BitLyft AIR® v1.28 is the biggest release we've ever shipped. For years, security teams have been working toward the same goal: spend less time figuring out what an alert means, and more time deciding what to do about it. Detection has never really been the hard part. Everything after detection is. Pulling logs, building context, retracing the user's day, deciding whether activity is normal or something to act on. Every case starts as a blank page.
As our AI SOC platform continues to evolve, AIR® now investigates every new case the moment it's created, delivers a clear verdict, and shows you exactly how it got there. Cases no longer start as a blank page. They start as a conclusion you can verify.
Building on the foundation of Ask Noah and Behavior Insights, Case Investigations (Beta) is the next step in our agent-driven approach to security operations. v1.28 also expands the BitLyft AIR® ecosystem with 12 new integrations, extending Custom Policies, Ask Noah, and Case Investigations across even more of your environment.
BitLyft AIR® already centralizes detection, context, and response in cases. With v1.28, AIR® takes the next step. The moment a case is created, Case Investigations automatically reviews it, builds the behavioral context your team would normally have to gather by hand, and delivers a verdict backed by evidence.
For every investigated case, AIR® will:
Investigated cases now open on a new Behavioral Insights view. Instead of leading with raw logs, AIR® leads with what happened and whether it's normal for the user, device, or IP involved.
Behavioral Insights organize context into clear signals:
Each signal includes a plain-English finding and a "why it matters" explanation, followed by the key findings that drove the verdict. Context is built on demand and scoped to the case, so investigations stay fast and easy to explain.
Every investigated case gets a verdict and a confidence level. AIR® also shows why it is confident, what raises confidence, what it could not confirm from the available data, and suggested steps to validate before closing.
Severity doesn't change how deeply a case is investigated. Every investigated case gets the same consistent, documented review.
Two new tabs make every conclusion transparent and auditable:
Nothing is asserted without something an analyst can inspect.
A simple toggle switches between Insights, the structured and scannable view of the investigation, and a Full Report, a complete narrative write-up. Use Insights for triage. Use the Full Report for documentation, escalation, or sharing with a customer.
Case Investigations is decision support, not an execution engine. In this release, AIR® does not run remediation actions and does not close cases on its own. Analysts review the evidence, agree or disagree with the verdict, and add their own notes. Disagreement is fully supported and never blocks an investigation. Analyst feedback during the Beta directly shapes the full release.
And Ask Noah is still right there in the case for any follow-up questions.
v1.28 also expands the BitLyft AIR® ecosystem with twelve new integrations. Once connected, each one brings its activity into AIR®, where your team can:
The new integrations:
Case Investigations is launching as a Beta so we can refine it using real-world cases and customer feedback before the full release.
This is early access to an evolving feature, so expect it to keep getting better throughout the Beta. Want to join the Beta?
v1.28 is the biggest release we've ever shipped. It moves BitLyft AIR® from a platform that helps your team investigate cases faster to a platform that does the first investigation for them, with full transparency and the analyst always in control.
Combined with twelve new integrations, the result is broader coverage, faster decisions, and less manual investigation work on every case.
BitLyft AIR® v1.28 is our biggest step yet from detection to decision.
Case Investigations (Beta) is available to participating tenants beginning June 30, 2026 for users with the appropriate permissions, and runs through August 25, 2026.
To see Case Investigations in action and explore the new integrations in your environment, book a 15-minute walkthrough.