SOAR playbooks are deterministic but brittle. Unbounded AI agents are adaptive but hard to trust. Gamebooks give AI agents a game plan.
We want our AI agents to always be right.
In security, 90% accuracy is not enough when the other 10% can disable a legitimate account, revoke an executive’s access, or shut down a critical production system.
The obvious answer is: “Then do not let the agent act.”
But an agent with its hands tied cannot defend at machine speed. By the time a human picks up the phone, validates the evidence, and approves containment, an attacker may have already moved from initial access to impact.
So the real design problem is not autonomy versus control.
It is controlled autonomy.
How do you let AI agents reason, pivot, and act without letting them improvise past the boundaries of your security team?That is what Gamebooks are built to solve.
The missing layer between context and action
We have written before about the two architectural foundations behind Mate.
The first is the Security Context Graph, which turns organizational facts, investigation history, analyst reasoning, and changing business context into living memory that AI agents can use. Instead of treating an analyst decision as a permanent allowlist, the Graph preserves why the decision was made, under which conditions it was valid, and how much confidence it should carry today.
The second is Continuous Detection / Continuous Response, where detection, investigation, and response operate as one continuous loop on a shared reasoning plane. Investigations improve detections. Detections initiate new investigations. Confirmed noise is tuned out, and useful investigation patterns become reusable coverage.
But one question remains:
How do you tell an AI system how your organization investigates without reducing it to another rigid workflow?
Gamebooks are the answer.
A playbook is a script. The game does not read it.
Think about how a football team prepares.
You do not script the entire game before kickoff.
You can try. You can write down that on play 14, against one exact defensive formation, every player must take one exact route.
Then the other team lines up differently. A player gets injured. The defense changes its coverage. The quarterback sees something unexpected.
Your beautiful script is dead by the second play.
What actually wins is a game plan.
A game plan defines what the team is trying to achieve, how to read the field, which options are available, and which rules must never be broken. It gives players room to adapt without letting everyone invent a different sport.
A SOAR playbook is the pre-written script.
A Gamebook is the game plan.
What is a Gamebook?
A Gamebook is a versioned investigation procedure built for AI agents.It defines:
- What must be investigated
- Which evidence must be established
- Which conditions should change the investigation
- Which actions are permitted
- When the agent must escalate, stop, or request approval
It describes investigative intent, not vendor-specific API calls.For example, a Gamebook may require Mate to:
Establish how a suspicious file reached the endpoint, reconstruct its execution chain, determine whether it communicated externally, profile the affected user and device, and contain it if the evidence meets the organization’s approved threshold.
That is very different from:
Call CrowdStrike endpoint 17, take the value from field 4, send it to VirusTotal, wait 30 seconds, and branch left if the score is above 5.
The first describes the security outcome.The second describes one implementation of that outcome, at one moment in time, using one specific stack.
[Visual: SOAR playbook with hardcoded APIs on the left. Suspicious File Execution Gamebook with investigation requirements on the right.]
How an investigation actually runs
A Gamebook is not a standalone agent and it is not a fixed workflow.It runs as part of an investigation architecture with five connected layers.
1. The orchestrator reads the investigation
When an alert arrives, Mate does not simply map one alert type to one workflow.The orchestrator examines the investigation context:
- Which product produced the signal
- Which users, endpoints, files, applications, and cloud resources are involved
- Which relationships already exist in the Security Context Graph
- Which other alerts or investigations may be connected
- Which Gamebooks are relevant to the situation
It may initiate one Gamebook or several.An endpoint alert might begin with the Endpoint Threat Investigation Gamebook. If the Graph reveals that the file arrived through a reported email, the orchestrator can also activate the Email Threat Investigation Gamebook. If the affected identity has unusual cloud activity, it can bring in the Cloud Identity Investigation Gamebook.The investigation is composed around the situation in front of it.It is not locked to the label on the original alert.
2. Gamebooks define the investigation contract
Each Gamebook defines what the agents must establish and which boundaries they must respect.An Endpoint Threat Investigation Gamebook might require:
- Alert and entity extraction
- User and endpoint profiling
- Process-chain reconstruction
- File provenance analysis
- File and network threat analysis
- Historical investigation context
- A final verdict with a confidence review
The Gamebook gives the investigation structure and determinism.It does not dictate every query or every pivot in advance.
3. Capabilities, or capabilities, do the investigative work
We call reusable capabilities capabilities.A capability is vendor-neutral security skill, such as:
- Profile a user
- Analyze a process chain
- Determine file provenance
- Analyze endpoint behavior
- Enrich a file hash
- Assess exposure
- Communicate with end-user
- Review the confidence of a verdict
- RDP to a machine
- Collect Threat intel
The distinction matters.
“Notify the user” is a capability. “Send a Slack message using this API call” is not.
The capability describes what Mate needs to accomplish. The underlying execution may use Slack, Microsoft Teams, email, a service-management platform, or an internal tool.Because capabilities are reusable, the same User Profiling capability can participate in an endpoint investigation, an identity investigation, a DLP investigation, or an email investigation.
Mate ships with pre-built capabilities, maintains them, and composes teams of them inside different Gamebooks.
4. Agents investigate on the Security Context Graph
The agents executing capabilities do not work in isolation.They read from and write to the Security Context Graph.One capability might extract a process, a file hash, and a user from the original alert. Another adds the process parent and child relationships. Another finds that the user recently received a suspicious email. Another retrieves a Memory explaining that this application is normally deployed through an approved IT process, but only on a specific group of machines.Every result changes the investigation state.The next capability works from a richer Graph than the one before it.This is what lets agents pivot dynamically without losing coherence. They are not passing around disconnected blocks of text. They are collaborating on a shared, structured model of the investigation and the organization around it.The Graph is the memory.The Gamebook is the procedure.The capabilities are the investigative abilities.
