With Cynet’s 4.33 release, CyAI now explains XDR and ITDR alerts in plain language — the capstone on a release cycle that turns the Volume, Value, Velocity model into everyday practice.
For most security teams, detection was never the hardest part of the job. The hardest part is what happens in the minutes after an alert fires: figuring out what it means, whether it matters, how the pieces connect, and what to do next. That gap between an alert appearing and a defender truly understanding it, is where attackers buy time, and where lean teams lose it.
Closing that gap is the entire point of an AI SOC. It is also the throughline of Cynet’s most recent release cycle. Cynet’s 4.33 release adds CyAI XDR and ITDR Alert Explanations, extending GenAI alert explanations across cross-vector XDR detections and identity-based threats. It is a small phrase in a release note and a big idea in practice: AI that doesn’t just flag activity but explains it — outlining everywhere defenders need to act.
The Method Behind the Features: Volume, Value, Velocity
Cynet’s AI SOC Method is the operating model our CyOps team has run across tens of thousands of attacks. Ronen Ahdut, Head of CyOps, lays it out in How Cynet Uses AI in Security Operations: Volume, Value, Velocity. The model is a flywheel, and each new capability we ship is meant to make it spin faster:
- Volume. CyAI absorbs the noise so analysts never have to — behavior-based detection across telemetry, auto-triage, correlation, and payload analysis. It catches exploitative activity even before it’s tied to a named CVE.
- Value. AI sharpens human judgment where it matters most. CyAI remediates the majority of threats automatically, and hands analysts the context to move from detection to decision faster. The goal isn’t to replace the analyst, it’s to make experienced defenders more effective.
- Velocity. Every investigation makes the next one faster. Analyst input and automated analysis feed back into the model, which retrains on real-world activity, so detection and response sharpen with every cycle.
As Ahdut puts it, the system “improves not only from what it sees, but from how experienced defenders interpret it.” That feedback loop is the difference between AI as a feature and AI as an operating model. And in a landscape where new AI models have compressed the time from vulnerability disclosure to exploitation from days to hours, velocity is the new perimeter.
One Idea, One Release Cycle
Cynet’s 4.33 release completes an arc of GenAI capabilities that have built on each other, release over release, each one advancing a different layer of the flywheel:
| Release | What shipped | What it advanced |
| Cynet Version 4.30 | GenAI Alert Summaries arrive in the console providing a concise, plain-language explanation for every alert. | Value: faster understanding, less manual triage. |
| Cynet Version 4.32 | CyOps Recommendations and updates added to GenAI Alert Summaries; GenAI Console Explanations gain recommended remediation playbooks alongside auto-remediation. | Velocity: expert-validated AI that retrains on every investigation. |
| Cynet Version 4.33 | CyAI XDR and ITDR Alert Explanations. Agentic, AI-generated explanations across multiple providers and detection sources, spanning identity, endpoint, network, cloud, and file-based alerts. | Value + Velocity: agentic explainability across the full attack surface, including identity. |
When you read the cycle end to end and the pattern is clear: first we summarized alerts, then we let our experts validate and enrich those summaries with recommended actions, and now we extend that same plain-language clarity to the alert types where it’s hardest to earn — multi-stage XDR detections and identity threats. (See the 4.32 release notes and the 4.33 release notes for the full details.)
What’s New in Cynet 4.33: Explanations Where They’re Hardest to Earn
The headline capability in Cynet’s 4.33 release is CyAI XDR and ITDR Alert Explanations. CyAI translates raw alert details into clear, contextual explanations that show what happened, why the activity may be suspicious, which entities are involved, and where to focus next, so security and IT teams can quickly understand complex detections, prioritize what matters, and cut investigation time.
