Simbian touts AI SOC growth as automation race intensifies

Simbian reports a 15-fold increase in its customer base over the past 12 months, positioning its AI-based security operations platform as an alternative to the rules-driven automation tools used in many security operations centres.

Based in Mountain View, California, Simbian says its AI SOC platform processed more than 1 million security incidents in the past year. It argues that automation is becoming more urgent as organisations face a rising volume of alerts alongside AI-enabled attacks.

Security teams often rely on security orchestration, automation and response (SOAR) systems. These products typically depend on rules and playbooks that teams must build and maintain, and many organisations struggle to keep them aligned with changes in tooling and attacker behaviour. Simbian estimates that such approaches achieve 25% automation or less.

Rules and reasoning

Simbian says its approach replaces rules with what it describes as reasoning. Its product uses AI agents designed to act like virtual security analysts, handling tasks such as triage, investigation and remediation. Simbian claims the agents can address up to 90% of alerts without human involvement.

The platform includes a proprietary architecture called TrustedLLM and a data layer it calls the Simbian Context Lake. Simbian says these components let the agents account for a customer's environment and operating procedures, and that the same model can handle both known threats and new attack patterns.

The update comes as security teams assess how generative AI is reshaping both offence and defence. Many organisations already use some automation in incident response and threat detection, and vendors across the market are pitching agent-based approaches aimed at reducing alert backlogs and speeding up response.

Simbian did not disclose customer names, revenue, or headcount. It says its recent progress puts it at the top of the AI SOC market by annual recurring revenue.

"I am excited by the success and momentum in 2025 that took Simbian to #1 in AI SOC ARR," said Ambuj Kumar, Simbian's co-founder and CEO.

Kumar linked the company's product direction to attacker use of AI and to changes in how security teams operate. He said Simbian is expanding the number of autonomous agents it offers.

"This reflects a fundamental transformation in the role of security professionals and the threat landscape. In 2025, we saw the first wave of AI-armed adversaries. In 2026, we are responding by expanding our family of autonomous agents that work at machine speed. Our mission is to provide every organization with the superintelligence required to stay ahead of sophisticated, automated attacks," said Kumar.

Partners and channels

Alongside its growth claims, Simbian highlighted product launches and commercial agreements over the past year. It cited the launch of an AI Threat Hunt Agent and an integration with the Microsoft Sentinel data lake. Simbian says the integration targets Microsoft 365 customers and supports validating threat-hunting hypotheses at scale.

It also pointed to a distribution agreement with SB C&S, part of SoftBank. Simbian says the deal focuses on Japan and ties demand for security services to local skills shortages.

Simbian says it has worked with service providers Wipro and NuSummit Cybersecurity on managed detection and response (MDR) offerings that incorporate its software. MDR services are a common route for organisations that lack internal security staff, and agent-based tools are one way providers can manage growing alert volumes.

On marketing and positioning, Simbian says it hosted what it calls the industry's first "AI SOC Championship". It says more than 100 professionals took part, and that the event measured human-and-AI collaboration as 2.3 times faster than manual efforts alone.

It also says it released a benchmark for measuring large language model performance in a security operations centre context. Simbian frames this as a way to evaluate security-focused AI as buyers and regulators increasingly seek clarity on model behaviour and testing methods.

Integration footprint

Simbian says its platform now supports more than 80 native integrations, including connections to CrowdStrike, Wiz and Palo Alto Networks. Integration breadth has become a key buying criterion for SOC tools because customers need products that can pull telemetry from multiple sources and trigger actions across ticketing, endpoint, identity and cloud systems.

Simbian says it plans to expand its range of autonomous agents during 2026 as it competes for security operations budgets and channel partnerships.