Securonix launches ABA to flag abnormal behaviour from enterprise AI agents

Security vendor Securonix has announced Securonix Advanced Behavioral Analytics, or ABA, a capability that helps security teams identify behaviour that is technically permitted but operationally abnormal, AI Magazine reported on October 14. The backdrop is a specific gap: traditional SIEM platforms were built to collect and correlate human and machine activity before enterprise AI agents became part of the attack surface.

The technical core of ABA is Agent and Entity Behavior Analytics, or AEBA. It identifies when an enterprise AI agent uses an unexpected tool, accesses data outside its purpose, or changes its operating pattern, then connects those changes with identity, authority, data use, asset sensitivity, timing and threat context so analysts can understand what changed, why it matters and what to do next.

The approach targets a new class of risk. Securonix chief executive Toby Weiss told AI Magazine that compromised AI agents can appear legitimate because they operate with valid credentials, which is why human oversight acts as a circuit breaker for high-impact response actions: detection can flag abnormal behaviour, but before access is removed or a critical process halted, a person must assess the activity, its context and the potential business impact.

Structurally, ABA combines AEBA with User and Entity Behavior Analytics, or UEBA, correlating signals across systems and time to surface compromised identities, unusual access, privilege misuse, sensitive data exposure and abnormal agent activity, and it extends behavioural baselines and risk detection across full databases from cloud environments to AI agents. An expanding catalogue of AI-threat policies covers established techniques such as compressed reconnaissance, exploit development, privilege escalation and data movement.

Automation is handled by Sam, which Securonix describes as an AI SOC Analyst that carries out repeatable Tier 1 and Tier 2 work across triage, investigation, evidence collection and case creation. Consequential response actions, however, remain subject to human approval and audit records.

The article also cites findings from Securonix's report, The Evolution of Cybersecurity Automation: Towards the AI-Governed SOC. It says 96% of respondents reported that cybersecurity automation is important to their organisation, 49% said they use AI in behavioural analytics with human approval, and 99.6% said their organisation increased its budget for AI in cybersecurity automation over the past year. The full report and methodology are set for public release in November 2026.

Worth noting on context, Securonix says its platform was built from the ground up on AWS and Snowflake, and that Sam was announced in collaboration with AWS, which ties those partnerships directly to this announcement.

Why it matters: once enterprises let agents hold credentials, call tools and reach into data, the attack surface expands from accounts to behaviour. Products such as ABA move detection logic from identity toward behavioural baselines, a sign that security vendors now treat AI agents as operational actors that need continuous monitoring rather than one-off technical integrations.