7AI expands platform with Federated SIEM and AI workflow builder

7AI has announced two major platform capabilities: 7AI Federated SIEM, which lets security teams query, investigate, and act on data wherever it lives, including within 7AI, and 7AI Build, which lets enterprises and partners define agentic workflows, skills, and AI-native security services on top of the 7AI platform.

“Three out of five customers we have talked to in the past year tell us the same thing: they want to stop putting everything into the SIEM,” said Lior Div, CEO of 7AI. “When AI agents can query, investigate, and act on data where it lives, customers start pushing for a federated approach. Our approach is agnostic. We separate detection from storage, enable fully federated detection, and read from and act on data wherever it is stored, whether that is our data lake, in what a customer already uses, or a combination of both.”

“The same is true for how agents work,” Div continued. “An investigation using generic AI tooling can tell an analyst whether an alert looks suspicious in isolation. It cannot understand how that alert changes based on the customer’s users, assets, policies, applications, workflows, historical investigations and institutional knowledge. 7AI builds a context graph for each customer’s environment, connecting federated data access, enterprise insights and customer-defined skills so agents can reason against how the organization works. With 7AI Build, customers and partners can extend that context directly, so agents investigate, optimize detections, respond and hunt based on the customer’s reality, not a vendor’s default workflow.”

The announcement follows 7AI’s June launch of Threat Hunt, Threat Intel Hunt and Skills, which gave security teams the ability to direct agents proactively, turn threat intelligence into autonomous hunts, and teach agents new skills based on their own environments. One year into operating at enterprise scale, 7AI’s agents have run more than nine million investigations, returning more than one million analyst hours to customer security teams.

7AI Federated SIEM: Every customer defines their own SIEM transformation

Every enterprise is at a different point in its relationship with the SIEM. Some want to reduce what they send to it as consumption costs climb. Some want to keep it at the center of their operations. Others are ready to move past it. 7AI Federated SIEM works with all customers, no matter where they are on their journey.

The 7AI platform connects to security data where it already lives, across a customer’s existing SIEM, data lakes, and cloud platforms, and puts 7AI’s agents to work on top of the data, no matter where it resides. With fully federated search across either the customer’s or 7AI’s data lake, and detection abstracted from storage, every customer can define their own SIEM transformation, moving as much or as little data as they want, on their own timeline, without duplicating data.

7AI Build: The platform customers and partners extend

7AI Build opens the platform, enabling security teams and partners to create agentic workflows, custom skills, and complete AI-native security services. Teams can encode organizational context, tribal knowledge, and their own investigative techniques, extending the context graph that informs how agents investigate, optimize detections, respond, and hunt. Partners can build differentiated offerings on 7AI’s foundation rather than assembling AI capabilities from scratch. Every extension inherits the platform’s transparency, controls, and enterprise governance.

Three ways to build AI security on 7AI

With this announcement, the 7AI platform supports three models for AI-native security operations:

• Use the platform. Enterprises deploy 7AI directly across their security operations to investigate alerts, hunt for threats, optimize detections, manage response workflows, and give analysts a single place to direct agentic security work.
• Run with 7AI’s expertise. Through PLAID ELITE, customers combine 7AI’s autonomous agents with 7AI security experts who help operate, tune, and optimize the platform for their environment.
• Build on 7AI. With 7AI Build, customers and partners extend the platform with their own skills, workflows, services, and security offerings, using 7AI as the foundation for AI-native security operations.

“AI security platforms cannot be rigid,” said Yonatan Striem-Amit, CTO of 7AI. “Every enterprise has its own tools, policies, workflows, risk tolerances, and institutional knowledge. The platform must understand that context and let customers build on it. That is fundamentally different from traditional automation. 7AI gives organizations a foundation where agents can reason, act, learn from context, and be extended by the people who know the environments best.”