Legion Security Unveils DragonClaw for Context-Aware SOC Orchestration

DragonClaw functions as an intelligent intermediary, allowing analysts and security leaders to request actions in plain language rather than relying on rigid, pre-programmed workflows. The system interprets these requests, determines which agents are required for the job, and coordinates their execution. Because the platform learns from an organization’s existing tools and decision-making patterns, it avoids the need for extensive custom integrations.

To maintain operational security, the platform incorporates configurable guardrails. No action is performed without explicit human permission, and the system operates strictly through approved credentials stored in secure vaults. According to Michael Gladishev, co-founder and vice president of research and development, the goal is to provide bespoke, trusted security operations that avoid the opacity of a black-box AI model.

DragonClaw is currently available to existing customers and will be demonstrated at the upcoming Black Hat USA 2026 conference. By grounding AI responses in real-world organizational data, the tool aims to bridge the gap between high-level CISO oversight and the granular, minute-by-minute investigations conducted by SOC analysts.