TLDR; security operations was never one problem, so we stopped building it as one product. We became the foundation a security team grows on. Investigations are still the front door. Foundational AI Security is the whole building.
"v3" is our word, and it stays our word. It answers Allen's real question, which was never "what is it" so much as "how do we talk about it."
Externally, always: the 7AI platform, Foundational AI Security, the foundation you grow on.
For the capabilities: Investigation, Detection, Response, Threat Hunting.
"We started with investigations. From there teams grow into detection, response, and hunting on the same foundation."
Never say "v3" to a prospect, customer, partner, or analyst. It means nothing to them and invites "so what was wrong with v2?"
Keep "Engine V3" / "EV3" for internal and deep technical conversations only.
"v3" is our internal name for the step change. The market only ever hears the foundational story.
v3 is two changes that arrived together. Internally we bundle them under one label. Externally we only ever tell the second one.
We rebuilt the investigation core from the ground up (internally, Engine V3). It reasons more flexibly, adapts to each environment, and is built to improve as the underlying models improve, without a re-engineering project each time.
Who hears about this: engineers, technical evaluators, and analysts who ask. Nobody else. It is proof the platform is smarter, not a headline.
The platform grew from doing investigations into a foundation a security team keeps building on: investigation first, then detection, response, and threat hunting, on one engine and one connected view of the environment.
Who hears about this: everyone. This is the story. Investigations is where a customer starts. Foundational is what they are actually buying into.
Yonatan's marketecture, from the managed tier at the top down through the agent architecture and Agentic SOAR to the Federated SIEM reaching your data wherever it lives. The breadth is the point. This is still being locked, so treat labels as directional.
Do not sell v3 as "our engine got smarter." Smarter engines are what every vendor in this category claims this year. If the headline is the engine, we sound like everyone else. The headline is the foundation. The engine is the receipt.
Everyone started with investigations, because the math never worked with people alone and AI is obviously faster and more consistent. That is exactly why speed and false-positive reduction are now a commodity. A whole category says the same words we do: no playbooks, go to the data, show your work, multiple agents. Winning on those is winning a race everyone is already running.
Here is what we noticed and they did not build for. Once a team proves AI can reach data where it lives and do the execution work, they immediately want to move in three directions:
But these are not three separate products bolted together. Run on one foundation and one shared data layer, they become a single loop, and each turn of it makes the next one sharper.
Threat intelligence drives hunting. Hunting expands detection. Detection triggers investigation. Investigation informs response. Response feeds optimization. A self-reinforcing loop that gets smarter with every cycle.
The two enemies we stand against are fragmentation (a SOC stitched from disconnected point tools) and sameness (generic AI that treats every environment identically). Fragmentation is the sharper one, because our architecture genuinely answers it.
The virtue is not that you can configure us. The last generation made you author and babysit endless playbooks, and everyone remembers. The virtue is that the platform adapts to your environment on its own, and is extensible if you ever want to reach in. Bespoke behavior without the burden. That pairing is the thing our sharpest competitors cannot claim: the pure-automation camp gives you no way to reach in, and the pure-DIY camp makes you do the work to get value at all.
Same story, different entry point. The rule of thumb: the closer someone is to our current platform, the more you talk about growth and continuity. The further away, the more you talk about approach and outcome, never internal history.
Frame everything as continuous improvement. Never imply what they have today was lacking.
They do not know v1 or v2, so never mention them. Differentiate on approach and outcome.
The foundational story is a channel gift: land on investigations, expand across detection, response, hunting, and the managed tier over time. More surface to sell into one account, less rip-and-replace friction on the way in.
Lead with: expansion motion and attach, not architecture.
Because we go to data where it lives and speak the native language of the tools, integrations are a strength, not a threat. Position alliances as the platform reaching into their surface, making both more valuable.
Handle with care: the data-layer story can read as "we replace things." Frame it as reach and consolidation choice, on the customer's timeline.
Keep the AWS narrative on speed and scale: built on AWS, running production at scale, to market through Marketplace and the co-sell motion. AWS is infrastructure and a go-to-market lever, not a place to expose architecture internals.
Lead with: proof of scale and the joint motion.
There are two registers, and most of the field lives in the first one. Value and benefit is the default. Technical and architecture is on request, for the people who can act on it.
The discipline here is simple: translate every architecture fact into what the customer gets. "We own the data layer" is a fact about us and means nothing to a buyer. Here is the same set of facts, said as benefits.
Nothing to centralize, no translation into the language of a SIEM. We speak your tools' native languages, so you keep control of your own data architecture and avoid lock-in.
Detection, investigation, response, and hunting run off one consistent picture of your environment. Context carries end to end instead of dying in the handoff between five disconnected products. Nothing falls between the seams.
Growing into detection, response, or hunting does not mean standing up another tool or re-integrating your environment. It runs on the foundation you are already connected to. Add capability, not complexity.
Accountable humans on the loop, all the way up to a fully managed tier in PLAID ELITE. A force multiplier for your team, not a replacement, and not an unattended black box.
We promise no new plumbing, never no new purchase. Adding a capability means no new integration and no re-architecture. Whether it is an add-on or already inside a package depends entirely on how the customer buys, from investigations as a starting point up through PLAID ELITE. Keep all external language on the technical benefit and stay silent on packaging mechanics. If a prospect pushes on cost, that is a discovery move and a human conversation, not a number on a slide: "That depends on how you use us and which way you buy. The point is the capability is already built to run on what you have connected, so adding it is a decision, not a project."
For engineers, technical evaluators, and analysts. This is where "v3" and "Engine V3" are allowed, and where the data layer detail earns its keep.
These were real wedges a year ago. The whole category says them now, word for word. Keep them as reasons to believe once someone is interested. Never build the opening on them.
Booth #1839, Mandalay Bay. One story, told at three depths, so a passer-by, a serious buyer, and an analyst each get the right version without us switching scripts.
Foundational AI Security. The foundation a security team grows on, from investigation to detection, response, and hunting. No engine talk, no v3.
Open on a live investigation as the proof, then widen to the loop on one foundation. Show the smarter engine as evidence of quality, on stable, curated paths only.
Register B. The engine, the data layer, the build surface, the commitments. This is where "v3" and the architecture live, and nowhere else on the floor.
The Federated SIEM and the data-layer story are the most differentiated thing we have, and also the least mature. Treat them as an emerging capability and a direction, not a shipped, sell-hard product, in any external material and on the floor. Show the reach and the consolidation choice as where the platform is going. Keep unified chat and the mobile app demo-only, as UI and direction with representative data. Confirm the live status of anything data-layer before it goes on a slide.
"Others add an 'AI Analyst' on top of your SIEM and tell you to fire your people. 7AI is the foundation that runs investigation, detection, response, and hunting on one engine and your data wherever it lives, with humans on the loop. Start with investigations, then grow into the rest without stacking on another tool."
"Same platform, now doing more for you. The directions you asked about run on the foundation you are already connected to, so adding one is a decision, not another integration project."
"They investigate alerts on top of your stack, and stop there. We are the foundation underneath: one engine across detect, investigate, respond, and hunt, shaped to your environment, with humans on the loop. They add to the pile. We help you collapse it over time."
"It is the most adaptable and extensible engine in the category: bounded specialist skills over a planner, shared memory, and built to take stronger models over time without a rebuild. Approach, not a spec war."