Pontera — Customer Success Report

1. Agentic SOC — Alert Triage & SOAR Orchestration

Description: End-to-end automated alert processing pipeline that ingests detections from CrowdStrike and Sumo Logic, deduplicates and correlates events into cases, enriches all observables, applies AI-powered response routing, and delivers analyst-ready summaries — without requiring manual first-pass triage.

Business problem solved: Security teams are overwhelmed by alert volume across multiple detection sources. This use case eliminates manual triage by automating the full journey from raw alert to enriched, deduplicated, AI-summarized case ready for analyst action.

Key integrations: CrowdStrike, Sumo Logic, Blink Case Management, OpenAI, Slack, Monday.com, AWS, Google Workspace, Cato Networks, Okta, Wiz

2. Case Management & Slack Synchronization

Description: Bi-directional synchronization layer between Blink case management and Slack. When a new case opens, a dedicated Slack channel is created and populated with an AI-generated briefing. As case fields evolve (status, severity, summary), Slack messages update in real time. Analyst replies in Slack feed back into the case. When cases close, Sumo Logic insights are updated accordingly.

Business problem solved: SOC analysts spend significant time context-switching between case management systems and communication tools. This use case makes Slack the single operational interface for incident response, eliminating manual status updates and keeping the entire team in sync automatically.

Key integrations: Slack, Blink Case Management, Sumo Logic, OpenAI

3. Alert Enrichment & IOC Analysis

Description: Comprehensive observable enrichment library covering IPs, URLs, domains, hashes, hostnames, and user identities across multiple threat intelligence and identity sources. Custom enrichment pipelines pull context specific to the organization's environment from Sumo Logic and CrowdStrike, augmenting standard threat feeds. Utility playbooks manage the lifecycle of observable-to-alert relationships within the case management system.

Business problem solved: Manual enrichment of each observable in an alert is the most time-consuming part of triage. This library provides automated, on-demand context for every observable type — so analysts begin investigation with full context rather than spending time gathering it from disparate tools.

Key integrations: AbuseIPDB, VirusTotal, URLScan, CrowdStrike, Okta, Google Workspace, Microsoft Entra ID, GitHub, Slack, Sumo Logic, Mitiga, Whois, Cato Networks, AWS, Blink Case Management

4. Phishing Detection & Email Triage

Description: Automated phishing response pipeline covering the full investigation lifecycle: monitors the security inbox for inbound mail, uses AI to classify intent and extract indicators, queries Perception Point for known phishing campaigns by subject and sender, investigates attachments, and updates the case with a verdict and recommended action.

Business problem solved: Phishing reports from users and security-inbox emails are high-volume and require rapid first-response to contain threats. This use case eliminates manual triage of email-based threats, enabling faster analyst focus on confirmed incidents.

Key integrations: Google Workspace, Gmail, OpenAI, Slack, Blink Case Management, Perception Point

5. DLP Triage & Investigation

Description: Automated investigation workflow triggered by Teramind DLP alerts. Cross-references the flagged activity against Google Workspace admin logs and Sumo Logic Cato network logs, applies AI reasoning to determine intent and risk level, and delivers a structured finding to Slack and the case record.

Business problem solved: DLP alerts for data exfiltration require correlation across email, network, and endpoint data — a manual process that takes analysts hours. This workflow automates the full correlation and delivers a contextualized verdict in minutes.

Key integrations: Teramind, Google Admin Console, Sumo Logic, OpenAI, Slack, Blink Case Management

6. Endpoint Hygiene & Compliance Scanning

Description: Automated endpoint security posture management combining scheduled policy compliance scans (CrowdStrike + Kandji) with real-time file integrity monitoring. Device inventory and compliance state are tracked across both macOS (Kandji) and Windows (CrowdStrike) endpoints; violations trigger investigation workflows. Remote script execution via CrowdStrike RTR and endpoint quarantine capabilities enable rapid containment.

