Atos, a European leader in cybersecurity and managed security services, has announced a global strategic partnership with Qevlar AI, a software company specializing in agentic AI for security operations. The collaboration, announced on October 7, 2025, will see Atos integrate Qevlar's "Virtual SOC Analyst" platform into its global network of 17 Security Operations Centers (SOCs). This move aims to leverage Artificial Intelligence to automate a significant portion of the cyber alert investigation process, thereby increasing efficiency and allowing human analysts to concentrate on higher-value activities such as threat hunting and strategic defense planning. The partnership represents a significant step towards AI-driven security operations at a massive scale.
Atos operates one of the world's largest SOC networks, processing over 31 billion security events daily for more than 2,000 customers across highly regulated industries. The partnership will embed Qevlar AI's technology directly into these operations.
This partnership reflects a growing trend in the cybersecurity industry towards automation and AI to combat analyst burnout and the overwhelming volume of security alerts.
Atos will leverage its extensive experience in protecting critical and regulated industries to deploy the Qevlar AI platform at scale. The collaboration aims to bring the benefits of autonomous AI investigation to managed security customers across all sectors. Ahmed Achhak, CEO of Qevlar AI, and Farah Rigal, VP at Atos, both emphasized that the partnership combines Atos's global reach and operational expertise with Qevlar's cutting-edge AI technology to deliver a next-generation security service.
This initiative can be seen as a practical application of MITRE D3FEND defensive techniques at scale, particularly those related to analysis and detection, such as Process Analysis (D3-PA) and Network Traffic Analysis (D3-NTA), by automating the initial steps of these complex tasks.
The AI tool automates the process of auditing and analyzing security events, which is a core component of the Audit mitigation.
By analyzing alerts, the AI helps in identifying behaviors that should be prevented on endpoints.
Mapped D3FEND Techniques:
The integration of Qevlar's Virtual SOC Analyst into Atos's SOCs represents a significant scaling of the Process Analysis defensive technique. This AI-driven approach automates the initial, time-consuming steps of investigating alerts from EDR and other tools. For example, when an alert for a suspicious process is generated, the AI analyst can automatically enrich the alert with data such as the process hash's reputation, its command-line arguments, its parent process, and any network connections it made. This automated triage allows human analysts to immediately focus on high-fidelity, pre-vetted alerts, drastically reducing response times. Organizations can adopt a similar strategy by using SOAR (Security Orchestration, Automation, and Response) platforms to create playbooks that automate the initial stages of process analysis for common alerts.
The Atos-Qevlar partnership enhances Network Traffic Analysis by automating the investigation of network-based alerts. When an IDS/IPS or NDR tool generates an alert for suspicious traffic, the Virtual SOC Analyst can take over. It can automatically perform DNS lookups on the source and destination IPs, check their reputation against threat intelligence feeds, analyze the payload for known malicious signatures (if unencrypted), and cross-reference the activity with logs from other security tools. This provides human analysts with a comprehensive summary of the network event without them having to manually query multiple systems. This allows the SOC to more effectively manage the massive volume of network alerts and quickly identify truly malicious activity, such as C2 communication or data exfiltration attempts.

Cybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Help others stay informed about cybersecurity threats