Mate Security released Gamebooks this week, and SiliconANGLE was first to report the launch. The name is new, so the useful starting point is a plain explanation of what a Gamebook is, how it differs from the playbooks security teams already run, and where it fits in the platform Mate has been assembling.
Definition First
A Gamebook is a structured investigation procedure built for AI agents.
Mate Security’s Gamebooks specify five things: what must be investigated, what evidence must be established, which conditions should change the course of the investigation, which actions are permitted, and when an agent must escalate, stop, or request approval.
Notice what is absent from that list. There are no steps. A playbook says do this, then this, then this. A Gamebook states the objective and the boundaries. The agent works out the sequence from the evidence in front of it and from the organization’s most current context.
The Difference That Makes
Playbooks have served security teams well as a way to automate investigation procedures. Investigations, though, have never followed scripts. Threats change. Environments change. Security stacks and business processes change. Keeping a scripted workflow aligned with a moving reality is continuous effort.
AI SOC agents approached this by replacing static workflows with agentic reasoning. Mate’s assessment is that structured investigation procedures and clear rules belong alongside that reasoning, and that the resolution is architectural rather than a matter of writing better scripts or using more capable models.
Mate summarizes the resulting behavior in one line: deterministic where it matters, dynamic where it helps.
Five Layers, Each With a Job
Gamebooks arrive with a layered architecture that separates investigative intent from execution. Here is how a live investigation moves through it.
The orchestrator reads the investigation and composes the right Gamebooks for the situation. The Gamebooks define investigative intent, required evidence, and boundaries. Capabilities give agents reusable, vendor-neutral security skills to draw on. Agents dynamically apply those capabilities as evidence emerges. The Security Context Graph keeps the investigation grounded in shared state and the organization’s most current context. Flows provide the controlled execution layer, defining how agents interact with specific tools and systems.
Two properties follow from that arrangement. Investigation logic is not tied to specific tools, APIs, or predefined execution paths. Agents can act without receiving unrestricted access to real systems.
Why the Design Is Built Around Trust
The stakes explain the structure. Organizations need AI agents to get it right, because the small percentage of cases that go wrong can disable a legitimate account, revoke an executive’s access, or shut down a critical production system.
The common safeguard is to limit autonomy by requiring human approval. Mate identifies the tradeoff involved. An agent waiting for approval cannot defend at machine speed, and AI-driven attacks operate continuously, in parallel, and adapt as defenders respond. The recent Hugging Face incident is the example Mate points to. An analyst validating evidence and approving containment may be responding to an attack that has already moved.
Mate frames the goal as controlled autonomy, which lets agents reason, pivot, and act while keeping them inside the organization’s methodology, policies, and guardrails.
What Happens When Things Change
Because intent and execution are separated, environmental change is absorbed at the execution layer.
Organizations replace security tools. Acquisitions bring in different security stacks. Vendors introduce new alert types. Experienced analysts leave. In each case the same Gamebook continues to operate while execution adapts. Analyst departures are handled by the Security Context Graph, which preserves previous decisions along with the reasoning and context behind them.
Making It Yours
Gamebooks are extensible and customizable. Organizations can adapt agentic investigations to their own processes, tools, and institutional knowledge without taking on the complexity of building, testing, and operating the underlying agentic systems.
The paths in are straightforward. Existing playbooks can be translated into investigative intent. Gamebooks designed by Mate’s security experts can be extended with organization-specific requirements. Proprietary tools and data can be connected. New investigation procedures can be defined in natural language.
Mate owns the agent engineering, evaluations, testing, and execution. As models, tools, and environments change, Mate continuously validates and evolves the system while customers retain their investigation logic and customizations. Organizations define how they investigate. Mate ensures the agents continue to execute it reliably.
The Feedback Path
Gamebooks do more than execute investigations consistently. They participate in Mate’s Continuous Detection / Continuous Response loop, where detection, investigation, and response operate as one continuous process.
Every investigation adds evidence, relationships, outcomes, and reasoning to the Security Context Graph. Useful investigation patterns can improve capabilities, update Gamebooks, or become new detections. Noisy detections can be tuned based on actual investigation results. Mate describes the result as a compounding cyber defense system where every investigation improves what happens next.
Where It Sits
Gamebooks are the third architectural foundation Mate has introduced in recent months, following the Security Context Graph and the CD/CR framework.
“AI is changing the speed and scale of both attack and defense, but security teams cannot trade control for speed,” said Oren Saban, Co-Founder and Chief Product Officer at Mate. “The shift to agentic investigations requires a different architecture, one that gives AI the freedom to reason and adapt while keeping it grounded in how each organization actually investigates. Gamebooks give agents that structure, so organizations can move toward autonomous security operations without giving up trust.”
Gamebooks are generally available as part of the Mate platform. Mate will showcase them at CrowdStrike Fal.Con 2026.