Beyond the Alert: Intezer’s Bid to Automate Forensic Triage and Neutralize Linux Rootkits

The SOC is Breaking, but Intezer Thinks It Found the Fix

If you've spent any time in a modern Security Operations Center (SOC), you know the vibe: a relentless, flashing dashboard of "urgent" alerts that mostly turn out to be digital tumbleweeds. It’s a structural limit that Itai Tevet, CEO of Intezer, isn't shy about calling out. According to him, human teams—even those bolstered by high-priced Managed Detection and Response (MDR) providers—simply can’t keep up. The numbers back him up; an analysis of 25 million alerts by the firm revealed that nearly 1% of legitimate, confirmed incidents actually start as "low-severity" signals that most teams just ignore to stay sane. It’s in this gap between human capacity and threat volume that Help Net Security reports Intezer is planting its flag with an expanded AI SOC platform.

The company isn’t just throwing "AI" at the wall and hoping it sticks. Their strategy is a coordinated squeeze: using "Agentic AI" to handle the grunt work of triage while doubling down on deep-dish research into the kind of sophisticated threats that usually slip through the cracks—specifically Linux rootkits. By shifting away from per-alert pricing and toward a per-endpoint model, as noted by Gartner Peer Insights , Intezer is trying to remove the financial penalty for being thorough. It’s a gamble that enterprises are tired of the "ignore the noise" mantra and are ready for a system that investigates 100% of their alerts with "forensic-depth" accuracy.

Hunting the Invisible: The Linux Rootkit Research

While the AI handles the triage desk, Intezer’s research arm is busy dissecting the nightmare fuel of the server world. Their latest deep dives into the "OrBit" malware family show a disturbing trend toward stealth. Recent samples from 2025 and 2026 have been caught manipulating authentication via pam_sm_authenticate, a move that lets attackers maintain a foothold even when the front door seems locked. As TipRanks highlights, this research isn't just academic; it’s the fuel for their "Closed-loop" detection engineering, where investigation outcomes are fed directly back into the platform's brain to tune SIEM and EDR rules in real-time.

Then there’s the "Curing" rootkit—a proof-of-concept from the Intezer labs that should give any sysadmin pause. It exploits io_uring, a high-performance Linux kernel feature, to sidestep traditional system call monitoring entirely. Most security tools today are like bouncers watching the front door (the syscalls); "Curing" is the guy who built a tunnel into the VIP lounge. This level of technical "street cred" is vital for Intezer. It proves they aren't just building a fancy chatbot; they’re building a system that understands the low-level "genetic" code reuse that defines modern, sophisticated attacks as discussed on Schneier on Security.

Ultimately, the "coordinated push" is about trust and scale. With a $33 million Series C in their pocket, as reported by PR Newswire, Intezer is betting that the future of the SOC isn't just "more humans" or "better filters," but a platform that can think like a researcher and work like a machine. Whether they can truly replace the traditional MDR model remains to be seen, but by focusing on the "uninvestigated" 1% and the deepest parts of the Linux kernel, they’re certainly making a compelling case for a new kind of defense.

The Hidden Cost of "Good Enough" Security

The Real-World Friction: Behind the marketing gloss of "AI-driven efficiency" lies a gritty reality that most security vendors avoid discussing: the industry is currently suffering from a crisis of confidence in its own tools. For years, the standard operating procedure has been "tuning"—a polite industry term for turning down the sensitivity of sensors so that human analysts aren't buried under a mountain of false positives. Intezer’s push isn't just about a new product; it’s a direct challenge to this culture of intentional blindness. By automating the deep forensic analysis that usually takes a human tier-3 analyst hours, they are trying to prove that "background noise" is often where the most dangerous actors are hiding.

Historically, the relationship between automated triage and human expertise has been rocky. Previous generations of "AI" in the SOC were often little more than glorified decision trees that broke the moment an attacker changed a single line of code. This created a massive burnout loop. Senior analysts, bored with repetitive triage, leave the industry, while juniors are left to manage tools they don't fully understand. Intezer’s focus on "genetic" analysis—identifying code by its ancestry and functional DNA rather than simple hashes—is an attempt to give the AI the same "gut feeling" that a twenty-year veteran of the industry has developed. It’s a shift from looking at what a file is to understanding what it wants to do.

