How to cut alert noise with AI: ESET NeoCortex

Security teams face billions of raw telemetry events, very few real threats and shrinking time to respond. ESET NeoCortex is a specialized cybersecurity AI model that correlates fragmented signals into actionable incidents and estimates an attacker's likely next step, so defenders can intervene before the next stage of an attack. Softprom is the official distributor of ESET.

What was announced

On October 27, 2026, ESET introduced ESET NeoCortex, a foundational cybersecurity AI model powering ESET LiveCortex within the ESET PROTECT Platform. ESET LiveCortex processes billions of raw telemetry events daily. Only 0.00111% of them, approximately 1 in 90,000, contribute to incidents presented to customers.

According to ESET internal research, a specialized model such as ESET NeoCortex can be trained at up to 200 times lower cost than a large general reasoning model, while delivering more accurate, defense-focused results. The model is developed and self-hosted within the ESET secure environment.

AI is accelerating both cyberattacks and cyberdefenses. With ESET NeoCortex, we are applying our AI investment to develop specialized foundational cybersecurity intelligence that remains under our control and strengthens, rather than replaces, human expertise.

Why this matters

Modern environments generate security data across endpoints, identities, cloud workloads, networks and applications. During Black October, the week leading up to October 25, 2026, critical issues affecting PHP, Linux, GitLab and other key systems required rapid, prioritized responses. For CISOs and SOC leaders, the challenge is deciding which signals belong together and what action to take next.

ESET NeoCortex reduces alert fatigue and manual investigation, and its world-model approach supports a minus-one-day defense: predicting attack progression before it unfolds. For CIOs and procurement leaders, the self-hosted design reduces exposure to shifts among third-party AI providers, while lower computing requirements mean more predictable costs and more frequent updates to learned incident patterns.

Technical details

• Architecture: world-model AI built for structured, time-dependent and adversarial security data
• Capabilities: reconstructs missing incident context, creates compact representations of complex incidents, identifies anomalous events within an attack sequence
• Prediction: estimates an attacker's likely next step based on patterns learned from real security incidents
• Signal correlation: links sign-in anomalies, suspicious process launches, unusual connections, configuration changes and data access attempts into prioritized incidents
• Training efficiency: up to 1/200th of the training cost of general-purpose models thanks to optimized training, security vocabulary and privately owned hardware
• Never-go-rogue safeguards: restricted sandboxes, read-only tools, continuous monitoring, usage and token limits, a kill switch and human oversight of critical response decisions
• Layered architecture: combined with deterministic controls, correlation logic, validation and auditability; not a standalone decision maker

FAQ

How does AI reduce alert fatigue in a SOC?

It correlates isolated signals into a small number of prioritized incidents. In ESET LiveCortex only about 1 in 90,000 raw events contributes to an incident shown to customers.

Does ESET NeoCortex make response decisions on its own?

No. It is part of a layered architecture with deterministic controls, validation and auditability, and critical response decisions remain under human expert oversight.

Where is ESET NeoCortex hosted?

It is developed and operated on ESET's own infrastructure, keeping sensitive security data and model operations under ESET control and reducing reliance on third-party AI providers.

Softprom and ESET

Softprom is the official distributor of ESET. Our team helps organizations evaluate, license and deploy the ESET PROTECT Platform, including AI-driven incident correlation with ESET LiveCortex. Learn more about the vendor portfolio: ESET.

Prepared by the Softprom editorial team based on vendor materials (Softprom DistriFlow). Source: original article.