Command Zero Unveils Throughline Living Investigations Ahead of Black Hat USA 2026

Command Zero has introduced Throughline, a new living investigation capability for its security operations platform, previewed ahead of Black Hat USA 2026, announced in a press release.

Throughline connects related alerts into one ongoing case that reopens and re-analyzes evidence when new alerts appear. The feature applies governed AI to merge signals, reassess verdicts, and maintain evidence trails, addressing issues such as alert overload, weak prioritization, and fragmented context. In testing, Throughline reduced verdicts that analysts needed to review by up to 41 percent and linked attack attempts previously shown as separate incidents.

The platform update also introduces automatic alert closure based on analyst policies, continuous alert tuning, and exposure management that integrates asset risk into verdict reasoning. Precision role-based access control adds transparency, while response actions can trigger from investigation verdicts rather than alert severity.

According to the company, the updates are accessible through APIs and an MCP server, allowing teams to connect the platform to their own SecOps pipelines, SOAR systems, and AI agents without requiring data migration.