Why the Linux Kernel is the New High-Stakes Battlefield

The strategic pivot toward Linux rootkit research isn't a coincidence; it’s a response to where the crown jewels are currently stored. While Windows might dominate the desktop, the backbone of the cloud, AI training clusters, and critical infrastructure is almost exclusively Linux. Threat actors have noticed that while Windows security has become incredibly noisy and defensive, Linux security is often still reliant on legacy logging and "trusted" kernel modules. As Help Net Security has pointed out, the complexity of the Linux kernel provides a perfect "dark basement" for sophisticated rootkits like OrBit or Curing to reside undetected for months.

From a stakeholder perspective, this move targets the Chief Information Security Officer (CISO) who is tired of hearing that their "EDR coverage is 100%" only to find a breach originated from an unmonitored container. By integrating deep kernel research directly into an autonomous SOC platform, Intezer is trying to close the "knowledge gap" between high-end threat hunting and daily operations. They are essentially packaging the brain of a malware researcher into a scalable software agent. This isn't just a strategy for growth; it’s a bet that in the next five years, the only way to defend a modern enterprise will be to have an AI that can out-research the attackers in real-time.

Ultimately, the industry is watching to see if Intezer can maintain this pace. The history of cybersecurity is littered with companies that had great research but couldn't scale the "human" part of the equation. By moving to a per-endpoint model, they are tying their financial success directly to the breadth of the network they protect, rather than the number of times the alarm goes off. It’s a bold move that shifts the incentive from "responding to alerts" to "maintaining a state of security," a nuance that might finally change the lopsided math currently favoring the attackers.

The Paradox of Autonomy: Can We Truly Trust the Machine?

The Skeptic’s Lens: While Intezer’s vision of an autonomous SOC sounds like a relief for overstretched teams, it introduces a classic security "catch-22": the more we automate the triage, the more we atrophy the very human skills needed when things inevitably go sideways. There is a delicate irony in leaning so heavily on AI to solve a problem—alert fatigue—that was arguably created by previous generations of "smart" automation. If an AI SOC platform becomes the sole arbiter of what constitutes a "real" threat, we risk creating a single point of failure where a sophisticated attacker only needs to learn the AI’s blind spots to become effectively invisible.

Furthermore, the pivot to a per-endpoint pricing model, while appearing customer-friendly on the surface, hints at a deeper strategic contradiction. In a world of ephemeral cloud instances and serverless architectures, defining what an "endpoint" actually is has become a philosophical nightmare. Intezer is betting that their "genetic" analysis can keep pace with polymorphic malware that changes its signature every few seconds, but this level of deep-packet and deep-code inspection is computationally expensive. As they scale, the friction between forensic depth and real-time performance will be the true test of whether this is a sustainable evolution or just a very sophisticated band-aid.

There is also the question of the "research-to-product" pipeline. It is one thing to identify a cutting-edge Linux rootkit like "Curing" in a controlled lab environment; it is quite another to detect its fingerprints across a chaotic, multi-cloud environment without generating a new wave of "high-fidelity" noise. The industry has a long memory of "revolutionary" technologies that promised to end the cat-and-mouse game, only to become another legacy tool that needs its own dedicated management team. To succeed, Intezer doesn't just need to be smarter than the malware; they need to be simpler than the mess they are trying to clean up.

"In the end, we’re all just trying to reach that cybersecurity nirvana where the only thing blinking red on the dashboard is the reminder to order more coffee, rather than a frantic notification that a rootkit is currently redecorating the kernel."

Artūras Malašauskas is an AI Systems Integrator with 20+ years of production-grade web engineering experience. He has designed, shipped, and scaled enterprise Python/PHP systems for logistics, SaaS, and public-sector clients. For the past year, he has focused exclusively on AI integrations: deploying open-source LLMs, building generative media pipelines (image, audio, video), and engineering multi-agent workflows for real production environments. His standard: reproducibility, security, cost-efficient inference—no vaporware. He documents and evaluates emerging AI tooling, separating verified capabilities from marketing noise. Technical editor at: muza-ai.eu, ai-verslas.lt, ai-naujinos.lt Connect on LinkedIn