21 October 2026 — Wizard Cyber today announced the launch of CYBERSHIELD AI, an agentic AI platform for security operations in which specialised AI agents carry the triage and investigation workload, and human analysts remain accountable for every consequential decision.
The platform is live and available now to customers of Wizard Cyber's managed security services.
The problem it was built for
Security operations has a volume problem that hiring cannot solve. Alert queues grow faster than teams do, and the work that suffers first is the part that matters most: the patient, complete investigation of the alert that turns out to be real. Most automation to date has attacked the queue by closing things faster. CYBERSHIELD AI was built on a different premise — that the bottleneck is not triage speed but investigative depth, and that depth is exactly what an agent can be made to do consistently.
What CYBERSHIELD AI does
CYBERSHIELD AI runs a roster of agent roles spanning five SOC functions, drawing on 250+ named analyst skills and 300+ AI tools. Rather than a single model answering a single prompt, each agent holds a defined role and a defined set of capabilities, and the work is distributed across them the way it would be across a staffed shift.
Every alert enters the same multi-stage investigation pipeline. The pipeline includes a completeness gate — a checkpoint that will not allow an investigation to reach a verdict on partial evidence. Where the evidence is not there, the investigation continues or escalates; it does not close early to keep the queue moving.
Related incidents are grouped into a case, and a case can be marked as a campaign where the pattern warrants it — so that connected activity is investigated as one story rather than as a series of unrelated alerts.
The decision stays with policy and with people
The close-or-escalate decision is made by policy and by customer decision templates, not by the model. Autonomy is configurable, per agent and per tenant, so each customer sets how much the platform does on its own and where a human takes over. On the managed service, senior analyst sign-off is the default.
Every investigation produces a full report, an escalation write-up where the case is escalated, a closing statement, and a drafted email — so that the reasoning behind a verdict is written down and reviewable, not locked inside the system that produced it.
Speed, measured
Across the platform, the average time to verdict is 3 minutes 30 seconds, and 7 minutes 50 seconds where the Incident needs Advanced Investigation — investigation times that would be difficult to sustain by hand at volume, arrived at through the same pipeline every time.
Tenant isolation
Each customer environment is isolated, and there is no cross-customer learning. Nothing observed in one tenant informs the handling of another.
"The thing we kept coming back to is that speed is not the hard part. Getting to a defensible answer is the hard part, and doing it the same way at three in the morning as at three in the afternoon is harder still," said Adam Jones, CTO and co-founder of Wizard Cyber, and the principal designer and architect of CYBERSHIELD AI. "So we built the platform around the investigation rather than around the queue. The agents do the work. The completeness gate stops an investigation closing before it should. And the decision to close or escalate is made by policy and by the customer's own decision templates — not by the model, and not by a confidence score nobody outside the building can interrogate. A senior analyst signs it off. That accountability is the product, as much as the automation is."
"A fantastic milestone for Wizard Cyber," said Paul Goldney, CEO of Wizard Cyber. "Thank you to the entire team for the hard work, determination and innovation that has gone into building CYBERSHIELD AI. Most importantly, thank you to our customers who have trusted us enough to adopt the platform and work with us as we continue to develop it. I'm incredibly proud of what we've built together and very excited about where we take it next."
Availability
CYBERSHIELD AI is available now in three packages — Core, Complete and Command.
Microsoft Sentinel is the only hard requirement. Wizard Cyber builds the tooling to fit the rest of the estate as part of the managed service, rather than requiring customers to standardise their environment before they can begin.
The demo is a working investigation shown end to end by an analyst, not a slide deck. Organisations can book a demo to see the pipeline, the agents and the autonomy controls against a real case.
About Wizard Cyber
Wizard Cyber is a managed security services provider that has been running Microsoft Sentinel since 2019 and is a Microsoft Solutions Partner.
The company operates multiple security operations centres, each manned 24/7 in its own right, with senior analysts, incident responders, L3 analysts and AI developers on shift in every SOC around the clock.
Wizard Cyber has a presence in the United Kingdom, the United States, Pakistan and Kuwait, including an office in the Microsoft Digital Innovation Centre in Kuwait.
Wizard Cyber Security Ltd is certified to ISO 27001 and ISO 9001.
Media enquiries: wizardcyber.com/contact