Tanium relaunches its SecOps product to rank endpoints that act out of character
Tanium relaunched Tanium Security Operations around Endpoint Drift, a detector that ranks endpoints acting out of character against their own learned baseline. The bet is that AI-assisted intruders will log in with stolen credentials and run IT's own admin tools, which a list of known-bad files will not catch.
The Watch · Security desk
What happened
- Tanium's new Insights Engine replaces its process injection detection with an engine built to catch attackers hiding inside trusted processes.
- A Federated SOC model lets separate security teams share one platform, each setting its own suppressions and automatic reactions that never land on another team's endpoints.
- Tanium Atlas answers plain-language questions from every endpoint in seconds, according to Tanium, and recommends whether to dismiss, escalate, hunt or contain each alert.
- Tanium says its HuntIQ hunters, who work inside customer environments, built a hunt for the FalconFlank zero-day before any patch or CVE existed.
Why it matters
- decision Teams weighing Endpoint Drift will have to measure its ranking on their own fleet, admin hosts included, because Tanium has published no detection or false-positive rates to compare against.
- exposure Actions that can run across the whole fleet at once mean one bad automated rule could stop processes or isolate hosts everywhere; per-team suppressions are the main control Tanium describes.
- constraint Existing customers' tuning built around the retired process injection detection has to be rechecked, since Insights Engine replaces that detection.
- cost Positioned beside SIEM and EDR, the product adds another set of detections to tune and alerts to triage on top of tools teams already pay for.
Tanium's case rests on data it already holds. Security Operations runs on the same platform and real-time data that IT teams use to manage their endpoints [2]. "The next breach won't look like malware. It will look like one of your own administrators," said Harman Kaur, Tanium's chief technology officer [15]. Kaur also said: "We have spent years learning what normal looks like on every endpoint our customers run. Now we use that to catch what doesn't belong and stop it everywhere at once." [17]
The product sits alongside the SIEM and EDR tools a team already owns [3]. Endpoint Drift gives hunters an order in which to look [4]. An analyst still decides what an out-of-character machine means. That decision is hardest on the hosts administrators work from, because their normal already includes the admin tools Tanium expects intruders to run with stolen credentials [13].
Response runs on the endpoint itself. The actions range from halting one process or gathering forensic evidence up to isolating a host, and they can target a single machine or every endpoint in the fleet simultaneously [6]. The release puts the limit on people. "People set the guardrails, and every automated action stays inside them," it says [8].
The only voice in the account from outside Tanium is Dave Gruber, chief analyst at Omdia. "Agentic capabilities can speed detection and response, but without access to near real-time telemetry and response, agentic SOC capabilities still lag attacker activities," Gruber said [10]. Grounding detection and hunting in real-time endpoint state, in Gruber's words, "addresses one of the most persistent gaps in enterprise SOC architectures." [11]
Everything else in the account is Tanium describing its own product. It includes no incident data behind the premise, no detection or false-positive rates, no pricing, and nothing on FalconFlank beyond Tanium's own claim about it [12].
What to watch
- Independent test results or customer data on Endpoint Drift's false-positive rate on administrator workstations and jump hosts.
- Whether suppressions and tuning written for Tanium's old process injection detection carry over to Insights Engine.
- Public technical detail on FalconFlank: the affected product, the dates, and whether Tanium's hunt found it in a live environment.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence25
- Adoption
- Insufficient
- Hype gap+45
- Incentives75
- Confidence30
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Tanium has relaunched Tanium Security Operations to address AI-assisted attacks in which adversaries use legitimate administrative tools to blend into normal activity and spread across endpoints.
- [2]
Tanium Security Operations runs on the same platform and real-time data IT teams already use to manage every endpoint.
- [3]
Tanium says Tanium Security Operations works alongside the SIEM and EDR tools teams already own.
- [4]
New Endpoint Drift learns how each endpoint normally behaves and ranks the machines acting out of character, so hunters start where it matters.
- [5]
New Insights Engine replaces Tanium's process injection detection with an engine built to catch attackers hiding inside trusted processes.
- [6]
Tanium runs a range of responses directly on the endpoint, from stopping a single process or collecting forensic evidence to isolating a host, on one machine or across the whole fleet at once.
- [7]
A new Federated SOC model lets separate security teams share one platform while each sets its own suppressions and automatic reactions, so one team's rules never land on another team's endpoints.
- [8]
"People set the guardrails, and every automated action stays inside them."
- [9]
With Tanium Atlas, an analyst asks a question in plain language, gets an answer from every endpoint in seconds and acts on it in the same place; Atlas also ranks the alert queue and recommends whether to dismiss, escalate, hunt, or contain each alert.
- [10]
"Agentic capabilities can speed detection and response, but without access to near real-time telemetry and response, agentic SOC capabilities still lag attacker activities," said Dave Gruber, chief analyst at Omdia.
- [11]
"Tanium's approach of grounding detection and hunting in real-time endpoint state addresses one of the most persistent gaps in enterprise SOC architectures," said Dave Gruber, chief analyst at Omdia.
- [12]
The Help Net Security account of the relaunch includes no incident data supporting the premise, no detection or false-positive rates, no pricing, and no detail on the FalconFlank zero-day beyond Tanium's claim; the only non-Tanium voice in it is Omdia's Dave Gruber.
- [13]
Tanium says that with AI, attackers no longer need malware a scanner can catch; they sign in with stolen credentials and run the same administrative tools IT uses every day, and to a security tool hunting for known-bad files that activity looks like a normal workday.
- [14]
Tanium says catching that behavior means knowing what normal looks like on every endpoint and acting on all of them the moment something drifts.
- [15]
"The next breach won't look like malware. It will look like one of your own administrators," said Harman Kaur, chief technology officer at Tanium.
- [16]
Tanium HuntIQ pairs Tanium threat hunters with the platform; the hunters work directly in customer environments and, Tanium says, can build a hunt before a patch or CVE exists, as they did for the FalconFlank zero-day.
- [17]
"We have spent years learning what normal looks like on every endpoint our customers run. Now we use that to catch what doesn't belong and stop it everywhere at once," said Harman Kaur.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- helpnetsecurity.comTanium adds endpoint behavior detection and AI-assisted threat hunting
1 article · October 7, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Security Operations CenterFollow
- Threat huntingFollow
- Endpoint Detection and ResponseFollow
- Living-off-the-land attacksFollow