Business problem solved: Maintaining continuous endpoint compliance visibility across a mixed-device fleet is operationally intensive. This use case automates daily scans, anomaly detection, and targeted remediation — reducing drift between security policy and endpoint state.

Key integrations: CrowdStrike, Kandji, OpenAI, Blink Case Management

7. Threat Intelligence Ingest & Curation

Description: Automated threat intelligence pipeline monitoring curated RSS sources — HaveIBeenPwned for credential breach data relevant to organizational domains, SocketSecurity for supply chain security signals, and community vulnerability research. Entries are assessed by AI for applicability, and relevant findings are delivered to the security team via Slack. A GitHub code search subflow supports IOC hunting across public repositories.

Business problem solved: Security teams struggle to keep pace with the volume of threat intelligence published daily. This use case provides a filtered, AI-curated signal feed ensuring relevant threats — especially credential breaches and supply chain risks — reach the team without manual monitoring.

Key integrations: RSS, HTTP, OpenAI, Slack, HaveIBeenPwned API, GitHub

8. Identity & Access Management

Description: IAM lifecycle automation covering employee onboarding triggered via HiBob HR webhooks, user deactivation, Teramind monitoring license removal triggered via Okta webhooks, and compliance reporting on identity coverage gaps — users missing Cato network agent coverage and Okta accounts deprovisioned for over 90 days without cleanup.

Business problem solved: Identity hygiene — ensuring timely onboarding, timely deprovisioning, monitoring tool coverage, and stale account detection — is frequently deferred due to operational burden. This use case automates onboarding directly from the HR system alongside detection and reporting of IAM coverage gaps, reducing unauthorized access risk via orphaned accounts and delayed provisioning.

Key integrations: HiBob, Okta, Teramind, Cato Networks, Gmail, Google Workspace

9. Security Operations Reporting

Description: AI-powered reporting layer that monitors Blink automation health and delivers structured error reports to the security lead via Slack. A separate incident post-mortem workflow fetches relevant incident data from external sources, applies AI summarization, and posts a digestible briefing to the team.

Business problem solved: Security leads need continuous visibility into automation health and incident learnings without reading raw logs. This use case provides proactive, AI-generated summaries that keep the state of the security program immediately legible.

Key integrations: OpenAI, Slack, HTTP

10. Security Pack & Tooling Lifecycle

Description: Automated lifecycle management for the Claude AI security pack deployed via Kandji. Monitors the GitHub repository for new releases on a daily schedule, compares configuration deltas against current Sumo Logic match lists and Kandji state, applies updates, and distributes AI-generated release notes to the appropriate Slack channel by deployment ring.

Business problem solved: Keeping AI-assisted detection packs current typically requires manual tracking of releases and error-prone configuration updates. This use case automates the full update lifecycle, ensuring the latest detections are consistently deployed without analyst involvement.

Key integrations: GitHub, Kandji, Sumo Logic, OpenAI, HTTP

11. Cloud Security Posture Management (Wiz)

Description: Real-time cloud posture monitoring via Wiz webhook events. When Wiz flags a posture issue involving exposed secrets, the workflow queries Wiz for full issue context and secret instance details, then delivers a structured alert to the security team's Slack channel.

Business problem solved: Cloud misconfigurations and exposed secrets can go unnoticed without continuous posture monitoring. This workflow streams Wiz posture findings directly into the security team's existing Slack-based response process, ensuring secret exposure issues are surfaced immediately rather than discovered during periodic reviews.

Key integrations: Wiz, Slack, OpenAI

12. Cloud Infrastructure Investigation & Remediation

Description: On-demand AI-agent tooling for AWS environments — enabling arbitrary AWS CLI script execution and EC2 instance inventory lookups, plus a dedicated S3 bucket security analysis subflow that runs a purpose-built "Cloud Analyst" agent and reports findings to Slack.

Business problem solved: Cloud investigations traditionally require an analyst to manually run AWS CLI commands or console queries across accounts. This capability lets an AI agent execute cloud investigation and remediation actions directly, sharply reducing the time from suspicion to answer during cloud-related security investigations — already the single highest-volume automation in the environment.