5. Flows execute against real systems
When a capability needs to interact with a real system, it uses a Flow.
A Flow is a reusable execution DAG. It contains the tool-specific API calls, queries, transformations, conditions, and scripts required to perform an operation.For example, the Endpoint Profile Collection Flow might collect information from whichever sources are available in that environment:
- CrowdStrike
- Microsoft Defender
- SentinelOne
- Device42
- Microsoft Sentinel
- An MDM platform
- A custom data lake
- An internal asset service
The capability asks for an endpoint profile.The Flow knows how to retrieve it.
Mate generates and maintains generic Flows that work across common systems. Customers can enrich those Flows with their own logic or create entirely new ones for proprietary tools and internal data sources.
Flows are also where execution is constrained. Inputs and outputs are typed. Permissions are enforced. Rate limits and action scopes are applied. The agent cannot silently exceed what the Flow permits.
This is the layer that allows an agent to act without giving it unrestricted access to everything.
Deterministic where it matters. Dynamic where it helps.
This architecture separates two things that security platforms have traditionally forced together.
The Gamebook is deterministic about intent.
It defines what must be investigated, what evidence is required, which actions are permitted, and what approval boundaries apply.
The agent is dynamic about execution.
It decides which capability to invoke next, which evidence to pursue, and when new context requires a pivot.
The Flow is deterministic about tool access.
It defines exactly how systems can be queried or changed.
The Graph keeps everyone aligned.
Every capability works from the same evolving investigation state and the same organizational memory.
That gives you flexibility without improvisation, and control without turning the agent into a ticket-routing bot.
What happens when the world changes?
The difference becomes obvious when something in the environment moves.
You swap your EDR
In a SOAR playbook, CrowdStrike APIs, response commands, field names, and assumptions may be spread across a dozen nodes.
Moving to SentinelOne means rewriting the workflow.
With a Gamebook, the investigation requirements do not change. You still need to profile the endpoint, reconstruct the process chain, retrieve the suspicious file, and assess its behavior.
The relevant Flows change.
The Gamebook does not need to be rebuilt.
You acquire a company with a different stack
The acquired environment may use different endpoint, identity, cloud, SIEM, and service-management products.
A traditional playbook written for the parent company’s stack transfers poorly, if at all.
A Gamebook expresses the common investigative intent across both organizations.
Each environment can use different Flows underneath it.Different infrastructure.
Same investigation logic.
A new alert type appears
Security teams rarely have a dedicated playbook for every signal their vendors release.
With SOAR, no playbook usually means no automation
Mate decomposes the alert into its underlying entities, relationships, and behaviors. The orchestrator can then activate the relevant pre-built Gamebooks and capabilities based on what the alert contains, not only on whether someone authored a workflow for its exact title.
A new alert may still require new logic. But the team does not begin from an empty canvas every time a vendor adds another detection.
Your senior analyst leaves
Traditional playbooks preserve the steps, but often lose the reasoning.
A threshold remains set to 5, but nobody remembers why it was 5 instead of 3 or 7.
With Mate, investigation history, analyst decisions, relevant conditions, and their underlying reasoning are retained in the Security Context Graph. The Gamebook continues to use that organizational memory instead of depending on the person who originally built the workflow. The Graph was explicitly designed to retain this kind of institutional knowledge and apply it to future investigations.
The process survives. More importantly, the reason behind the process survives.
You should not have to choose between our product and your work
There is a reason security teams care about the playbooks, detections, queries, and procedures they have built.
Those assets contain years of hard-earned knowledge.
The problem is that traditional customization often creates a fork.
You start with a vendor template. You adapt it to your organization. The vendor continues improving the original, but your version is now a separate branch that you maintain forever.
The customization that made the product useful is also what stranded you from future improvements.
Gamebooks are designed around a different model.
Mate ships and maintains pre-built Gamebooks, capabilities, and generic Flows. Your team can:
- Bring existing SOAR playbooks and translate their investigative intent
- Enrich generic Flows with internal systems and logic
- Build new Flows for proprietary tools
- Extend Gamebooks with organization-specific requirements
- Describe new investigation needs in natural language
- Test changes against previous investigations and known outcomes
- Run changes in shadow mode before production
- Require sign-off before sensitive actions are enabled
Your additions should sit on top of a platform that keeps improving underneath them.You build with it, not around it.
Every investigation should improve the next one
Gamebooks do more than execute investigations consistently.
They participate in the larger CD/CR loop.
Every investigation adds evidence, relationships, outcomes, and reasoning to the Security Context Graph. Useful investigation patterns can become improved capabilities, updated Gamebooks, or new detections. Noisy detections can be tuned using actual investigation results rather than generic assumptions.
A detection is an investigation that has been repeated and compressed.
An investigation is a detection that has not been compressed yet.
That means the system does not only automate the current queue.
It compounds.More investigations create better context.
Better context produces more accurate investigations.
Repeated investigation logic creates stronger detection coverage.
Stronger coverage reduces noise and initiates better investigations.
This is the shift
We moved from antivirus to EDR because static signatures could not keep up with a dynamic environment.
Investigation and response never made the same jump.
SOAR gave us programmable scripts, but scripts still assume that the world they were written for will remain true.Unbounded AI gives us adaptability, but adaptability without structure is difficult to trust with real access and real actions.
Gamebooks provide the third option.
The orchestrator composes the right procedures.
Gamebooks define investigative intent and boundaries. Capabilities give agents reusable security abilities.
Agents reason and pivot on the Security Context Graph.
Flows execute safely against real tools.And every completed investigation improves what happens next.You cannot script the whole game.
Give the agents a game plan, let them read the field, and keep every move inside the rules.
.jpg)
