AWS and Arctic Wolf Bring Agentic AI to Cloud Security Operations

AWS details how Arctic Wolf connects security findings from AWS environments to its Aurora Agentic Security Operations Centre (SOC), combining event-driven telemetry delivery, AI-assisted investigations, and human security expertise.

Published on October 16, 2026, on the AWS Marketplace Blog, the article describes an integration designed to help organizations move from collecting security alerts to investigating them and deciding what action to take.

The approach addresses a common operational challenge: security teams may have several detection tools generating findings, but limited time and staffing to investigate every signal. An alert can indicate suspicious activity, a configuration issue, or legitimate testing. Determining which explanation applies requires additional context.

Arctic Wolf combines its Aurora platform with its Concierge Security team to provide this operational support. The integration uses AWS services to transfer findings into Arctic Wolf's security operations environment, where AI agents assist with triage and investigation while human specialists handle complex decisions and escalation.

How the AWS Integration Works

AWS offers multiple services for identifying suspicious activity, recording events, and consolidating security findings. The integration described by AWS connects these capabilities to Arctic Wolf's managed security operations.

Amazon GuardDuty detects potential threats in AWS environments, while AWS CloudTrail records API activity for auditing and investigation. AWS Security Hub CSPM collects findings from supported AWS services and third-party tools in the AWS Security Finding Format (ASFF).

However, collecting findings is only one stage of security operations. Teams must also determine which findings matter, correlate them with other evidence, and decide how to respond.

Arctic Wolf's integration uses an event-driven architecture to move findings into its Aurora platform without relying on periodic polling.

Inside the Event-Driven Telemetry Pipeline

The integration relies on five main stages to move AWS security findings into Arctic Wolf's operations environment.

1. AWS Security Hub CSPM aggregates findings.

Security Hub collects findings from services such as GuardDuty, Inspector, Macie, and Config, as well as supported third-party security tools. It provides a consolidated view of findings in ASFF.

2. Amazon EventBridge routes new findings.

When new findings arrive, EventBridge triggers events according to the configured rules. This event-driven design removes the need for Arctic Wolf's integration to repeatedly poll Security Hub for updates.

3. Amazon Data Firehose streams the events.

Data Firehose delivers events to Amazon Simple Storage Service (Amazon S3). Its buffering and batching capabilities support efficient data delivery, including during periods when security activity generates more events.

4. AWS Lambda processes and enriches findings.

Lambda performs processing and enrichment before routing findings to a destination S3 bucket.

5. Arctic Wolf accesses the destination data.

Arctic Wolf's SOC reads the destination bucket using cross-account AWS Identity and Access Management (IAM) authorization. The Aurora platform then correlates AWS findings with endpoint, network, and identity telemetry to provide broader investigation context.

Arctic Wolf supplies AWS CloudFormation templates to deploy the integration pipeline in the customer's AWS account.

The architecture is event-driven, but that does not mean every finding automatically represents a confirmed attack or that every incident is resolved without human involvement. Findings still need context, investigation, and appropriate decisions.

Why Agentic AI Is Paired With Human Security Expertise

AI agents can support repetitive operational tasks, including initial alert triage and investigation. They can help security teams process findings and coordinate work across tools.

Yet the meaning of an alert depends on the environment in which it occurs. For example, a pattern of repeated authentication failures might result from an authorized penetration test in one environment or a credential attack in another.

This makes contextual analysis important. Automated systems can help process events at scale, but deciding when a case requires escalation is also a key part of security operations.

Arctic Wolf's Aurora platform uses a framework it calls the Swarm of Experts, in which specialized AI agents collaborate on triage, investigation, and response. Human analysts provide validation and escalation, while the Concierge Security team works with customers on environment-specific requirements and communication.

The division of work is intended to let AI handle parts of the investigative workload while people focus on decisions that require additional judgment or customer context.

Additional AWS Integrations Extend Visibility

Beyond the Security Hub pipeline, Arctic Wolf describes integrations with several AWS services that provide additional sources of security information.

• AWS CloudTrail: Supplies API activity that can help identify suspicious administrative actions, unauthorized access, and potential privilege escalation.

• Amazon GuardDuty: Sends threat detection findings directly to Arctic Wolf. The integration supports single-account environments and multi-account deployments using AWS Organizations or AWS Control Tower.

• AWS WAF: Supplies web application logs for correlation with other security information.

Arctic Wolf states that it offers more than 120 alerting rules across these integrations. The company positions the combined service as a way to bring cloud, enterprise infrastructure, product infrastructure, and endpoint security operations under one provider.

The available integrations are offered to customers subscribing through AWS Marketplace.

For organizations, the practical value depends on which services they use, how their accounts are configured, and whether the collected telemetry provides the context needed for their investigations.

What the CloudHesive Customer Example Reports

AWS also highlights CloudHesive, an AWS Premier Tier Services Partner that adopted Arctic Wolf's services.

