Command Zero Throughline — Living SOC Investigations

Command Zero previewed Throughline (July 23, 2026), a capability that continuously merges related alerts into a single evolving investigation, re-reasoning the full case (using prior investigations, analyst notes, policies, and asset inventory) each time new evidence arrives rather than filing point-in-time reports; early testing showed up to 41% fewer distinct verdicts analysts had to review.

Addresses a core agentic-SOC gap — most AI SOC tools still investigate alerts as isolated snapshots — by keeping investigations 'alive' across multi-day attack campaigns that evade point-in-time correlation.

SOC teams evaluating agentic investigation platforms ahead of Black Hat USA 2026; relevant to MSSPs and enterprises building on Command Zero's API/MCP server.