Query Workers go generally available for security investigations across 60+ tools

Query has made Query Workers generally available, giving security teams AI agents that investigate threats across connected tools without moving data first. The launch leans on the company’s Security Data Mesh and aims to speed triage, preserve evidence, and keep humans in control of final decisions.

Why it matters: - Query Workers are designed to cut time on security investigations from hours to minutes by letting AI search across live data in place. - The launch targets a core enterprise problem: security data is spread across multiple tools, and copying it into one platform can slow analysis and create gaps. - Query says the system keeps humans in control, with Workers recommending actions but not taking them.

What happened: - Query made Query Workers generally available on July 30, 2026. - The AI agents investigate threats across connected security tools without first moving data into another platform. - Query built Query Workers on top of the Query Security Data Mesh and its patented federated search engine. - The launch follows the preview shown at RSAC 2026. - Query said the product is generally available now and will be shown at Black Hat USA 2026.

The details: - The Security Data Mesh translates data into the open OCSF schema at query time. - Query runs searches in place across CrowdStrike, Databricks, Splunk, Microsoft Sentinel, Cribl, Okta, cloud data lakes, and other tools. - The mesh covers more than 60 integrations. - Query says the platform includes more than 1,000 detection recipes behind Federated Detections. - Workers can draft new detections for human review and deployment. - Every investigation produces a report, a full log of each query run, and a ledger of indicators found. - High-severity findings trigger an automated nine-point senior-analyst review. - Query says the process is not a black box and that humans decide on any action. - Findings flow into a case workspace that supports triage, investigate, act, escalate, and close workflows. - The workspace supports fast filtering and shareable views, and it can push cases into an enterprise ticketing platform. - Workers can run on a schedule to deliver a morning briefing on new, recurring, resolved, and unresolved items. - Pricing is credit-based and does not include per-gigabyte ingest fees or data-volume charges. - Query’s Demo Center publishes step-by-step replays of real Worker investigations with every federated query included. - Query says its testing showed that agents with direct access to raw security tools can stop consulting some sources as the environment grows, while agents working through the mesh keep searching across the whole estate. - In Query’s testing, an agent that cannot reach all data can still sound confident about a narrow set of results. - Query said a single Worker can finish work that took analysts hours in about 15 minutes. - Query is headquartered in Atlanta, Georgia. - The company invites teams to request a demo and review live investigation replays. - Query’s announcement links to its LinkedIn page.

Between the lines: - Query is making a broader argument that AI security tools are only as strong as the data they can reach. - The company is positioning its mesh-first architecture as the differentiator, not the model itself. - The emphasis on transcripts, query logs, and human review appears aimed at easing trust concerns around autonomous security agents. - The product framing suggests Query wants to sell both speed and auditability to security teams that already rely on multiple consoles.

What's next: - Query plans to continue promoting Worker investigations through live demos and replay content. - The company will appear at Black Hat USA 2026. - Security teams can request demos and evaluate how the system fits into existing triage and ticketing workflows. - Query is likely to use the GA release to push the idea that AI agents should investigate across existing tools instead of replacing them.