The Pulse
Tanium Relaunches Security Operations Around Endpoint Behavior
Tanium relaunched its Security Operations platform on October 6, adding behavior-based detection, fleet-wide response options and AI-guided threat hunting. The company says the product is available now and works alongside customers’ existin
AI.info Team · Written with AI ·
“AI has changed who the attacker is and how fast they move. The next breach won't look like malware. It will look like one of your own administrators.”
Harman Kaur, chief technology officer at Tanium
Tanium relaunched its Security Operations platform on October 6, recasting it around a threat it says traditional file-focused defenses can miss: attackers using stolen credentials and everyday administrative tools. The company’s approach centers on monitoring behavior across endpoints, then investigating and responding from the same platform. Tanium says the service is available now and is designed to work alongside the SIEM and endpoint detection and response tools customers already use.
The announcement combines new detection features with response and hunting workflows. It does not provide performance benchmarks or independent test results, so claims about how quickly the platform finds or stops attacks remain the company’s own.
Endpoint Drift looks for machines acting out of character
Tanium’s new Endpoint Drift feature learns how each endpoint normally behaves and ranks devices that depart from that pattern, directing analysts toward machines the company considers more suspicious. The idea is to look for activity that differs from a device’s usual behavior rather than depend only on identifying known malicious files.
A second addition, the Insights Engine, replaces Tanium’s process injection detection with an engine intended to identify attackers hiding inside trusted processes. The release does not describe the engine’s detection criteria or give figures on false positives, detection rates or how it compares with competing products. Those details would help security teams assess how the feature performs in varied environments.
Response actions range from one process to a fleet
When analysts find suspicious activity, Tanium says they can stop an individual process, collect forensic evidence or isolate a host. The actions can apply to one endpoint or to an entire fleet, a design meant to match the response to the scope of an incident rather than rely on a single, broad quarantine control.
The relaunch also introduces a Federated SOC model for organizations with separate security teams. Each team can maintain its own alert suppressions and automated reactions on the shared platform, Tanium says, so one group’s settings do not automatically carry over to another group’s endpoints. The company describes people as setting the boundaries for automated actions; the release does not specify how those boundaries are configured or audited.
Atlas brings plain-language queries into threat hunting
Tanium Atlas lets an analyst ask questions in plain language and query endpoint data, with answers returned in seconds, according to the company. Analysts can take action in the same interface, while hunt strategies written by Tanium threat hunters guide the investigation. Atlas also ranks alerts and recommends whether an analyst should dismiss, escalate, investigate or contain them.
New Security Operations dashboards and templates offer teams starting points for the work. For organizations seeking outside support, Tanium HuntIQ pairs its threat hunters with the platform to investigate customer environments, improve detections and assist with incident response. Tanium says lessons from those hunts feed back into the platform.
A complement to existing security tools, not a replacement
Tanium frames the relaunch as a way to apply its endpoint-management reach to security operations: the same platform used to understand and manage devices becomes a source of behavioral signals and response actions. Its release says Security Operations works alongside existing SIEM and EDR products, rather than requiring customers to replace them.
That positioning makes the quality and immediacy of endpoint data central to the pitch. But the announcement leaves open how the new features perform at different fleet sizes, how they connect to specific third-party tools, and what operational results customers have measured. For now, Tanium’s stated offer is a single workflow that links endpoint behavior, analyst-led hunting and actions ranging from evidence collection to fleet-wide isolation.