Huawei launches AI-powered security operations system with automated threat detection and response

Huawei Launches AI-Powered SOC to Automate Enterprise Threat Response

Huawei unveiled the Xinghe AI Network Security Agentic SOC on April 30, designed to automate threat detection and response across enterprise networks. The system addresses a persistent operations challenge: security teams drown in alerts while attackers move faster than manual response teams can act.

The platform uses three AI agents working in coordination. A sensing agent aggregates logs from firewalls, switches, and routers to build a unified view of network risks. An analysis agent filters threats from noise using Huawei's security language model. An enforcement agent executes automated responses without waiting for human approval.

The Alert Problem

Large enterprises generate over 10,000 security alerts daily. Most are false positives. Traditional security information and event management (SIEM) systems monitor less than half of enterprise assets, leaving blind spots attackers exploit.

Huawei's data fusion engine processes logs using 3,000 AI parsing rules and searches through billions of records in seconds. The company claims this delivers 100% asset visibility and reduces business interruption risk from unknown threats by 95%.

Speed as a Competitive Advantage

AI-driven attacks can breach networks in two minutes. Manual incident response typically takes over four hours. That gap allows attackers to move laterally, steal data, or establish persistence.

The enforcement agent responds to correlated threats automatically, shifting operations teams from reactive firefighting to proactive defense. The system integrates with third-party large language models, avoiding vendor lock-in.

Operations professionals implementing SOC solutions can explore AI training for cybersecurity analysts to understand how these autonomous systems work. Teams can also learn more about AI agents and automation in security operations.

Huawei said the system supports out-of-the-box deployment on devices from mainstream vendors, reducing implementation friction for operations teams managing heterogeneous environments.