AI SOC Agent

What do you like best about the product?

I like how Simbian simplifies security operations and helps automate repetitive security tasks. The AI-driven approach makes it easier to investigate alerts, understand security issues, and respond more efficiently without spending too much time on manual work.

What do you dislike about the product?

One thing I dislike is that there can be a learning curve when getting started, especially when configuring workflows and understanding all the available features. More guided examples and documentation would make onboarding easier.

What problems is the product solving and how is that benefiting you?

Simbian helps reduce manual security work by automating repetitive tasks and assisting with alert investigation and analysis. This saves time, improves response efficiency, and allows the security team to focus more on higher-priority issues.

What do you like best about the product?

I am a cyber security engineer at a mid-sized organisation and we have Simbian as our AI-powered security copilot in the Security Operations Centre (SOC). It integrates seamlessly with our current SIEM and EDR solutions, enabling my team to leverage natural language search capabilities to delve deeper into intricacies of alerts, automate recurring log evaluations, and rapidly develop incident response summaries without constantly switching between dashboards. The thing that I like the most is that it's a force multiplier for our comparatively small security team. A junior analyst has to spend many hours coding a great deal of complicated regular expressions, or learn a new query language for end users to query a particular log or a group of logs for a host that communicated with this malicious ip address during the past 48 hours, but with this new feature they can just type a question like show me all hosts that communicated with this malicious ip address over the last 48 hours. Simbian interprets that purpose, then traverses our interlocked equipment and provides an integrated overview. It has transformed our initial triage process and made it much faster. I also appreciate how fast it comes up with an easy to read summary of an incoming security alert with context—this can save us a lot of manual documentation time during the active investigation.

What do you dislike about the product?

As with any Generative AI application, you can't simply switch it on and expect it to work without supervision and feedback. I will say, from time to time, we do get instances where the AI will recommend a remediation step that is a little bit more generic, or we don't exactly have the same architecture in our network, or something like that. Furthermore, it took an awful lot of customization to be able to properly parse and understand our very customized in-house log formats while we were in the initial learn step in trying it out. It is also important to have a senior engineer ensuring its outputs prior to allowing it to run any automatic block rules or firewall changes, which makes the "fully autonomous" promise a promise yet to be fulfilled.

What problems is the product solving and how is that benefiting you?

The main issue it alleviates for us is that of alert fatigue and a slow mean time to respond (MTTR). Maddeningly, a few months ago when a big zero-day came down, our team would have to spend an entire day looking into our logs to figure out if our infrastructure was exposed, manually pulling data from so many sources. The only thing we had to do with Simbian is to submit the recently released Indicators of Compromise (IOCs) to threat feed and have it scan our environment. It cross referenced our logs and generated us a nice exposure report in minutes. It ensures that my team can focus on threat hunting and critical thinking and not be burnt out with log filters.

What do you like best about the product?

Working in a SOC means constantly drowning in thousands of daily alerts, the vast majority of which are false positives. What sets Simbian apart is its agentic AI approach to handling Tier 1 triage. Instead of relying on rigid, pre-built playbooks, the AI SOC agent autonomously investigates alerts the instant they arrive by collecting evidence across our entire stack pulling from our SIEM, EDR, and identity tools. It follows the evidence, evaluates observables, and categorizes each alert as a True or False Positive with a clear severity level and confidence rating. I love that it provides an auditable, replayable reasoning chain for every decision, so I can see exactly why it classified something as benign. The fact that it continuously learns from human feedback and writes its findings back into a shared Context Lake means it gets smarter and more accurate over time.

What do you dislike about the product?

Because the reasoning engine operates dynamically without strict playbooks, trusting the agent to take automated containment actions on mid-to-high severity alerts requires a significant mindset shift for the team. Initially, we spent a lot of time double-checking its work because we were hesitant to let it autonomously block threats or quarantine endpoints without human intervention. While the platform is built to empower analysts rather than replace them, getting comfortable with its level of autonomy and adjusting to how it queries federated data across 100+ integrations takes time.

What problems is the product solving and how is that benefiting you?

