Intezer has announced Workflows, a native automation and response builder that enables security teams to create and customize response workflows directly within the Intezer platform.

The capability brings response automation into the same environment where alerts are triaged and investigated. According to Intezer, this allows organizations to automate post-investigation actions without maintaining a separate Security Orchestration, Automation, and Response (SOAR) system.

Security teams may currently rely on standalone SOAR platforms, custom integrations or manual processes after reaching a verdict on an alert. Workflows is designed to close that gap by allowing actions such as closing alerts, isolating hosts, updating tickets, notifying analysts and other remediation steps to run with the investigation context already available.

“As attackers scale with AI, security teams need security operations that can operate at machine scale,” said Itai Tevet, CEO and co-founder of Intezer. “By combining forensic-depth investigation with custom, automated response, teams can execute remediation and close the loop faster.”

Intezer Workflows allows teams to build response logic directly within the AI SOC without maintaining a separate SOAR. The company said workflows can trigger actions across the security stack based on investigation outcomes without additional API glue or polling.

Users can also create workflows using natural language through Intezer’s MCP. Generated workflows can then be reviewed, refined, tested and activated within the platform.

The workflows carry evidence, data and organizational context gathered during an investigation into the response process. Actions are reflected in the relevant alert or case and each workflow run is logged for audit and troubleshooting.

Intezer said Workflows can also help managed security service providers automate customer communications and per-tenant routing that might otherwise require manual processes.

The company’s AI SOC Report 2026 found that nearly 1% of real incidents were traced to alerts classified at the lowest severity levels. Intezer said an enterprise generating 450,000 alerts annually could have roughly 54 real threats per year, or about one per week, that could go uninvestigated. The company said the findings demonstrate the importance of full-alert coverage and forensic-depth investigation.

Workflows is currently available in early access to selected Intezer customers. General availability is planned for later this quarter and Intezer’s customer success team will assist with migrating existing SOAR playbooks.