Panther Labs

Panther offers what it calls a complete AI SOC platform, combining SIEM capabilities with agentic automation across the detection and response lifecycle. The platform is positioned as an alternative to legacy SIEM and SOAR tooling that has had AI added on top, and to point solutions that operate across fragmented data sources such as separate cloud log stores, EDR portals and MDR consoles.

Functionally, the product covers four areas: detection engineering, in which agents handle repetitive work and detections can be created from natural language descriptions while quality is governed at each step; scheduled proactive threat hunting, in which agents query the full data lake on a cadence and route findings into new detections through a governed workflow; automated triage, in which each alert is investigated with context and confirmed-benign alerts are closed automatically while outcomes are stored to suppress repeat alerts; and investigation and response, in which the agent assembles cross-system investigations and analysts review and direct agentic runbooks. Detection engineering also supports Python.

Governance controls are a stated design element: human approval is required for every write action, all AI actions are logged and reviewable, user permissions are enforced with agents acting under the invoking identity, and each customer runs in an isolated tenant on Amazon Bedrock with no cross-tenant data sharing and no customer data used for model training.

Traction

The company cites customer results including an 85% reduction in alerts reaching the queue through outcome-based suppression, and a customer statement that a fully deployed in-house enterprise SOC was stood up in a matter of weeks using Panther's SIEM and AI SOC.

Latest developments

Panther announced that it is joining Databricks to build the future of the security lakehouse.