It is directly solving the problem of alert fatigue and the high volume of false positives. By automating the repetitive ingestion, enrichment, and investigation phases, Simbian filters out the noise and auto-closes low-severity false positives. This frees me up to focus strictly on complex threats and high-severity escalations that actually require human judgment. It has drastically reduced our response times and allowed our team to handle a growing attack surface without needing to constantly add headcount for Tier 1 triage.

What do you like best about the product?

Reasoning Over Playbooks: Unlike legacy SOAR tools that break when APIs or environments change, Simbian uses federated reasoning. Its agents independently adapt their investigation paths, querying over 100 integrated tools to gather evidence and reach a verdict on novel threats.

What do you dislike about the product?

Emerging Category Risks: Replacing highly deterministic, heavily scripted legacy automation with a dynamic AI reasoning engine means organizations must be prepared for an initial tuning phase to align the AI's logic with their highly specific corporate risk tolerance.

What problems is the product solving and how is that benefiting you?

The Context Lake: At its core is the Context Lake, a centralized intelligence layer that captures an organization's specific tribal knowledge, operational procedures, and past analyst feedback. This creates a self-improving loop where the system gets smarter with every resolved alert.

What do you like best about the product?

The platform has been really great for automating security alert investigations and the AI-powered response feature handles threats automatically without needing manual intervention and I also really like the autonomous SOC capability which makes managing security operations very straightforward and efficient.

What do you dislike about the product?

No cons that I can think of at the moment as the platform has been working really well and it does exactly what we need it to do in a very reliable and consistent way.

What problems is the product solving and how is that benefiting you?

It effectively helps automate the investigation and response of security alerts and reduces the number of false positives which saves our team a lot of time and the autonomous threat response feature also helps improve our overall security operations across the organization.

What do you like best about the product?

It alert giving feature or say message and specify some real information about any suspicious hunting or something

What do you dislike about the product?

It just give solution , it can apply that also

What problems is the product solving and how is that benefiting you?

It resolve many mainly any attack will happen then it will rate that attack and specify it's frequency and will tell what yo do now'

What do you like best about the product?

Simbian is a good starting point for SOC analysts to be comfortable with AI agents. It has integration available with different SIEM solution like qradar, Splunk etc. It has autonomous alert triage available. It automatically analyse the incident and gives appropriate analysis. It will reduce Mean time to detect with automation. It executes predefined response actions as well.

What do you dislike about the product?

1- On the high impact incidents SOC analyst need to manually validate the findings and recommendations.
2- More of the fine tuning is required on the SIEM solution or source of truth.
3- The setup of is quite complex and not easily deployed.
4- It can mis interpret the alerts alot.

What problems is the product solving and how is that benefiting you?

It resolves the challenge of high alert volumes specially in MSSP environment.
Level 1 SOC investigations can be handled by the solution with automation.
It reduces the Mean time to Detect (MTTD).

What do you like best about the product?

Reduces alert fatigue, saves cost in security operations budgets, Integrates via APIs to various security tools for effective data correlation, significantly improves Mean Time To Resolution (MTTR)

What do you dislike about the product?

The major drawback felt is that Simbian AI lacks contextual reasoning. It means that while Simbian can spot suspicious activity, however it is unable to flag the same as it lacks the context of the business and the organization. UI also has scope for improvement.

What problems is the product solving and how is that benefiting you?

Simbian has helped us in automating our Secops to a large extent using automated AI agents and reduce alert fatigue which in turn has helped us save costs. It has also led into workoad reduction and shifted focus from reactive to proactive security with focus on threat hunting unlike before. The Mean Time To Detect has significantly gone down as compared to the pre Simbian deployment.

What do you like best about the product?

Simbian distinguishes itself with AI-driven automation that accelerates how security teams investigate and respond to threats, shortening detection-to-response time. It reduces manual effort, enhances consistency in incident handling, and integrates smoothly with existing SOC tools, enabling analysts to concentrate on the most complex security issues.

What do you dislike about the product?

Nothing to report so far; the tools offer good features and strong security controls.

What problems is the product solving and how is that benefiting you?

Simbian automates security operations, cutting down manual tasks and enabling faster, more precise threat detection and incident response.