Positive Technologies Automates Cyber Incident Investigations With MaxPatrol O2
The platform uses a cascade of AI models to relieve security operations center analysts of routine work.
Attackers are increasingly using artificial intelligence to breach corporate infrastructure. Algorithms allow them to launch attacks at greater scale, and human staff simply cannot keep up with every intrusion attempt. Defenders therefore need to use AI to counter attackers as well.
Two-Thirds of Incidents Resolved Automatically
Positive Technologies has shifted cyber incident processing to the MaxPatrol O2 cascade of AI models. The algorithms can automatically close up to 68% of incidents, taking no more than 15 to 20 seconds per case. In the most complex cases, security operations center (SOC) analysts receive the AI agent’s verdict, along with an explanation, in less than 15 minutes.
The system addresses one of the SOC’s fundamental challenges. When analysts handle incidents manually, they can process no more than 3,000 a day. As a result, up to 63% of incidents may go uninvestigated. MaxPatrol O2 takes over routine tasks, including analyzing security events and determining their disposition, thereby improving the SOC’s effectiveness.
How Does It Work?
“Each model in MaxPatrol O2 is designed to improve the accuracy of the entire cascade. Their roles are comparable to those of Tier 1 and Tier 2 SOC analysts. First, machine learning models assess each incident within seconds and automatically close false positives. Incidents that may indicate malicious activity are passed to an AI agent. It develops a hypothesis, checks it against events from multiple sources, then reaches a verdict and generates a report for the SOC analyst,” the developers explain.
The incident report contains all the information a specialist needs to make a final decision. Users can also specify which types of incidents require human involvement and which the system can handle fully autonomously.
Increasing Autonomy Is a Priority
The developers plan to make the system more autonomous, reducing the share of incidents that require manual analyst work to 10%. Notably, MaxPatrol O2 is already deployed in PT X, Positive Technologies’ cloud-based solution for monitoring and responding to cyber threats. In that environment, the system achieves 98% accuracy.
According to the developers, MaxPatrol O2 integrates easily with infrastructure products used to protect information systems, significantly expanding SOC capabilities.
Automated cyber incident investigation is relevant across industries. Demand is particularly strong in banking, manufacturing, telecommunications and logistics, as well as in other organizations with extensive IT infrastructure where attackers can easily hide among legitimate activity.
Responding to a Changing Threat Landscape
Positive Technologies has been developing AI-based cybersecurity capabilities for several years. In 2024, Positive Technologies published the findings of a major study examining how attackers could use artificial intelligence and how defenders could counter those tactics.
In 2025, Positive Technologies experts reported on how Russian companies were using the intelligent module MaxPatrol BAD. The system assembled incident context, visualized process and user behavior, and explained the sequence of events to help specialists investigate attacks. In effect, this module became the direct technological predecessor of MaxPatrol O2.
The new system’s launch responds to recent changes in the threat landscape. In June 2026, Positive Technologies reported that AI was being used in approximately 10% of intrusion attempts, twice the share recorded in 2024. These figures reinforce the point that automating incident investigations will soon become indispensable.
AI-powered defense systems are expected to continue advancing in the coming years, particularly in autonomy. Rather than simply detecting suspicious events, AI will also generate assessments, establish links between attackers’ actions and execute authorized response operations.
