TENEX.ai Rebuilt Security Operations to Dig Through The Volume of Alerts That Bury a SOC During An AI Attack

Introducing Telemetry, Alert Screen and Threat Loop to give defenders data they couldn’t see, verdict on every alert, & detections that keep pace with attacks

SARASOTA, FL, UNITED STATES, November 11, 2026 /EINPresswire.com/ — For three days in July, 26,000 AI agents attacked a global institution’s live production environment with no credentials and no map. They executed 17 million offensive actions against more than 25,000 services, and chained 38 validated paths to exploitation. The institution’s defenders had 231 billion events to look through to find them, and exactly one in every 13,338 was the attacker. Every detection that fired was buried under the rest.

TENEX.ai was the defense. It triaged every one of the 101,169 alerts the attack generated, more than 33,000 a day on top of the institution’s normal volume, and rebuilt all 38 attack paths with evidence. Today the fully agentic, human-led security operations provider is previewing what it built from that engagement: three new solutions on the TENEX.ai Agentic Security Operations Platform, TENEX Telemetry, Alert Screen and Threat Loop, built on one lesson. It’s not the alerts. It’s the scale.

“We ran a live AI Hyperattack with Armadin because opinions don’t defend anything. What we learned is that it’s not the alerts; it’s the scale. One event in 13,338 was the attacker, and it wasn’t hidden; it was buried, and you can’t filter your way out of that,” said Eric Foster, founder and CEO of TENEX.ai. “So we built for it, and because investigating every alert costs compute, we made that cost ours and not our customers’.”

For thirty years, security operations has worked by filtering down: logs to alerts, alerts to triage, triage to people, each stage dropping volume so humans could keep up. The partnership with Armadin, Kevin Mandia’s company, showed what that costs once the attacker stops choosing targets. Much of the evidence the defense needed never reached the SIEM or generated an alert at all; it sat in identity systems, network devices and endpoints behind logging built for human speed, and many of the exposures the swarm exploited were not CVEs. The swarm went after everything at once, so the defense had to look at everything, with human analysts directing every step and owning every escalation. Defending at that scale requires useful telemetry and the capacity to investigate it all, continuously. That is what the three solutions are.

Three Solutions. One Platform. The SIEM You Already Have.
TENEX Telemetry is a solution on the TENEX.ai Agentic Security Operations Platform that makes useful real-time telemetry available across a customer’s SIEM and connected sources, choosing the collection, query and routing approach for each source. It is the answer to everything the defense couldn’t see. Data in the SIEM, EDR and NDR stays where it is and is used in place; telemetry nobody stores today becomes available and is correlated with the SIEM. More telemetry, not less.

Alert Screen is the alert-investigation layer of the TENEX.ai platform. It investigates every alert, attaches the evidence and produces a verdict with human oversight, with a median time to verdict under one minute, and it is live today. Known noise closes with a record. When the evidence runs out, the case goes to a person. A verdict is not a claim of containment; the customer’s response permissions decide what happens next.

Threat Loop is a solution on the TENEX.ai platform that uses threat intelligence and analyst decisions to improve detection and response, feeding tested rules, detections, resolutions and new agents back into the platform. It is how the lesson doesn’t get forgotten. It hunts across the sources it can reach, including data already in a customer’s existing tools, and nothing goes into a customer’s environment that a named analyst hasn’t signed. Detections keep pace with the attack, not the calendar.

“Look at everything, not a sample. That is what the engagement taught us, and that is what these three solutions make possible,” said Venkata Koppaka, co-founder and chief technology officer of TENEX.ai. “The agents absorb the volume. The analysts own the decisions that matter, and every one of those decisions can be inspected.”

Measured, Not Projected
Across TENEX.ai platform telemetry from July 29 to October 27, 2026: a median time to verdict under one minute, 94% alignment between AI and human expert verdicts, 69.9% of noise removed before an analyst ever saw it, 15x analyst efficiency, and $0 in separate AI token fees within contracted scope. Every breach write-up prices the attack and almost none price the defense, and the defender’s bill rises with every alert a person has to look at. TENEX.ai built its architecture so the cost of defending does not scale with the attacker’s volume, prices for outcomes rather than raw token volume, and carries the cost of looking at everything itself. Definitions are published in the TENEX.ai Metrics Definition Guide; under one minute is the median, not a guarantee for every alert or a containment time.

Alert Screen is live today for eligible customers with an active Google Cloud SecOps or Microsoft Sentinel deployment. TENEX Telemetry and Threat Loop are in preview with design partners through the end of 2026, with full launch planned for the first half of 2027, and TENEX.ai plans to make all three available to Agentic Overwatch and Agentic MDR customers as part of the platform as they reach general availability. Venkata Koppaka walks through the engagement and all three solutions in a keynote at tenex.ai/11-11, where security teams can register for a Capture the Flag built on the exercise and find out whether their SOC would have seen all 38.

About TENEX.ai
TENEX.ai is a fully-agentic, human-led security operations platform and MDR provider built by operators who have previously scaled MDR and founding engineers from Google Cloud SecOps and leading AI labs. Launched in January 2025, TENEX.ai serves enterprise customers across the Google and Microsoft security ecosystems. Its fully agentic Security Operations platform autonomously triages, investigates, hunts and responds to threats, with elite human analysts always in the loop to provide oversight, judgment and accountability. Named #1 on IT-Harvest’s 2026 Cyber 150, TENEX.ai is backed by Crosspoint Capital Partners, Shield Capital, DTCP, Deepwork Capital and the Florida Opportunity Fund, with its seed round led in 2025 by Andreessen Horowitz (a16z). TENEX.ai is headquartered in Sarasota, Fla., with offices in Overland Park, San Jose and Phoenix. Learn more at TENEX.ai.

TENEX.AI PR
TENEX.AI
Visit us on social media:
LinkedIn
Facebook
X

Media gallery