Arctic Wolf is releasing Aurora Adaptive Threat Protection as a closed beta for its customers. According to the company, the endpoint security solution analyses the relationships between activities on endpoints in order to recognise malicious intent earlier. The tool runs alongside existing EPP and EDR solutions, including those from other vendors.
Aurora Adaptive Threat Protection maps endpoint activities such as processes, files, registry changes and API calls in a so-called causal graph. By analysing the relationships between those activities over a longer period, the solution recognises malicious intent, according to Arctic Wolf, even when individual actions appear harmless on their own. The company is focusing on threats including ransomware and credential theft.
Detection and remediation
To distinguish between normal business activity and attacks in their early stages, the solution uses agentic AI workflows, including a specially trained small language model (SLM). Arctic Wolf says the system automatically interrupts the activity as soon as it has detected and confirmed malicious intent. It then rolls back the attack chain by undoing harmful changes, such as modified files and system settings, where possible.
The solution keeps a history of endpoint activity, allowing security teams to review how an attack unfolded. According to the manufacturer, the software has no noticeable impact on endpoint performance, memory usage or CPU load. Arctic Wolf also expects security teams to spend less time on incident response and manual remediation.
Alongside existing EDR
Aurora Adaptive Threat Protection does not replace existing endpoint security. The solution runs alongside endpoint protection (EPP) and endpoint detection and response (EDR), whether from other vendors or Arctic Wolf’s own Aurora Endpoint Security.
Dan Schiappa, President of Technology and Services at Arctic Wolf, argues that attackers often no longer need malware. Instead, he says, they use legitimate tools, stolen credentials and AI-driven automation to remain undetected. According to Schiappa, EDR solutions are good at detection, but that detection needs to happen earlier in the attack chain. With the new solution, the company aims to shift the focus from detection and response to recognising malicious intent at an earlier stage.
Figures from its own research
Arctic Wolf backs up the launch with figures from its own incident response work. According to the Arctic Wolf Threat Report 2026, ransomware accounted for 44 per cent of the incidents in which the company provided support over the past year. The company also points to research by Flashpoint, which estimates that infostealers have harvested 1.7 billion credentials from 7.4 million infected devices. Analyst firm Gartner notes that organisations are increasingly moving from reactive monitoring to preventive measures designed to stop, deceive and disrupt attackers.
Platform and availability
The solution runs on the Aurora Superintelligence Platform, which, according to Arctic Wolf, processes more than ten trillion security events from more than 11,000 customers every week. The company states that humans remain involved in reviewing and validating decisions made by the AI.
Aurora Adaptive Threat Protection is now available as a closed beta for Arctic Wolf customers. Organisations can sign up to take part from 10 November. The company has not yet announced details of general availability or pricing.
The full report can be read via the Arctic Wolf Threat Report 2026.
This article was originally published in Dutch on MSP Business. Read the original →
