Exabeam's Nova agent now runs its own follow-up searches during security incidents

The opening work on an incident is mostly fetching. Someone pulls the entity profiles, collects the surrounding context, then runs the follow-up search the first result suggested. Nova now does that part itself, while the incident is still unfolding, across the whole New-Scale platform ^[2]. Exabeam first introduced the agent in April 2025 ^[3].

Exabeam's pitch moves the analyst up a level. The company calls the destination the agentic security operations center, where agents take on much of the investigative legwork under an analyst's supervision ^[4]. Steve Wilson, its chief AI and product officer, said the future SOC will be defined "by how effectively people and AI agents work together" ^[5]. Teams that buy on that story picture an analyst reviewing finished investigations.

Here's what the one customer quoted in the launch coverage says users actually do. Eduardo Sulvarán Velázquez, subdirector of cyber risk management at Mexican payment processor E-Global, said the agent has helped analysts there prioritize cases ^[7]. AI can speed up investigations "without removing human judgment from the process," he said ^[8]. Prioritizing is sorting a queue. A case the agent ranks too low still sits in the queue for a person to open. The launch coverage does not include a price or any measured change in triage time ^[1].

Supervising an agent requires a record of what it did. For Claude Enterprise deployments, prompts, tool calls and actions now land on a single timeline. Exabeam runs event-time analysis and behavior-based correlation over that record to catch rogue agents and behavioral drift ^[9]. Praxen, the verification tool Exabeam open-sourced in June, now ties each finding and score more directly to its source material ^[11]. For Nova itself, the question to put to a demo is whether every secondary search shows up in the case with its query and its results.

The two product lines get different things. New-Scale cloud customers get an agent that investigates ^{[1] [2]}. LogRhythm's on-premises customers mostly get a view of their own staff's AI use. Collectors feed ChatGPT, Gemini and Copilot activity into LogRhythm Intelligence Analytics, and a community MCP server lets teams query that data with local models so sensitive data stays inside their environment ^[12].

For a Monday rollout, sort each agent task on two lines. The first is whether its output reorders the queue or closes a case. The second is whether it arrives with the evidence it used, in a form an analyst can check faster than redoing the search.

An agent that sorts the queue and shows its evidence is safe to switch on; track how often analysts re-rank its picks. E-Global's account sits in the sorting row ^[7]. Sorting without evidence is tolerable, because a mis-ranked case still gets opened, and the thing to track is low-ranked cases that turned out serious. Closing cases with evidence attached is the supervised model Exabeam describes ^[4], and there the figure to watch is the override rate. When the agent closes cases without showing its evidence, the analyst is approving work they cannot check, and that task should stay off.

A count of Nova searches per case measures how busy the agent is. To see value, track time from alert to a triage decision and the rate at which analysts reverse the agent.