What was done
Victrix, a Quebec IT and managed security firm, runs a SOC for more than 100 Canadian customers and over 450,000 endpoints. After winning 45 new public-sector customers, it replaced a SOAR tool its analysts avoided with Swimlane Turbine, an agentic automation platform hosted in a Canadian tenant. The AI analyzes alerts, pulls in context and proposes a conclusion that an analyst approves or rejects. Analysts also build new playbooks by describing them in plain language, and one playbook covers Microsoft Defender, CrowdStrike and SentinelOne.
Outcome
Swimlane's case study says Victrix rebuilt a year of SOAR work in three weeks, saw every AI recommendation match the analyst's own conclusion so far, and plans to move half its analysts from L1 to L2/L3 work within six months and to let the AI auto-resolve proven case types later. Figures are vendor-reported. The case study shows no visible publication date; the page metadata says August 7, 2026.
Evidence: Vendor case study (customer quote). Figures are as reported by the source and have not been independently audited by AgentsNorth.
Prompt Reconstructed by AgentsNorth
The source didn't publish its prompt. This is our reconstruction of a starting prompt for a similar workflow, not the company's actual prompt.
You are a tier-1 SOC triage assistant for a managed security provider. For this EDR alert, gather the host, user, process tree and recent related alerts, then explain in plain language what happened. Give a verdict (likely benign, suspicious or likely malicious) with your confidence and the evidence for it, and propose the response playbook step. Do not run any response action; the analyst approves or rejects your recommendation.