According to the article, Arctic Wolf's Concierge Security team helped CloudHesive verify that findings from CloudTrail, GuardDuty, and Security Hub were reaching the platform correctly. The team also adjusted detection rules for CloudHesive's environment and conducted quarterly security posture reviews.

AWS reports the following outcomes attributed to CloudHesive:

• 50% fewer alerts requiring triage

• 99% faster investigation-to-remediation

• 10 times cost savings compared with CloudHesive's estimated cost of building an in-house SOC

These are customer-reported results presented in the AWS article. They should not be interpreted as guaranteed outcomes for every organization or as independently verified performance benchmarks for every Aurora Agentic SOC deployment.

The article also references Arctic Wolf's 4.9 out of 5.0 rating on Gartner Peer Insights and a 99% willingness-to-recommend figure. These are attributed to the source's cited material rather than presented as independent measurements in this report.

The customer example illustrates why managed security services can involve more than deploying software. Configuration, validation, detection tuning, and ongoing security reviews are part of the operational model described.

Platform Scale and AWS Marketplace Availability

Arctic Wolf states that its Aurora platform supports more than 10,000 customers globally and processes over 10 trillion security events each week. The company also cites more than 14 years of curated security operations data behind the platform.

These figures describe the scale reported by Arctic Wolf in the AWS article. They do not, by themselves, establish investigation accuracy, incident prevention rates, or outcomes for an individual customer.

AWS and Arctic Wolf signed a Strategic Collaboration Agreement in October 2025 to support the platform's global scaling. According to the article, Arctic Wolf uses AWS Global Infrastructure to expand services across regions.

Availability through AWS Marketplace also gives customers a procurement route that can use existing AWS purchasing arrangements and consolidated billing. Custom pricing and committed-term arrangements may be available through private offers, with contractual terms agreed with Arctic Wolf.

Security Responsibilities, Prerequisites, and Costs

The integration operates within the AWS Shared Responsibility Model. AWS is responsible for protecting the underlying cloud infrastructure, while customers remain responsible for securing their workloads and configurations. Arctic Wolf's cross-account access and SOC operations form part of the service arrangement described in the article.

Before setting up the integration, organizations need to enable AWS Security Hub and Amazon GuardDuty in their AWS accounts and hold an active Arctic Wolf subscription through AWS Marketplace.

Understanding the costs

The source identifies two main cost components.

AWS infrastructure costs: The integration uses AWS services running in the customer's account. Charges depend on the resources deployed through CloudFormation and the volume of findings processed and stored. AWS recommends using its Pricing Calculator to estimate costs based on expected usage.

Arctic Wolf subscription costs: The service is purchased through AWS Marketplace. Pricing and contract terms depend on the negotiated offer and appear on the consolidated AWS bill. Renewal and cancellation are governed by the agreement.

The article does not provide a universal subscription price or a single total cost for the integration. Organizations need to assess both their AWS consumption and their specific Arctic Wolf contract.

Removing the integration

The pipeline is deployed through one or more AWS CloudFormation stacks. Organizations can remove it by deleting the relevant stacks through the AWS CloudFormation console.

Any S3 bucket that still contains objects must be emptied before CloudFormation can delete it. The source also advises notifying the Arctic Wolf team before removal because its Concierge Security team helps operate the integration.

Deleting the CloudFormation stacks stops findings from flowing to Arctic Wolf, but it does not cancel the AWS Marketplace subscription. Subscription cancellation must be handled separately according to the contract.

What This Means for Security Teams

Analysis: The integration highlights a broader industry shift from collecting security alerts toward managing the investigation workflow that follows them. Detection tools can surface suspicious activity, but teams still need to establish context, prioritize findings, and coordinate a response.

An event-driven pipeline can reduce dependence on scheduled polling and move new findings into downstream workflows as events arrive. Correlating AWS signals with endpoint, network, and identity telemetry can also give investigators more context than a single alert provides.

The managed-service model may be relevant to organizations that lack the staffing to operate continuous security investigations internally. However, teams should assess data access, cross-account permissions, integration coverage, retention requirements, response responsibilities, and contract terms before adopting the service.

AI-supported triage should also be evaluated against the organization's own requirements. Buyers should define how they escalate findings, which actions require human approval, and how they will measure service performance in their environment. The source describes the overall operating model but does not disclose detailed accuracy benchmarks or a universal response-time guarantee.

Conclusion

AWS's integration with Arctic Wolf connects cloud security findings to a managed security operations workflow built around event-driven delivery, AI-assisted investigation, and human expertise.

Security Hub, EventBridge, Data Firehose, Lambda, and S3 form the AWS-side pipeline, while Aurora correlates findings with other telemetry to support investigation. Arctic Wolf's Concierge Security team provides customer-specific guidance and handles escalation.

For organizations considering the service, the key question is not simply how many alerts their tools detect. It is whether they have the people, context, and processes needed to investigate those findings and take appropriate action.