Key integrations: AWS, Slack, Sumo Logic

13. Vulnerability Management — SCA Critical Ticketing

Description: AI-powered triage of software composition analysis (SCA) findings. The workflow evaluates flagged dependency nodes for criticality using OpenAI, then loops through qualifying findings to create tracking tickets for remediation.

Business problem solved: SCA scan output is often voluminous and undifferentiated, burying critical vulnerabilities among low-priority findings. This workflow applies AI-based criticality assessment and automates ticket creation for the findings that matter most. A companion set of playbooks tracks AUTOMATIC_FIX tickets through to their linked pull requests and notifies the team in Slack once an automated fix agent completes, closing the loop from finding to remediated code.

Key integrations: OpenAI, Jira, GitHub, Slack

14. Agentic SOC — Interactive Case Assistant (Slack)

Description: A conversational, Slack-embedded AI assistant that lets analysts ask ad-hoc questions during an investigation, receive AI-recommended case-closure guidance, and communicate directly with affected end users — all without leaving Slack. A dedicated "User Communications Agent" drafts and sends user-facing messages, while supporting query tooling pulls context from Sumo Logic and Snowflake on demand via Slack slash commands.

Business problem solved: Mid-investigation questions and end-user communications typically require analysts to switch tools or manually track down data. This use case embeds AI-driven Q&A, case-closure recommendations, and user outreach directly into Slack's interactive components (buttons, forms, slash commands), keeping analysts in a single interface from question to resolution.

Key integrations: Slack, OpenAI, Sumo Logic, Snowflake, Blink Case Management

15. Database & Network Infrastructure Health Monitoring

Description: Snowflake-powered operational health monitoring covering database locking behavior and proxy performance. A high-frequency real-time check flags locking/blocking anomalies as they occur, a daily job summarizes lock activity against a refreshed baseline, and a separate daily report scores proxy health — all delivered as structured Slack alerts.

Business problem solved: Database lock contention and proxy degradation can silently erode application performance until they cause an outage. This use case gives the team continuous, automated visibility into infrastructure health via near-real-time and daily Snowflake-driven checks, surfacing anomalies in Slack before they escalate.

Key integrations: Snowflake, Slack

16. Financial Order Monitoring & Account Lookup

Description: Order-processing oversight combining a scheduled digest of recent orders with an AI-driven order analysis agent that reviews order data on demand and reports findings to Slack, backed by a direct account lookup tool against the production database.

Business problem solved: Reviewing order activity and looking up account details for investigation typically requires direct database access and manual cross-referencing. This use case automates recurring order reporting and gives the team an AI-assisted, Slack-native way to analyze order data and pull account context on demand.

Key integrations: MySQL, Slack, OpenAI

17. WAF IP Blocking & Auto-Unblock

Description: On-demand and scheduled IP blocklist management for the web application firewall, backed by a Blink table tracking currently blocked IPs. Analysts can block or unblock a specific IP on demand or list the current blocklist, while a daily scheduled job automatically expires and unblocks IPs once their block window elapses.

Business problem solved: Manually tracking which IPs are blocked in the WAF and remembering to lift temporary blocks is error-prone, leading to either lingering unnecessary blocks or missed containment. This use case gives analysts a simple on-demand block/unblock/list interface while a scheduled job guarantees blocks expire automatically.

Key integrations: AWS, Blink Tables

18. AI Prompt Offence Investigation (Cato)

Description: Investigation pipeline for AI-app prompt policy violations ("offences") surfaced by Cato Networks. A dedicated "Cato Prompt Analyist" AI agent evaluates the flagged prompt and session, invoked either directly from the webhook-driven analysis flow or on demand — including a bulk mode that pulls existing cases and re-analyzes their AI prompt offences.

Business problem solved: As employees increasingly use AI tools, Cato's network visibility flags risky prompts (e.g., potential data exfiltration or policy violations), but assessing whether each flagged prompt is actually risky still required manual review. This use case automates that assessment with an AI agent and supports both real-time and retroactive bulk investigation.

