Atos Partners with Qevlar AI to Deploy "Virtual SOC Analyst"

Atos Announces Strategic Partnership with Qevlar AI to Integrate Agentic AI into Global SOC Network

INFORMATIONAL
October 8, 2025
3m read
Security OperationsPolicy and Compliance

Related Entities

Products & Tech

Virtual SOC Analyst

Full Report

Executive Summary

Atos, a European leader in cybersecurity and managed security services, has announced a global strategic partnership with Qevlar AI, a software company specializing in agentic AI for security operations. The collaboration, announced on October 7, 2025, will see Atos integrate Qevlar's "Virtual SOC Analyst" platform into its global network of 17 Security Operations Centers (SOCs). This move aims to leverage Artificial Intelligence to automate a significant portion of the cyber alert investigation process, thereby increasing efficiency and allowing human analysts to concentrate on higher-value activities such as threat hunting and strategic defense planning. The partnership represents a significant step towards AI-driven security operations at a massive scale.


Partnership Overview

Atos operates one of the world's largest SOC networks, processing over 31 billion security events daily for more than 2,000 customers across highly regulated industries. The partnership will embed Qevlar AI's technology directly into these operations.

  • Technology: The "Virtual SOC Analyst" is an agentic AI platform designed to autonomously handle the investigation of routine and intermediate-level security alerts. It mimics the workflow of a human analyst, gathering context, enriching data, and providing an initial analysis.
  • Goal: The primary objective is to achieve "incremental operational excellence." By automating the high-volume, repetitive tasks of alert triage and initial investigation, Atos aims to free up its skilled cybersecurity experts.
  • Human Analyst Focus: With the AI handling the initial workload, human analysts can shift their focus from reactive alert management to more proactive and complex work, including advanced threat hunting, incident response, and aligning security measures with client-specific business risks.

Impact on Security Operations

This partnership reflects a growing trend in the cybersecurity industry towards automation and AI to combat analyst burnout and the overwhelming volume of security alerts.

  • Increased Efficiency: Automating the initial stages of investigation can drastically reduce the mean time to respond (MTTR) for security incidents.
  • Improved Accuracy: AI agents can consistently follow a defined investigation playbook, reducing the potential for human error in routine tasks.
  • Scalability: The AI platform allows the SOC to scale its operations and handle a growing number of alerts without a linear increase in human staff.
  • Enhanced Threat Hunting: By offloading Tier 1 and Tier 2 analysis, senior analysts have more time to proactively hunt for advanced threats that may not trigger standard alerts, leading to a more mature security posture for clients.

Implementation and Vision

Atos will leverage its extensive experience in protecting critical and regulated industries to deploy the Qevlar AI platform at scale. The collaboration aims to bring the benefits of autonomous AI investigation to managed security customers across all sectors. Ahmed Achhak, CEO of Qevlar AI, and Farah Rigal, VP at Atos, both emphasized that the partnership combines Atos's global reach and operational expertise with Qevlar's cutting-edge AI technology to deliver a next-generation security service.

This initiative can be seen as a practical application of MITRE D3FEND defensive techniques at scale, particularly those related to analysis and detection, such as Process Analysis (D3-PA) and Network Traffic Analysis (D3-NTA), by automating the initial steps of these complex tasks.

Timeline of Events

1
October 7, 2025
Atos and Qevlar AI announce their global strategic partnership.
2
October 8, 2025
This article was published

MITRE ATT&CK Mitigations

The AI tool automates the process of auditing and analyzing security events, which is a core component of the Audit mitigation.

Mapped D3FEND Techniques:

By analyzing alerts, the AI helps in identifying behaviors that should be prevented on endpoints.

Mapped D3FEND Techniques:

D3FEND Defensive Countermeasures

The integration of Qevlar's Virtual SOC Analyst into Atos's SOCs represents a significant scaling of the Process Analysis defensive technique. This AI-driven approach automates the initial, time-consuming steps of investigating alerts from EDR and other tools. For example, when an alert for a suspicious process is generated, the AI analyst can automatically enrich the alert with data such as the process hash's reputation, its command-line arguments, its parent process, and any network connections it made. This automated triage allows human analysts to immediately focus on high-fidelity, pre-vetted alerts, drastically reducing response times. Organizations can adopt a similar strategy by using SOAR (Security Orchestration, Automation, and Response) platforms to create playbooks that automate the initial stages of process analysis for common alerts.

The Atos-Qevlar partnership enhances Network Traffic Analysis by automating the investigation of network-based alerts. When an IDS/IPS or NDR tool generates an alert for suspicious traffic, the Virtual SOC Analyst can take over. It can automatically perform DNS lookups on the source and destination IPs, check their reputation against threat intelligence feeds, analyze the payload for known malicious signatures (if unencrypted), and cross-reference the activity with logs from other security tools. This provides human analysts with a comprehensive summary of the network event without them having to manually query multiple systems. This allows the SOC to more effectively manage the massive volume of network alerts and quickly identify truly malicious activity, such as C2 communication or data exfiltration attempts.

Article Author

Jason Gomes

Jason Gomes

• Cybersecurity Practitioner

Cybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.

Threat Intelligence & AnalysisSecurity Orchestration (SOAR/XSOAR)Incident Response & Digital ForensicsSecurity Operations Center (SOC)SIEM & Security AnalyticsCyber Fusion & Threat SharingSecurity Automation & IntegrationManaged Detection & Response (MDR)

Tags

AIAutomationSOCMSSPThreat DetectionIncident Response

📢 Share This Article

Help others stay informed about cybersecurity threats

Continue Reading