eSentire's Claude agents run 120,000+ security investigations a year; experts agree 90%+ of the time

eSentire's Atlas platform uses Claude agents to investigate threats across endpoint, identity, network and cloud data. Senior analysts review every critical finding and sample the agent's verdicts.

Organization: eSentire
Industry: Cybersecurity (managed detection and response)
When: 2026
Evidence: Vendor case study
Agents and tools: Claude Opus 4.6 Amazon Bedrock Claude Agent SDK eSentire Atlas

Reported outcome

Over 120,000 autonomous investigations in 12 months, 6-minute average investigation, and above 90% alignment with top SOC experts on a sampled review.

120,000+ (company)
Investigations in 12 months
6 minutes (company)
Average investigation
Above 90% (company)
Alignment with senior experts
44 average (company)
Tool calls per investigation

Caveats

Published by the company that sells the agent. Treat numbers as marketing until confirmed elsewhere.

The page is a vendor case study. We found no independent audit of the figures.
'Alignment' is defined by eSentire's own review of a sample of cases. The page does not say how the sample was chosen.
The '468,000 hours of expert effort' figure is an estimate built on an assumed time per tool call, not a measured number.
Senior analysts still review critical findings, so this is not fully autonomous. The page gives no error rate for wrong verdicts.

What the agent does

A multi-agent system investigates security alerts on its own. For each case it queries threat intelligence, correlates endpoint and SIEM data, checks identity activity, and rebuilds what the attacker did. The company says an average case uses 44 tool calls. Senior analysts review and act on every critical finding.

Why this works

Security triage is high volume and repetitive, with a clear question at the end: was this a real compromise, how bad, what next? Senior experts can check the agent's answer against their own on a sample. That gives eSentire a running quality number, not a one-time demo score.

What to copy

Measure the agent against your best people on real cases, and keep measuring in production.
Keep a human on critical findings.
Define what "agreement" means (verdict, severity, response) before you report it.

Starter prompt

Written by us, not by eSentire.

You are a security analyst assistant. Investigate this alert.

Alert: {alert_json}
Related endpoint events: {endpoint_events}
Related sign-in events: {identity_events}

Return:
1. Verdict: COMPROMISE, BENIGN, or NEEDS_HUMAN
2. Severity: low, medium, high
3. The evidence for the verdict, as a list of specific events
4. Recommended response
Choose NEEDS_HUMAN if the data is missing or conflicting.