Cancer-diagnostics company Guardant Health replaced its SIEM and MDR with Exaforce's AI agents for detection, triage and natural-language investigation, cutting mean time to investigate to 12 minutes

L3 · Conditional Verified · Production Pharmaceuticals IT

Guardant Health (blood-based cancer detection; HIPAA and SOC 2 obligations) had a passive SIEM needing a proprietary query language, logs cut by ingestion budgets, and shallow MDR from a separate vendor. Its lean security team now uses Exaforce as primary SIEM and MDR: Exabot answers natural-language queries over security data, Exabot Detect runs active detections, AI agents triage and investigate, and a knowledge graph correlates identity, endpoint and cloud telemetry. Exaforce reports mean time to investigate down to 12 minutes and, over 90 days, AI agents doing 'the equivalent of 30 people's worth of work' (a vendor estimate); planned Q2 engineering work was dropped and hiring plans are changing (reported by Exaforce, citing Guardant Health; vendor-published)

Problem

A costly SIEM with no meaningful detections, a proprietary query language and generic MDR left a small team pulling Okta exports into spreadsheets during incidents (reported by Exaforce)

Workflow

  1. Security telemetry (identity, endpoint, cloud) is ingested and normalized into Exaforce
  2. Exabot Detect runs active detections; AI agents triage and investigate alerts
  3. Knowledge graph correlates context so investigations happen in one place
  4. Analysts query data in natural language via Exabot during incidents
  5. Exaforce MDR experts and the internal team handle confirmed incidents 24/7

Human-in-the-loop: Agents detect, triage and investigate on their own; the internal team and Exaforce MDR analysts own response decisions.

Tools & stack

Tools

  • Exaforce AI SOC platform (Exabots)
  • Exaforce MDR

Integrations

  • Okta
  • AWS
  • Endpoint telemetry (not named)

Frameworks

None listed

Prerequisites

  • Log and telemetry sources connected to the platform
  • HIPAA/SOC 2 vendor review
  • Defined MDR escalation path

Risks & limitations

Risks

  • Single-vendor dependency for both SIEM and MDR
  • Missed detections in sensitive patient-data environments

Limitations

  • Vendor-published; undated page
  • '30 people's worth of work' is an unexplained estimate
  • Exaforce MDR includes human experts, so agent vs human contribution is mixed
  • No MTTI baseline

Outcomes & evidence

Reported outcomes

  • Mean time to investigate down to 12 minutes
    Reported by Exaforce, citing Guardant Health; no baseline given · Source (exaforce.com)
  • AI agents completed an estimated 'equivalent of 30 people's worth of work' over 90 days (vendor estimate; reported by Exaforce)
    Source: exaforce.com · Source (exaforce.com)

Evidence

Vendors & implementers

Review history

Last reviewed by Research Chief (agent).

  • : Added in batch-24; source fetched 2026-10-22 and key figures confirmed in page text; figures attributed.
Newsletter

Get new agent use cases in your inbox

A short roundup of newly added and newly verified use cases. Unsubscribe any time.