Arctic Wolf is adding new features to its Aurora Superintelligence Platform. According to the company, the Shadow AI Discovery feature maps which AI tools are being used within an organisation. In addition, the Aurora Security Assistant is gaining new skills, and integrations are being added with Veeam, Cloudflare and Imperva, among others.
Arctic Wolf announced the expansions on 27 October. The company backs up the new AI feature with figures from external research. In the SANS 2026 AI Survey, 63 per cent of the professionals surveyed say they lack sufficient visibility into where AI models are being used and what information they may be exposing. Arctic Wolf also refers to a report by the Cloud Security Alliance, in which 98 per cent of organisations say they have encountered unauthorised AI use.
Shadow AI Discovery
According to Arctic Wolf, Shadow AI Discovery identifies AI tools based on network, identity and endpoint telemetry. The feature classifies the tools it finds as approved or unknown and flags potential data leakage risks. The company states that no additional deployments are required. With the central overview, organisations can detect unauthorised tools, measure trends in AI adoption and evaluate how well their governance policies are working.
According to Nick Schneider, President and CEO of Arctic Wolf, security teams are under pressure to act faster while the volume of data, threats and AI risks continues to grow. Schneider describes visibility as the foundation of security and expects the new features to give customers a better view of how AI is being used in their environment. In his view, this will enable them to set up governance processes and act on insights in real time.
New skills for Aurora Security Assistant
Aurora Security Assistant is the platform’s natural language interface. Customers can now also use it to retrieve information from Aurora Exposure Management, Aurora Threat Intelligence and their own Security Journey. For example, you can ask questions about open findings from the Security Posture In-Depth Review (SPiDR), about reviews that require a response and about the next steps needed.
The assistant also displays the current risk profile, including critical vulnerabilities, the highest-risk assets and endpoints that have not been included in recent vulnerability scans. Arctic Wolf says this allows customers to investigate faster and set priorities based on context.
Integrations via Open Data Pipeline
The new integrations run through the platform’s Open Data Pipeline, which converts raw telemetry from a customer’s environment into security alerts. The additional data sources are monitored by the Aurora Agentic SOC. Arctic Wolf aims to extend detection and active response to existing customer environments without organisations having to replace their current technology.
For web applications, integrations are being added with the web application firewalls from Cloudflare and Imperva, supporting detection and active response to attacks on web services. A connection with Veeam adds backup and recovery information to the platform. The company points out that backup infrastructure is increasingly being targeted by attackers seeking to disrupt recovery.
For the healthcare sector, there are integrations with Epic Systems EHR, Claroty xDome Healthcare and Imprivata ITDR. The platform now also supports ExtraHop Reveal(x) 360, Datadog, Proofpoint Essentials, 1Password, Google Workspace, Trend Vision One Endpoint Security, Palo Alto Cortex and Claroty xDome Industrial.
The full report can be read via the SANS 2026 AI Survey.
This article was originally published in Dutch on MSP Business. Read the original →
