March 2026 Summaries

Alert fatigue poses a significant challenge for managed security service providers (MSSPs), affecting their business operations, analyst retention, and customer satisfaction. The high volume of alerts can lead to missed service level agreements (SLAs), overlooked critical alerts, and increased operational costs. To combat these issues, MSSPs are adopting intelligent workflows that leverage deterministic automation and AI to pre-investigate and filter alerts, thus reducing manual triage efforts and enabling analysts to focus on more complex tasks. By automatically enriching alerts with data, correlating signals across diverse tools, and prioritizing real threats, these workflows enhance Tier 1 triage and improve the efficiency and effectiveness of security operations. This approach not only reduces burnout among analysts but also transforms their roles from reactive responders to strategic automation engineers, thereby improving retention and offering more attractive career paths. Ultimately, the integration of intelligent workflows helps MSSPs optimize their processes, extend their capacity, and deliver superior customer outcomes while maintaining a competitive edge.

In January 2026, the National Security Agency released its Zero Trust Implementation Guidelines (ZIGs), which marks a shift from conceptual alignment to operational execution of Zero Trust principles, emphasizing that the challenge now is not just defining pillars but executing them effectively across various systems. The guidelines highlight the importance of intelligent workflows, which integrate automation, orchestration, analytics, and consistent policy enforcement, to ensure Zero Trust is operationalized at scale. Tines, an API-native automation platform, aligns well with this approach by facilitating seamless orchestration across diverse security tools without enforcing vendor lock-in, enabling organizations to achieve continuous enforcement and auditability. The ZIGs underscore that Zero Trust's success relies on execution discipline, where controls are continuously validated and governed, making them more than just theoretical standards but practical operational imperatives. As Zero Trust matures, the focus is on creating deterministic, policy-aligned workflows that integrate human oversight and AI-driven decision-making, ensuring organizations can adapt to evolving threats and maintain strategic advantages.

Managed Security Service Providers (MSSPs) are increasingly reliant on customer loyalty as a critical measure of business health. To retain customers, MSSPs must effectively deliver on promised security outcomes, such as threat prevention, while grappling with the complexities of scaling operations. Challenges like alert fatigue, poor communication, and lack of transparency can erode trust and lead to customer churn. Intelligent workflows, which integrate deterministic automation, AI, and human intervention, are pivotal in managing these challenges, enabling MSSPs to scale efficiently without increasing headcount. These workflows help standardize processes, reduce repetitive tasks, and enhance communication, allowing analysts to focus on high-value tasks and fostering a shift from being mere service providers to strategic partners. By employing intelligent workflows, MSSPs can improve operational transparency, enhance customer trust, and expand service offerings, ultimately leading to increased retention, customer acquisition, and revenue growth.

Tines' workflow capability matrix (WCM) is a comprehensive tool designed to help users audit and enhance their existing intelligent workflows by providing a complete view of potential opportunities across various domains, including security and IT operations. The matrix covers essential capabilities such as application security, cloud security, IT service delivery, governance, risk and compliance, network security, infrastructure management, identity and access management, threat intelligence, application management, incident response, vulnerability management, and data loss prevention. Available online, the WCM allows users to filter workflows by team or specific capability, offering an overview, relevant workflows, and resources for each area. Users can download example workflows to their Tines tenant or sign up for a free community edition to do so. Additionally, the matrix evaluates efforts across key operational areas, providing a personalized score to identify growth opportunities. Whether new to intelligent workflows or seeking to expand capabilities, the WCM aims to inspire and guide users towards impactful workflow enhancements.