Key integrations: Cato Networks, Blink Case Management, HTTP

19. Holdings Data Import & OFX Generation

Description: Slack-driven pipeline that converts uploaded holdings statement screenshots into structured data. A router listens for mentions in a dedicated ops channel and offers a menu of import purposes; when holdings import is selected, the uploaded image is passed to an AI vision model to extract holdings data, an analyst reviews and edits the extracted data through interactive Slack forms, and the confirmed data is compiled into an OFX file for downstream import.

Business problem solved: Manually transcribing customer holdings data from statement screenshots into a structured, importable format is slow and error-prone. This use case automates extraction with AI vision, keeps a human in the loop for verification via Slack, and outputs a ready-to-import OFX file — reducing a manual data-entry task to a guided review.

Key integrations: Slack, OpenAI

Strengths

Mature agentic SOC pipeline. The alert triage flow — CrowdStrike and Sumo Logic ingestion → case deduplication → observable enrichment → AI summary → Slack delivery — is fully automated end-to-end. With 679 CrowdStrike detections and 442 process-alert executions over 12 months, this is the highest-volume and highest-value use case in the environment.

Slack-native SOC operations. With 1,532 incoming Slack interactions and 1,440 case-update syncs handled automatically, the team has made Slack the primary incident response interface — eliminating context-switching between the case management system and communication tools for routine operations.

AI deeply embedded across the security program. OpenAI is used not only for case summarization but also for phishing classification, DLP intent analysis, threat intel filtering, endpoint IDE investigation, case escalation briefings, and incident post-mortems. This indicates a sophisticated, AI-augmented security posture that goes well beyond basic automation.

Rich, custom enrichment library. Fifteen-plus enrichment playbooks cover every major observable type. The custom Pontera-specific enrichers (username/email via Sumo Logic, hostname via CrowdStrike) are actively running, demonstrating mature platform customization beyond out-of-the-box capabilities.

Proactive threat intelligence consumption. Automated monitoring of HaveIBeenPwned for breach data on organizational domains, combined with supply chain security RSS feeds (SocketSecurity) and community vulnerability research, provides a curated, AI-filtered intelligence stream without manual analyst monitoring.

Unique AI tooling automation. The Claude Security Pack Updater is a particularly sophisticated workflow — automating the lifecycle of an AI-powered security detection pack (release detection, config comparison, deployment, release notes) in a way that is rare among Blink customers.

Emerging agentic cloud security capability. New AI-agent tooling now enables autonomous AWS CLI execution and EC2/S3 investigation via a purpose-built "Cloud Analyst" agent — the AWS CLI tool alone has already executed 2,321 times, making it the single highest-volume automation in the environment. Combined with new Wiz-based posture alerting for exposed secrets, this marks the environment's expansion from pure SOC/EDR automation into cloud security posture management.

Multi-agent forensics network now operational. A new "Agent 2 Agent" tier lets the primary case-handling agent delegate forensics questions to vendor-specialized analyst agents — AWS, Google Workspace, Cato Networks, Sumo Logic, Okta, and Wiz — with 1,463 combined consultations in the last 12 months. Paired with a new direct-query layer (Okta log search at 2,307 executions, Cato Networks queries at 750, Wiz GraphQL queries at 580), this significantly deepens the platform's autonomous investigation depth across identity, network, and cloud domains.

New conversational Slack assistant for live investigations. A "SOC AI" tier now lets analysts ask ad-hoc questions and close cases directly from Slack (58 AI-recommended case closures, 19 ad-hoc Q&A sessions), backed by a dedicated user-communications agent for direct end-user outreach — extending the platform's AI footprint from background automation into a live, conversational analyst interface.

