Among companies looking to establish or upgrade Security Operations Centers (SOCs), there is a growing trend to manage detection, analysis, and response systems integrated into a single screen, rather than operating individual security tools separately. A Kaspersky survey found that half of the companies preparing to adopt an SOC cited enhanced security levels as the primary reason, and one in three respondents stated they plan to integrate EDR or XDR into their SOC. Responses indicating an intention to introduce AI into security operations were also high.

Against this backdrop, Kaspersky officially announced the 'Kaspersky Next' update on February 25, and related details were introduced in Korea on March 25. The company focused this reorganization on integrated SOC management and expanding the scope of AI utilization.

The key change is the management structure of Kaspersky Next EDR Expert. By migrating to the Open Single Management Platform (OSMP), the product enables management of EPP, EDR, XDR, and SIEM from a single console. At the same time, it is designed to seamlessly switch between KATA and NDR screens via SSO, focusing on reducing the flow between detection and network monitoring.

The focus of AI functions has also shifted toward practical operations. Kaspersky explained that it automatically identifies DLL hijacking types to trigger alerts and detects suspicious signs of account compromise based on behavior deviating from the baseline of login patterns. In addition, it has incorporated KIRA, a generative AI-based assistant tool, into the product family to support the creation of natural language-based threat hunting queries and incident summaries.

Changes in terms of operational efficiency were also presented. Kaspersky stated that in large-scale deployment environments, EDR Expert can reduce resource requirements by up to 30%, and XDR Expert by up to 60%. Consequently, this update is less about adding new features and more about reducing the operational burden by consolidating detection, analysis, and response procedures—which SOC personnel previously handled by switching between various tools—into a single platform and supporting AI. From a corporate perspective, this can be interpreted as aligning with the demand to streamline operational systems within limited personnel and infrastructure, prioritizing this over the competition for advanced security.