SOC Jedi.AI is a security operations vendor that uses AI agents to investigate and triage alerts for security operations centres (SOCs) and managed security service providers (MSSPs). Its aim is to take routine investigation work off L1 to L3 analysts, so that people spend their time on the incidents that need judgement.
The problem it addresses is alert volume. Most alerts turn out to be harmless, and analysts gather the same context again and again for those that are not, which slows response and wears teams down.
At A Glance
| Vendor | SOC Jedi.AI (CyberForce, Inc. and CyberForce, LTD) |
|---|---|
| Category | AI SOC automation, alert investigation and triage |
| Deployment | On-premises (self-hosted) or SaaS |
| Agentic AI | Multi-agent SOC platform with an ML and LLM pipeline |
| Customers | Wrike |
| Market classification | Security Operations |
What SOC Jedi.AI Does
SOC Jedi.AI automates that groundwork. The platform is LLM-based and works with any text-based security data, splitting the work across specialised agents rather than one general assistant. A machine learning step removes obvious false positives first, then AI agents enrich the remaining alerts with internal and external context, look for correlations, map attack chains and identify the accounts and hosts involved.
Each investigation ends with a summary of what happened, how it happened and what to do next, and analysts can ask follow-up questions in a chat interface. For MSSPs, the layered ML and LLM design filters noise early, which lowers compute, token spend and the analyst hours each investigation takes.
Products
AI SOC Analyst
The AI SOC Analyst is the core agent for SOC teams that want routine L1 to L3 work handled automatically. It investigates alerts and writes incident summaries, and analysts reach it through a web interface, an API or chat.
ML Pre-Scoring Agent
This agent cuts false-positive noise before triage begins. It learns from historical data and earlier verdicts, so clear false positives never reach an analyst’s queue.
Specialist Agents
Three further agents extend the platform beyond alert triage:
| Reverse Engineer | Assesses suspicious binaries for zero-day risk |
|---|---|
| External IT Auditor | Runs penetration testing and red teaming from outside the organisation |
| Darknet Monitoring | Tracks leaks of corporate and employee data on the dark web |
MSSP Platform
The MSSP offering lets service providers run SOC Jedi.AI for many clients from one multitenant deployment:
- Tenant isolation, with each customer’s data isolated at the infrastructure level
- Ready-made workflows that can be adapted, plus custom AI agents and extra data sources
- PDF and email reports per investigation, or weekly, monthly and quarterly
- A choice of deployment regions for data residency and regulatory needs
How It Works
Alerts enter the platform from event storage, SIEM, data lakes, log managers and custom inputs, through a REST API or the user interface, and pass through seven stages.
| Component | What it does |
|---|---|
| Data Collection | Receives alerts from SIEM, SOAR, IRP, EDR, data lakes and other tools. |
| ML Pre-Scoring | Filters out clear false positives. |
| Data Markup | Extracts the details relevant to an investigation from any alert format. |
| Data Enrichment | Correlates the alert with internal systems and external intelligence using aggregation and clustering, threat feeds, IOCs, retrieval-augmented generation (RAG), asset resolution and data plugins. |
| Retro Analysis | Links current activity to similar past incidents. |
| Hypothesis Modelling | Builds and scores attack hypotheses from the correlated evidence. |
| Reporting and Verdict | Produces the verdict, multi-level SOC reports and remediation recommendations. |
The on-premises edition is fully self-hosted inside the client’s own secure environment. The SaaS edition runs in the cloud, needs little setup and receives continuous updates.
Integrations
| Area | Integrations |
|---|---|
| Cloud platforms | AWS, Microsoft Azure, Google Cloud Platform |
| Email security | Proofpoint, Microsoft Exchange, Google Workspace |
| Endpoint protection | CrowdStrike Falcon, SentinelOne, Microsoft Defender |
| Identity and access management | Okta, Microsoft Entra, Azure Active Directory |
| SIEM | Splunk, Microsoft Sentinel, Sumo Logic |
| Threat intelligence | VirusTotal, GreyNoise, AbuseIPDB |
| Collaboration | Slack, Microsoft Teams, Discord |
| Ticketing and incident response | Jira Software, PagerDuty, ServiceNow |
| Vulnerability management | Tenable, Nuclei, VulnCheck |
| Network security | Palo Alto Networks Firewall, Cisco Secure Firewall, Zeek |
Company Background
| Founded | 2024. |
|---|---|
| Operating entities | CyberForce, Inc. and CyberForce, LTD. |
| Recognition | Included in Gartner’s “Innovation Insight: AI SOC Agents” report (2025). |
Note: This overview is compiled from SOC Jedi.AI’s publicly available information as of 4 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.