Someone reviews every alert at 3 a.m. It is not a person, and that is exactly why it works.
Agents triage all of your alerts around the clock, with senior judgment behind them. You only receive what genuinely needs a decision, with the analysis already done.
The problem
A large customer or an auditor asked whether you have monitoring, and the honest answer was no. You asked for a SOC quote and got a USD 2,500 per month number that makes no sense for a company your size. Meanwhile your WAF logs attacks nobody reads, your servers send alerts that die in an inbox, and the uncomfortable question stays the same: if something happens on a Saturday at 2 a.m., who finds out?
How it decides what closes on its own
That is the right question, and we answer it with architecture rather than a promise. Letting a language model close security alerts on its own would be a bad idea. It does not.
The agent proposes. The gates decide.
The agent analyses and returns a verdict with a confidence level. What actually closes an alert is a set of fixed rules living outside the model: an alert closes on its own only if the verdict is false positive, confidence clears the threshold, and there is no sign of tampering. Every other combination escalates to a person. During the pilot, not even that: the agent only proposes, and nothing closes on its own until its accuracy is measured on your alerts.
Designed to fail on the safe side.
If the service goes down, a source fails, or we detect a manipulation attempt, the alert escalates: it does not close. What no filter can guarantee is that a model is never confidently wrong. That is why the pilot starts in observation mode, where the agent proposes and a person decides, and automatic closing is enabled in a narrow scope only when the numbers on your alerts back it up. Critical alerts skip the agent entirely and go straight to a person.
An audit trail you can verify, not just trust.
Every decision lands in a cryptographically chained log: which alert arrived, which rule or verdict decided it, with what reasoning and when. Altering an entry breaks the chain, and to also catch a deleted tail it is verified against a checkpoint exported off the server. On top of that, a sample of what closed automatically is reviewed by hand every week, to catch drift before you do.
What's included
- Automatic triage of every alert, 24/7: the agent assembles context (what else that IP, user or server did in the last 24 hours), queries threat intelligence and returns a verdict with its reasoning
- Your WAF and CDN as a first-class source: Cloudflare today, Akamai and AWS WAF in integration. Almost no SOC in the region reads the edge properly
- Case correlation: twenty alerts from the same attacker are one case, not twenty interruptions
- It connects to what you already pay for, replacing nothing: CrowdStrike, Microsoft Defender, Splunk, Netskope and Zscaler. Their alerts feed the triage, and we additionally query CrowdStrike and Splunk over API, read-only, to build context. Each integration is validated on your data during onboarding
- No EDR? On the Managed plan we deploy our own agent on servers and endpoints (in implementation)
- Coming soon: cloud and identity audit (AWS, Google Workspace, Microsoft 365)
- Escalation with the analysis done, not a raw alert, through the channel we agree on during onboarding
- Weekly report: what happened, what closed, what escalated and what needs fixing
How we work
- Scoping call: what you run, what you expose and what your customers are asking you
- We connect sources one at a time, starting at the edge. No new agents where they are not needed
- First month of tuning: the agent learns your environment and we drive the noise down. That is the month the setup fee covers
- Continuous operation, with a monthly review of the numbers alongside your team
How it works
- 01
Saturday, 2 a.m.
Your WAF, your CDN and your systems raise alerts all night. Someone has to look at them.
- 02
The agent reviews each one
Every alert goes through the agent, which analyzes it with its reasoning in the open. 24/7, without getting tired.
- 03
Noise closes itself
What’s noise gets closed with its explanation. Nothing is dropped without a trace.
- 04
One reaches you
Only what needs a human decision, with the analysis already done.
How fast you see value
- Day 1Scoping call and the first connector: the edge.
- Week 1The first sources are already going through triage and you get the first weekly report.
- Month 1Tuning: the agent learns your environment and we bring the noise down. That is the month the setup fee covers.
- Month 2Continuous operation. Monthly review of the numbers with your team.
What you get
- Escalations with the analysis already done: what happened, what was checked and what we recommend
- Weekly report summarising the operation
- A verifiable audit trail of every agent decision
- Monthly review of posture and noise, with concrete recommendations
Pricing
from USD 400/month
Watch (edge): USD 400/month. Managed (edge, servers, cloud and identity): USD 1,300/month. Setup from USD 600, covering the tuning month. We are opening with a limited number of pilot slots
What this service is NOT
- It is not a SOC with human analysts overnight. What is awake at 3 a.m. is the agent; a person steps in when something escalates, within the response time your contract states. We would rather say it plainly than sell you staff that does not exist
- It does not replace your antivirus or EDR. We read them, we do not substitute them
- It is not a compliance certificate. It helps you demonstrate monitoring to an auditor, but certification is separate work
- We do not run incident response for you on the entry plan: we tell you what happened and what to do. Incident support is part of the higher plan
Frequently asked questions
Are you letting an AI make decisions about my security?
Not in the way that sounds. The agent analyses and gives an opinion; what closes without human review is determined by fixed rules that live outside the model, and anything doubtful escalates. A critical alert does not even reach the agent: it goes straight to a person.
What if someone tries to trick the agent?
That is a real attack and it is accounted for. An attacker can plant text in a log to try to instruct the automated analyst. When that is detected the alert cannot close on its own: it is treated as what it is, an indicator of attack, and it escalates. Nobody legitimate writes that in a log.
What if I already run Splunk, CrowdStrike or Zscaler?
All the better: we replace none of those tools and ask you to migrate nothing. Their alerts feed our triage, and we additionally query CrowdStrike and Splunk over API to build context, always read-only. We never write to your platforms: containing a host or blocking at the proxy stay on your side, with your approval. And if your stack is not on the list it still connects — any source speaking OCSF or ECS works with no development, and anything we do not recognise escalates to a person rather than being discarded.
Why does this cost less than a traditional SOC?
Because a traditional SOC bills you for shifts of people watching screens at night. Here the repetitive work is done by the agent and the person steps in where judgment matters. It is not the same service for less: it is a different service, which is why we say so plainly.
Where does my data live?
In an instance with your own isolated index, your own configuration and your own audit log. On the Managed plan you can request dedicated infrastructure, with nothing shared with another client.
What if I want to cancel?
No lock-in. You take your documented configuration and your reports with you. If the service is not working for you, we do not want a contract to keep you.
Want to talk about your case?
A free, no-strings 20-minute intro call. Tell us your context and we’ll tell you honestly whether this service makes sense for you.