Flashpoint launches agentic AI for threat investigations

Flashpoint said on Nov. 10, 2026, it is adding purpose-built AI agents to its threat intelligence platforms to automate recurring workflows and speed investigations. The new offering is slated to arrive in early 2027 and is aimed at helping teams handle alert noise, limited bandwidth, and faster-moving threats.

Why it matters: - Threat intelligence teams are under pressure from more AI-driven adversary activity and limited analyst capacity. - Flashpoint is positioning agentic AI as a way to automate repetitive work without giving up visibility into sources, evidence, or decision-making. - The move could help teams spend more time on analysis, prioritization, and security decisions.

What happened: - Flashpoint announced Flashpoint Agentic AI, a new offering that places purpose-built AI agents inside threat intelligence workflows. - The company said the product uses Flashpoint’s proprietary, primary-source intelligence. - The offering includes Agentic Hub inside Flashpoint Ignite and product-specific agents in Echosec. - Flashpoint said the new offering will be available in early 2027.

The details: - Agentic Hub combines chat with specialized agents for multi-step intelligence work. - The chat function turns a natural-language question into an investigation across vulnerability, credential, fraud, and threat actor intelligence. - The Intelligence Briefing Agent produces scheduled briefings for executives, analysts, and technical teams. - The briefing agent draws on alert rules, Priority Intelligence Requirements, investigations, assets, and credential exposure data selected by the team. - The Alert Setup Agent converts plain-language monitoring requirements into alert rules and lets teams preview results before saving. - The Alert Triage Agent filters low-context alerts, flags mismatches to monitoring intent, and labels or archives remaining alerts while showing the actions taken. - The PIR Agent converts plain-language intelligence requirements into structured Priority Intelligence Requirements for review and approval. - The PIR Agent also identifies emerging threats that existing requirements may miss. - The Echosec Reporting Agent turns saved searches into scheduled reports with assessments, cited findings, and recommended actions. - Reports are preserved so teams can track how threats and emerging situations change over time. - Flashpoint said the tools are embedded in its existing platforms, so customers do not need separate infrastructure or additional integrations. - Josh Lefkowitz, Flashpoint founder and CEO, said the product is meant to take on recurring work and free teams to focus on connecting the dots and informing security decisions. - Flashpoint said organizations keep control over agent objectives and downstream decisions. - Agent-generated findings link back to underlying intelligence so practitioners can review evidence and validate results. - Some workflows, including PIR creation, require human review and approval before activation. - Flashpoint’s 2026 Enterprise Threat Intelligence Report found 65% of respondents cited alert noise and false positives as challenges. - The same report found 55% cited insufficient analyst bandwidth.

Between the lines: - Flashpoint is pushing a model that blends automation with human oversight, rather than replacing analysts. - The company’s pitch centers on reducing noise and manual work inside the systems teams already use. - The emphasis on source-linked findings and approval gates suggests customers in this market still want traceability and control.

What's next: - Flashpoint Agentic AI is expected to roll out in early 2027. - Existing customers are being directed to contact their customer success manager. - New customers are being asked to request a demo. - The broader test will be whether threat teams see measurable time savings without losing confidence in the output.