AI-driven case investigation now a high-volume core process. The new Main - Investigation playbook — which queries the case management system, evaluates conditions, pulls timeline events, and hands off to a "Post Investigation Triage Agent" before updating the case — has already run 324 times, and a new Sumologic WAF Alert flow adds a dedicated network forensics agent for WAF-triggered alerts (111 executions). Together these deepen the automated investigation layer introduced alongside the multi-agent forensics network.

Expansion into infrastructure health and business operations monitoring. Beyond security, Blink now automates database lock/block anomaly detection (3,839 real-time checks plus a daily summary) and proxy health scoring via Snowflake, alongside order-digest and account-lookup tooling for financial operations — signaling that the platform is being adopted as a general automation layer for the business, not solely for the SOC.

New network-layer containment capability. IP blocking and auto-unblocking in the WAF (27 combined on-demand executions plus 20 scheduled auto-unblock cycles) closes the gap between WAF alert investigation (Sumologic WAF Alert) and actual containment action, with a scheduled job guaranteeing temporary blocks expire automatically.

Emerging AI-usage governance. A new Cato-integrated pipeline (74 combined executions) evaluates AI-app prompts flagged as policy offences via a dedicated "Cato Prompt Analyist" agent, extending the platform's oversight from network and endpoint threats into GenAI usage risk.

Financial operations digitization via AI vision. The new Holdings Import pipeline (26 combined executions) uses AI vision to extract customer holdings data from uploaded screenshots, routes it through a Slack-based human review loop, and generates ready-to-import OFX files — automating a previously manual, error-prone data-entry process.

Gaps & Opportunities

Offboarding half of IAM lifecycle still dormant. The user deactivation, Cato coverage, and Okta deprovisioning playbooks all show 0 executions. Onboarding is now active — the new HiBob-triggered onboarding and sync playbooks run 11 and 1,049 times respectively — but the offboarding and coverage-reporting side of the tooling remains built but not yet operationally active. Wiring deactivation and deprovisioning to the same HiBob trigger is the most immediately addressable gap given the existing infrastructure.

Enrichment library underutilized. The general enrichment playbooks (IP/URL/hash enrichment via VirusTotal, AbuseIPDB, URLScan) all show 0 executions. This suggests the main triage pipeline currently routes through only the Pontera-specific enrichers, with the broader threat intel lookups not yet wired into the automated flow.

EDR containment not yet activated. CrowdStrike RTR (batch and single host) and endpoint quarantine playbooks exist but show 0 executions. Connecting these to the alert triage pipeline as automated response actions — triggered on confirmed high-severity detections — would complete the containment loop without analyst involvement.

Phishing email investigation incomplete. Init Email Investigation, Investigate Email - Search, and Investigate Email - Sandbox File all have 0 executions while the ingestion playbook runs 85 times per year. The new Agent Ability - Google List Gmail Messages tool (70 executions) now provides active mailbox search for investigations, partially closing this gap — but sandbox file analysis remains unused.

Vulnerability management coverage is just beginning. The new SCA Critical Ticketing workflow (20 executions) introduces AI-triaged, ticketed remediation for software composition analysis findings — a first step into vulnerability management. Broader coverage (CVE lookup, vulnerability scanner integration, patch lifecycle automation) is still missing, and given daily endpoint compliance scanning is already in place, there is a natural expansion path into fuller vulnerability prioritization.

Integration Ecosystem

The environment spans 20+ integrated platforms: CrowdStrike, Sumo Logic, Okta, Google Workspace / Gmail, Microsoft Entra ID, Slack, OpenAI, Teramind, Mitiga, Kandji, Cato Networks, Perception Point, VirusTotal, AbuseIPDB, URLScan, GitHub, HaveIBeenPwned, Monday.com, Wiz, AWS, HiBob, Snowflake, Jira, and MySQL.

This is a broad, mature integration footprint — signaling a security team that has actively unified disparate tools under automated orchestration rather than operating them in silos. The presence of Mitiga (cloud incident response), Teramind (DLP / insider threat), and Perception Point (email security) alongside the core CrowdStrike / Sumo Logic stack indicates a layered detection approach across endpoint, cloud, and human-layer threat vectors.