Crucially, this isn’t a single model summarizing text. CyAI is built on a configuration-driven explanation pipeline that decomposes each alert by provider, alert type, behavior group, and relevant entity context, then assembles the right domain guidance for that specific case. The explanations are produced by an agentic AI system, in which specialized agents apply provider-specific, activity-specific, and security-domain knowledge to each alert case. That is what lets CyAI deliver highly relevant, context-aware explanations across identity, endpoint, network, cloud, and file-based detections — for supported XDR and ITDR alerts spanning multiple providers, detection sources, and alert types. While the market debates what “agentic” should mean, this is what it looks like in production.
XDR Alert Explanations
XDR alerts are, by definition, the alerts that span vectors — an endpoint signal that connects to suspicious network traffic that connects to a risky cloud action. They’re also the alerts where context is hardest to assemble by hand, because the story lives across systems. CyAI now narrates that story in plain language. It outlines what happened, which entities are involved, how the signals connect across the environment, and where to look next. For a lean team, that turns a cross-vector puzzle into a readable account of an attack path.
ITDR Alert Explanations
Identity is involved in nearly every modern attack. It’s also been one of the hardest alert categories to interpret fast. CyAI now extends plain-language explainability to identity-based threats, building on v4.32’s ITDR Detect and Prevent modes. so analysts know immediately what a suspicious authentication or identity event means and how to prioritize it.
Knowing Who Acted: Actions Taken vs. Cynet Actions
The explanations delivered in Cynet 4.33 go a step beyond the earlier endpoint-only explanations by adding enhanced action visibility, with dedicated sections that separate response by source:
- Actions Taken surfaces outcomes reported by external providers — whether an activity was blocked, allowed, failed, prevented, or completed.
- Cynet Actions describes the remediation actions Cynet itself recorded.
Splitting the two answers a question that slows every multi-provider investigation: did the other tool already handle this, or did Cynet? Defenders can see, at a glance, what the environment did versus what Cynet drove, and respond without re-tracing the chain by hand.
The point isn’t that AI writes a nicer alert. It’s that agentic, domain-aware explanation across XDR and identity is where Value compounds into Velocity — understanding arrives faster, decisions get more consistent, and every interpreted alert feeds a model that gets sharper.
Why This Strengthens the AI pillar of Our Strategy
Cynet’s brand promise is simple: we manage attack paths with AI. See the path. Stop the attack. Attacks are paths, not points. Simply, they are chains that move across endpoints, identity, network, email, and cloud. A platform that only fires isolated alerts leaves the hardest work, connecting those alerts into a path, to a human under time pressure.
Explainable AI across XDR and ITDR is how that promise shows up in the daily workflow. It is the productive layer of CyAI, the human-plus-AI collaboration that explains, assists, and scales, working alongside the predictive and proactive layers our partners already rely on. And it does it where it counts most for our audience: the lean security teams, MSPs, and VARs who don’t have a room full of analysts to reconstruct an attack story by hand.
These capabilities also reinforce the loop. Every explanation CyOps validates, every recommendation an analyst refines, becomes training signal. The model improves not just from the volume of activity it sees, but from the judgment of the experts who interpret it. That is the AI SOC method in motion, and 4.33 is the release that brings it to the cross-vector and identity alerts where defenders need clarity the most.
The Numbers Behind the Narrative
| 97% / 90% | of threats acted on autonomously by CyAI; remediated automatically without human intervention. |
| <0.9% | false positive rate, providing a clearer signal with less alert fatigue. |
| <1 second | from detection to full containment. |
| 100% | Detection, Protection, and Technique-Level coverage across three consecutive MITRE ATT&CK Evaluations. |
| 1 : 100,000 | analyst-to-endpoint efficiency with 95% CSAT willingness to recommend Cynet. |
The reality is that the market is still arguing about labels — agentic SOC, human-in-the-loop, domain-specific models. But at Cynet, we’d rather show the work. We’ve been using AI in real security operations for years, and each release makes the loop between CyAI and CyOps a little tighter. With Cynet’s 4.33 release, that loop now closes around the alerts that matter most.
Learn more about Cynet’s AI product roadmap and get more details on the 4.33 release: AI in Security Operations — Volume, Value, Velocity | 4.33 Release Notes