With the self-hosted release of v34.7.0, Tines now supports sending Open Telemetry (OTEL) traces to observability stacks that can ingest OTEL data, offering a new way to gain insights into system performance. This series of articles aims to define key OTEL and observability concepts, explain the importance of tracing within Tines, and demonstrate how to implement an observability stack, focusing on the design of a Grafana dashboard and troubleshooting using OTEL data. By enabling tracing, users can better understand the flow of workflows through Tines, pinpointing specific areas of latency and identifying whether issues are due to stories or actions, rather than the infrastructure itself. This capability shifts the conversation from general system slowness to more precise diagnostics, such as identifying specific slow actions within a story and addressing them directly. The series will further explore practical steps for designing and implementing an observability stack and offer guidance on effective troubleshooting techniques.

Tines played a significant role as an industry partner in Defence Cyber Marvel 2026 (DCM 2026), deploying over 40 self-hosted instances on the CR14 NATO Cyber Range to support teams from 29 countries. This event, held in Singapore for the first time, involved over 2,500 participants from 70 organizations and emphasized the importance of international cooperation in cyber defense. The exercise included various teams—blue, red, green, and yellow—working together to simulate real-world cyber threats and improve decision-making under pressure. Tines' automation platform was integral in creating shared workflows across these teams, enhancing communication and operational efficiency. By automating alert enrichment and response actions, Tines demonstrated its ability to reduce dwell time for defenders and enable faster iteration for attackers. The exercise underscored the necessity of integrating industry innovation into military operations, bridging the gap between technological advancement and operational adoption. Participants gained practical skills, cross-functional collaboration techniques, and insights into integrating security, infrastructure, and enterprise tools, which are vital for enhancing operational readiness in defense and government sectors.

Tines has introduced several new features to enhance user experience and efficiency in building workflows, managing records, utilizing templates, and deploying in self-hosted environments. The introduction of storyboard sections and markdown notes aims to improve visual clarity and comprehension of workflows, while record enhancements include improved chart features and usability improvements. Template management has been enhanced with the ability to share private templates globally or with specific teams, and the Tines library now includes over 23,000 templates. The platform also offers new capabilities for managing cases with increased creation limits and automatic updates for case blocks, along with the option to deploy Tines in Kubernetes environments using Helm Charts. Additional features include a floating toolbar for page elements, easier resource variation creation, team API keys for secure scopes, and the integration of Mistral AI as a new AI provider.

Tines, a company known for its focus on security and automation, has adapted its platform to incorporate reasoning capabilities within its workflows by leveraging AI models, enabling tasks such as alert summarization and data enrichment. Initially, AI features were developed on AWS Bedrock to ensure data security and compliance, but as customer demand evolved, Tines introduced a flexible framework that supports multiple AI providers, including OpenAI, Mistral, and self-hosted options, without complicating the codebase. This was achieved through a generator-client split that standardizes interaction with various providers, allowing developers to focus on feature development rather than infrastructure specifics. Additionally, Tines implemented a method for enforcing structured data output across different AI models by incorporating JSON schema enforcement, ensuring consistent functionality even with diverse provider capabilities. The company’s iterative development cycle, driven by customer feedback, has allowed for rapid adaptation and the integration of new AI standards, ensuring that its platform remains versatile and capable of supporting both cloud-hosted and self-hosted AI deployments.

Over the past year, Tines has simultaneously faced and triumphed over significant challenges, achieving notable business milestones such as a 122% net revenue retention, tripling its enterprise customer base with major agreements, and growing its workforce by over 100 individuals. The company capitalized on the demand for intelligent workflows and AI-driven value creation, which contributed to a substantial increase in the adoption and use of its products. Emphasizing transparency and customer trust, Tines introduced the Tines Almanac, a comprehensive and open guide to the company's strategy and future direction, which aligns with its commitment to authenticity and innovation. The Almanac symbolizes Tines' dedication to building a sustainable and impactful software platform, with a focus on customer feedback and continuous improvement, as it aims for significant revenue milestones like $100 million in ARR. The company's founder reflects on personal roots and the importance of adaptability and learning, drawing parallels between his family's agricultural background and Tines' strategic approach, while encouraging stakeholders to contribute to shaping the company's future.