Security teams are drowning in alerts, not because they lack tools, but because those tools still rely too heavily on human effort to connect the dots.
Stellar Cyber’s 6.3 release is aimed at that exact problem. The update focuses on using agentic AI to reduce manual investigation work and help SOC teams move from alert handling to real response, faster and with less friction.
An operational approach to “Agentic AI”
The term “agentic AI” is getting used loosely across the industry. In many platforms, it amounts to better enrichment or smarter dashboards. Stellar Cyber is taking a more operational approach by embedding agents directly into investigation and response workflows.
Subo Guha, Senior Vice President of Product Management for Stellar Cyber, told MSSP Alert, “We’ve had an AI agent as part of our platform for two years, well ahead of the current buzzword trend. In 6.3, Stellar Cyber’s agents can autonomously analyze alerts, correlate signals across NDR and ITDR, generate case summaries, prioritize risk, and trigger predefined response actions such as alert triage and phishing analysis.”
At the same time, automation does not remove human control. “Humans remain in control for policy definition, response approval where required, and higher-risk actions, ensuring automation accelerates decisions without removing analyst judgment,” Guha said. The result is a SOC that moves faster without taking decisions out of human hands.
A direct impact on response times
One of the clearest benefits of 6.3 shows up on day one. Analysts are no longer greeted by long queues of raw alerts that require manual review and correlation.
“On day one, analysts see fewer alerts requiring manual review due to automated triage and AI-generated case summaries that explain what happened and why it matters,” Guha said. Instead of starting from scratch, analysts begin investigations with a clear narrative and supporting evidence already in place.
This has a direct impact on response times. As investigations shift from manual correlation to AI-assisted decision-making, teams see faster mean time to respond and a noticeable reduction in analyst workload. In practical terms, this helps SOCs keep up with alert volume without constantly adding staff.
Bringing identity and network context together
Modern attacks often move between identity, network, and endpoint layers. When those signals live in separate tools, important connections get missed. Stellar Cyber 6.3 addresses this by strengthening its unified view across NDR and ITDR.
Login anomalies, network behavior, and endpoint activity are correlated into a single investigation path. This allows analysts to see how events relate to each other instead of chasing alerts across different consoles.
Guha described this as a key distinction. “Unlike platforms that focus on AI-driven enrichment or dashboards, Stellar Cyber 6.3 applies agentic AI directly to investigation and response workflows, producing actionable decisions rather than additional context for analysts to interpret.” The focus is on helping analysts act, not just understand.
Designed for daily analyst work
Beyond automation, 6.3 also makes changes that improve how analysts work day to day. Features such as query sharing, easier reuse of detection logic, and streamlined workflows reduce context switching and help teams standardize investigations.
These improvements may seem small on their own, but together they reduce friction and make it easier for teams to scale best practices. For SOC managers, this means more consistent outcomes across shifts and teams, even as environments grow more complex.
Built for MSSPs
For MSSPs, the economics of the SOC matter as much as the technology. Multi-tenant environments magnify inefficiencies, and manual investigation work quickly becomes expensive.
“For MSSPs, 6.3 reduces the cost to deliver services by automating investigation, standardizing responses, and enabling analysts to resolve incidents faster across multiple tenants,” Guha said. This allows providers to scale services, improve SLAs, and offer more autonomous SOC capabilities without increasing headcount or operational complexity.
In effect, the platform helps MSSPs shift analyst time away from repetitive triage and toward higher-value work that customers actually notice.
Stellar Cyber 6.3 reflects a broader shift in security operations. Collecting more data is no longer the hard part. The real challenge is turning that data into clear decisions and fast action. By applying agentic AI directly to investigation and response, rather than stopping at alerts or dashboards, Stellar Cyber aims to close the gap between signal and outcome. For SOC teams and MSSPs working with limited time and staff, that is where the impact is felt.
