OpenAI and Elastic are tackling the AI problem enterprises can’t ignore

Enterprise AI has a dirty secret: the models are smart enough, but they're often working blind. Frontier reasoning systems can write code, summarize contracts, and spot security threats, but only if they can actually reach the right documents, tickets, and logs buried inside a company's systems. And a lot of that data sits behind role-based permissions that most AI agents have no clean way to respect. OpenAI and Elastic announced Thursday that they're going after this problem directly, expanding a partnership that started with basic connectors back in 2023 into something far more architectural.

The core idea is simple even if the engineering isn't: let Elasticsearch handle the finding, so OpenAI's models can focus on the reasoning. Elastic's search and retrieval layer filters enterprise data through existing access controls before anything gets handed to a model, meaning an agent only ever reasons over what the requesting user is actually cleared to see. That matters for security, obviously, but it also matters for cost. Elastic's own benchmarks claim a 0.89 recall score while preserving multi-tenant isolation, and in a separate test using the BrowseComp-Plus benchmark, precomputed "Knowledge Indicators" reportedly slashed input token usage by 75% while pushing answer accuracy from 60% to 92%. Less noise going in apparently means better answers coming out, and a smaller bill.

Beyond retrieval, the partnership tackles two other headaches that come with running agents in production: knowing what they're doing, and reacting when something breaks. Elastic now consolidates OpenAI API usage metrics and audit logs into one dashboard, so SRE teams aren't hopping between five tools to figure out why an agent burned through its token budget or failed mid-task. When something does go wrong, Elastic's agentic investigation workflows try to correlate the mess of signals automatically and point toward a root cause, rather than leaving a human to reconstruct the timeline by hand.

The security angle is where the numbers get more concrete. Elastic Security's "Attack Discovery" engine uses OpenAI's models to stitch scattered alerts into coherent attack chains mapped against MITRE ATT&CK, turning a pile of disconnected warnings into a narrative an analyst can actually act on. Visa says it used this in a SIEM modernization push and cut triage time on high-stakes mainframe detections from 15 minutes down to seconds, with full audit trails intact. Airtel's managed security team claims 40% faster alert triage and a 30% drop in investigation time. Those are the kind of numbers that get CISOs to sit up.

What's really going on here is a repositioning of the search engine itself. Elastic spent over a decade building infrastructure so humans could query enterprise data efficiently. That same infrastructure, it turns out, is exactly what autonomous agents need too, just with different plumbing. Through Model Context Protocol support, Elastic Agent Builder, and tighter hooks into OpenAI Codex, the pitch is that developers no longer need to hand-roll authorization and retrieval logic every time they want to plug an agent into corporate data. Whether that holds up outside the vendor-supplied benchmarks is the real test, but the direction is hard to argue with.