Intezer Forensic AI SOC

Intezer Labs Inc. is a security company whose contact page lists New York, NY as its office. It was founded by Itai Tevet, Roy Halevi and Alon Cohen, and is backed by Norwest, OpenView, Intel Capital and Samsung Next. It addresses the problem that many SOC and MDR teams never review a large share of their alerts.

Intezer Forensic AI SOC investigates every alert, including low-severity ones, by combining agentic AI with deterministic forensic tools such as endpoint and memory forensics, reverse engineering, network artifact analysis and sandboxing. It covers endpoint, identity, phishing, network, cloud and DLP alerts, closes false positives automatically and escalates real threats with recommended actions. Workflows add native automation and response without a separate SOAR. Over 150 enterprise customers and MSSPs use it.

• Forensic triage: Uses memory forensics, reverse engineering and sandboxing to reach verdicts.
• Broad alert coverage: Handles endpoint, identity, phishing, network, cloud and DLP alerts.
• Auto-remediation: Resolves false positives and remediates true positives with human approval.
• Workflows: Native automation triggered by verdicts, case events, schedules or webhooks.
• Expert access: On-demand Intezer analysts for complex incidents.
• Multi-tenancy: Supports MSSPs managing many client environments.

A Vietnamese MSSP can use the multi-tenant platform to triage EDR and phishing alerts for many SME clients. A manufacturer using Microsoft Defender can investigate every endpoint alert with memory forensics instead of trusting the EDR's mitigated status. A bank SOC can auto-close false positives from user-reported phishing.

The page states sub-minute triage across 100% of alerts, 98% verdict accuracy and fewer than 2% of alerts escalated to humans. Over 98% of false positives are closed automatically. Verdicts typically appear within the hour after connecting alert sources through API keys. Endpoint-based pricing keeps costs predictable as alert volumes grow.

Intezer's own 2026 report, based on over 25 million alerts, found that more than 60% of alerts are never reviewed and that some real incidents start from the lowest-severity alerts. This gap is driving demand for AI that can investigate every alert. Southeast Asian MSSPs and enterprises using CrowdStrike, SentinelOne or Microsoft Defender can add such coverage on top of existing tools.

Founders Itai Tevet (CEO), Roy Halevi (CTO) and Alon Cohen (Chairman). Investors include Norwest, OpenView, Intel Capital and Samsung Next. Reported 126% net revenue retention and over 25 million alerts processed in 2025. Named a Pioneer in the 2026 SACR AI SOC report.