AI is changing the work on both sides of cybersecurity. Attackers can use it to move faster, while defenders are being asked to make sense of more signals across endpoints, identities, cloud workloads and applications. For organisations, the question is no longer whether AI belongs in the security conversation. It is whether it helps the team spot the important activity sooner and respond with confidence.
ESET’s latest move is aimed at that operational problem. On 27 October 2026, the company introduced ESET NeoCortex, a specialised cybersecurity AI model that powers ESET LiveCortex within the ESET PROTECT Platform. The focus is on connecting fragmented security signals, reducing alert noise and giving analysts more context as an incident develops.
Why this matters to security teams National cyber defence priorities are moving in the same direction. On 13 October 2026, the Cyber Security Agency (CSA) announced enhancements to the National Cybersecurity Command Centre to improve national cyber situational awareness, strengthen threat detection and support faster, coordinated incident response. CSA also highlighted how AI-enabled systems can help defenders track incidents and plan next steps.
There is a practical reason for that focus. In its Cyber Landscape 2025/2026 publication, CSA warned that AI can help threat actors operate at greater speed and scale, with agentic AI potentially automating parts of the attack chain. ESET’s 28 October 2026 APT Activity Report adds useful nuance: its researchers observed threat actors using AI and large language models to speed up tasks such as malware development and building decoy websites, but said AI had not substantially reshaped the APT landscape over the preceding six months.
In other words, security teams do not need to assume every attack is suddenly autonomous. They do need to prepare for familiar techniques being carried out faster, at greater volume and with more convincing lures. That makes good visibility, useful prioritisation and a repeatable response process especially important.
What ESET NeoCortex is designed to do NeoCortex is not positioned as a general-purpose chatbot for the SOC. ESET describes it as a foundational AI model built for structured, time-dependent and adversarial security data. It powers LiveCortex, which connects and prioritises signals from across a business environment so analysts can investigate incidents rather than chase isolated alerts.
That context matters. A suspicious sign-in, an unusual process launch, a new network connection and a change to a cloud workload may look harmless when viewed separately. When the events are linked by timing, identity and system relationships, they may tell a very different story. ESET says LiveCortex is designed to bring those fragments together, reconstruct missing incident context and help defenders understand how an attack could progress.
ESET reports that the platform processes billions of raw telemetry events each day, while around 0.00111% of those events — approximately one in 90,000 — contribute to incidents presented to customers. That is ESET’s own figure, rather than an independent benchmark, but it illustrates the problem the company is trying to solve: reducing the volume of noise that analysts must review.
The company also says NeoCortex can be trained at up to 200 times lower cost than a large general reasoning model. ESET attributes this to specialised cybersecurity training and purpose-built engineering. The model is developed and operated on ESET’s own infrastructure, and the company says this helps keep sensitive security data and model operations under its control.
Human oversight still matters For business buyers, the safeguards are just as important as the AI capabilities. ESET says NeoCortex operates with restricted sandboxes, read-only tools, continuous monitoring, defined usage and token limits, a kill switch and human expert oversight of critical response decisions.
That is the right principle to look for in any AI-assisted security product. AI can help correlate activity, surface patterns and suggest where an investigation should go next. It should not quietly become an unchecked administrator of your environment. Your security team still needs clear evidence, approval boundaries and the ability to challenge or override a recommendation.
What IT buyers should evaluate Before shortlisting an AI-powered threat detection or XDR platform, look beyond the model name. Ask how it will fit into the way your organisation already detects, investigates and responds to incidents.
Coverage across your environment: Confirm which endpoint, identity, network, cloud workload and application signals are collected. Ask what needs an agent, connector or additional licence.
Useful incident context: Ask the vendor to demonstrate how separate events are linked into one investigation, what evidence is shown and how analysts can validate the reasoning.
Clear response controls: Separate actions the platform can take automatically from recommendations that require human approval. Check whether permissions can be scoped and actions audited.
Data handling and governance: Understand where telemetry and derived data are processed and stored, how long they are retained, who can access them, and whether any information is transferred across borders. Organisations should review these details against their own contractual, security and data protection responsibilities.
Integration with existing tools: Check compatibility with your current SIEM, endpoint controls, identity provider, cloud platforms, ticketing system and incident response workflow. A new console should reduce fragmentation, not create another silo.
Operational outcomes: Agree on measures for a pilot, such as time to triage, time to respond, false-positive volume, investigation effort and the number of incidents that receive a clear, actionable explanation.
Run a pilot around real incidents A short, well-scoped pilot will tell you more than a polished product demonstration. Choose a few realistic scenarios that matter to your business — for example, a compromised account, suspicious endpoint activity or an unexpected change in a cloud workload. Use representative data, involve the people who will operate the platform, and compare the results with your current process.
Record the starting point before the pilot begins. How many alerts does the team review? How long does it take to establish whether an alert is genuine? How often must analysts switch between tools to reconstruct an incident? At the end, compare those measures and ask whether the platform improved the quality and speed of decisions, not just the amount of information displayed.
It is also worth involving IT operations, security, compliance and procurement early. They will have different questions about deployment, access, data flows, service coverage and ongoing costs. Getting those answers before a wider rollout can prevent an AI project from becoming another disconnected security tool.
Where ESET fits ESET’s business portfolio includes the ESET PROTECT Platform and modules covering modern endpoint protection, extended detection and response, cloud workload protection, vulnerability and patch management, and managed detection and response services. The right combination will depend on your current controls, the size of your environment and how much investigation and response capability your team wants to operate in-house.
NeoCortex and LiveCortex are worth watching because they put the emphasis on a familiar security operations challenge: finding the few signals that matter in a very large stream of activity. For businesses reviewing their next step in endpoint, XDR or MDR security, the sensible approach is to test the technology against real workflows, ask detailed questions about data governance and keep human decision-making firmly in the loop.
If your organisation is assessing ESET for business, speak with Version 2 about the coverage, integrations and response model that make sense for your environment.