against vulnerable driver exploits. Windows on ARM devices, including Surface laptops, are now supported by Elastic Defend at no per-device cost.

Elastic Workflows, the platform's native automation layer, received updates including plain-language workflow generation, full version history with one-click rollback, a visual graph view, and human-in-the-loop approval routing to tools such as Slack.

All updates are available to current Elastic Security customers. Elastic will demonstrate the capabilities at Black Hat USA 2026, booth 3444, August 3–6, 2026, at the Mandalay Bay Convention Center in Las Vegas. The company is also a Blue Tier sponsor of Blue Team Village at DEF CON 33.

You May Also Be Interested In

• ADARx Pharmaceuticals files for proposed IPO
• USA Rare Earth (USAR) files for 126.5M share offering by selling stockholders
• Seagate board member Arumugavelu to step down at annual meeting