Blueprints captures how your best analysts work and converts those methods into repeatable, automated workflows allowing your whole team to operate at scale without adding headcount

PALO ALTO, CA – March 24, 2026 — Anvilogic, the AI SOC platform, today announced the launch of Blueprints, a new workflow automation capability, at RSA 2026 (Booth 350-S, March 24–27). Blueprints transforms the expertise of seasoned analysts into repeatable, team-wide automation, embodying how your most experienced staff approach security operations.

Instead of requiring specialized engineers to build and maintain code, Blueprints lets analysts author automation in natural language, deploy it the same day, and have it execute to automate processes across data onboarding, detection engineering, threat hunting and investigation & response.

"Your best analyst, at infinite scale," said Mackenzie Kyle, Chief Product Officer at Anvilogic. "Blueprints captures how your most experienced analysts work and converts those methods into repeatable, automated workflows for your AI SOC. Your whole team operates at the top of their game, and gets smarter with every run."

What is Blueprints?

Blueprints is Anvilogic's AI automation layer, which allows analysts to create reusable, task-specific AI workflows with pre-configured instructions, context, integrations, and memory. Think of them as specialized AI agents for specific security domains — built by your senior analysts, run by your entire team.

Unlike traditional SOAR systems that operate on noisy alert streams, Blueprints run on our Enterprise Security Graph. We have built years of context in the platform to discover and model enterprise SOC artifacts—including events, alerts, normalizations, data models, rules, and workflows—mapping them directly to detection, investigation, and triage workflows. 

The Problem It Solves

Security operations teams often rely on their most experienced analysts to interpret alerts, apply investigative judgment, and coordinate the actions that follow. Over time, these analysts develop a deep understanding of how alerts should be triaged, what context matters, and which actions move an incident toward resolution. However, much of this expertise remains informal and captured in static runbooks, documentation, or individual experience that is difficult to apply consistently across a team.

Traditional SOAR platforms promised consistent orchestration and automation, but often introduced a new role: the SOAR engineer. Building and maintaining playbooks required Python scripting, schema wiring, and ongoing integration work, turning automation into a specialist discipline. Blueprints removes that barrier.

"When a new analyst joins your team, they shouldn't be learning your SOC's tribal knowledge," said Karthik Kannan, founder and CEO of Anvilogic. "They should inherit it. Blueprints encode what your senior people know and make it operational at scale. That's not replacing analysts. That's multiplying them."

How Blueprints Works

Analysts provide step-by-step instructions in plain language. Using a visual AI workspace with drag-and-drop workflow design, analysts define how the system should gather context, analyze information, and take action at each step. 

The platform translates those instructions into executable workflows powered by Anvilogic's domain-specific AI agents and our Enterprise Security Graph to assist in automating a process end to end, just like your experience analysts would.  

• Connect to existing security tools through third party integrations (Jira, ServiceNow, Slack, VirusTotal, and 100+ others)
• Invoke Anvilogic's purpose-built SOC agents as workflow steps
• Run Blueprints interactively with a human in the loop or fully automated on a schedule 

Three Ways Security Teams Use Blueprints Today

• Investigation: A senior analyst writes an investigation procedure once in natural language based on their experiences. Every analyst on the team can leverage that Blueprint to assist them through the investigative steps required to complete the analysis. 
• Automated Threat Hunting: Security teams schedule multi-step hunting workflows to run every morning. The system queries the environment, analyzes results, and delivers a hunting report without requiring analysts to manually initiate searches.
• Threat Intelligence Operationalization: Blueprints ingest new threat intelligence reports, extract relevant indicators or behaviors, generate detection logic, tune that logic, deploy those detections in test mode, and notify the team creating a continuous pipeline from intelligence to detection.

Customer Validation

Anvilogic is shifting to an AI-native SOC platform. This is achieved through our Enterprise Security Graph and AI automation architecture where every capability from threat hunting and incident response to compliance becomes a "Blueprint” that can automate a process within the SOC.  This architecture is already allowing security teams in telecom, enterprise SaaS, and critical infrastructure to use Blueprints to scale their operational workflows without increasing headcount.

Why This Matters Now

The best teams already know what works: they have senior analysts who've built expertise over years. What they don't have is a way to make that expertise scale without hiring 10 more equally experienced people. Blueprints solves that. Your workflows become as repeatable as your detections. Your processes become standardized without becoming rigid. Your team gets smarter not because the tools got smarter, but because the expertise gets distributed.

For teams evaluating automation tools right now, the question isn't "which platform has the most features." It's "which one will actually get used." The answer is the one where anyone can build it and it actually works on good data.

Availability

Blueprints will be available in early access beginning at RSA Conference 2026, with general availability planned for Spring. 

Existing customers: anvilogic.com/blueprints

New customers: anvilogic.com/demo

About Anvilogic

Anvilogic is an AI SOC platform for agentic data management, detection engineering, and investigation. By decoupling detection from storage, it unifies detection engineering, investigation, and response across SIEMs and data lakes—delivering unmatched architectural flexibility, lower SIEM costs, and AI agents that continuously scale security programs. With Blueprints, analysts encode their methods as repeatable workflows. This eliminates data silos, removes the SOAR complexity barrier, and enables teams to operationalize expertise at scale—all without rip-and-replace. Trusted by enterprise security teams across finance, tech, and healthcare. Learn more at www.anvilogic.com.

# # #

Media Contact:

David Libby

david.libby@anvilogic.com

415-518-6611