Proofpoint unveiled its SOC Analyst Agent on September 3 at OpenAI's Cyber Summit, with a design decision worth calling out: the agent can investigate, but it's built so that its authority stops exactly there.
The SOC Analyst Agent uses OpenAI's Daybreak models to turn natural-language questions (for example, "what suspicious activity has this user shown in the last 48 hours?") into structured, traceable investigation findings, along with a recommended next step. It plans the investigation, pulls context from Proofpoint's various security data surfaces (alerts, logs, DLP events, user risk signals), and returns the result in a consistent format — not a loose paragraph an analyst has to reinterpret.
This is the part most worth replicating in any homegrown security-agent design: the system cannot modify an account, contain an active threat, or trigger any other remediation action with real consequences. Its authority ends at investigation and recommendation — the decision to act always stays in human hands.
The agent is in private preview with select beta customers, with general availability expected by the end of Q3 2026. Proofpoint said it's exploring how to extend the OpenAI Daybreak models to other defensive security workflows across its portfolio, including threat investigation, data security, and AI security.
If your company is designing an agent that touches sensitive systems — security, finance, customer data access — Proofpoint's pattern is a solid starting point: explicitly separate "what the agent can investigate and recommend" from "what it can execute on its own," and draw that line before you write the code, not after an incident. An agent that only investigates and recommends is easier to audit, easier to trust, and fails far less expensively than one with direct execution permissions.
Carlos Montiel is an enterprise AI solutions architect. He implements LLMs, Agents, RAG and orchestrators for companies across Guatemala and Latin America. Reach out for a consultation.
Contact Carlos Montiel