Seven components.
One autonomous engine.
From raw device log to verified AI verdict in under 60 seconds. No manual triage, no alert floods.
<60s
To first verdict
0
Raw logs egressed
OCSF 1.3
Normalised on-prem
Detect Triage Reason Share
Raw data and PII stay on-premise.
Three independent detectors run in parallel.
Cordon
Transformer semantic anomaly detection. Learns what normal looks like on your estate — no signatures required.
Sigma
Industry-standard rule correlation: brute force, port scan, lateral movement, exfiltration, persistence. Vendor-agnostic.
Vigil
IsolationForest behavioural anomaly detection against a rolling 7-day per-tenant baseline.
Signals are consolidated before any AI reasoning runs.
Sovereign first, frontier only on escalation.
Forge
On-premise LLM. Produces the first-pass verdict — escalate, monitor, or dismiss. Sovereign: sensitive data never leaves the cluster.
Apex
Cloud frontier model, high-signal incidents only. Produces the narrative, the remediation plan, and the final G-Score. Only anonymised envelopes ever leave.
What one tenant learns, every tenant benefits from.
On-premise log collection. Zero raw log transfer.
The Sidecar agent deploys as a single Docker container on an Ubuntu server inside your network. It receives logs from every device, normalises them to OCSF v1.3, scrubs PII locally, and forwards only cleaned events over mTLS.
- --Installs with a single command in under 5 minutes
- --Fernet-encrypted credential vault: credentials never reach the cloud
- --Built-in IP discovery and SNMP v2c polling
- --AppArmor enforcement profile for host-level security
Three detectors, three different ways of being right.
Detection runs autonomously and in parallel. Cordon is a transformer that learns what normal looks like on your estate and flags semantic drift. Sigma correlates industry-standard rules. Vigil scores behavioural anomalies against a rolling per-tenant baseline. An attack that evades one is rarely invisible to all three.
- --Cordon — transformer semantic anomaly, no signatures, every 15 minutes
- --Sigma — vendor-agnostic rule correlation: brute force, port scan, lateral movement, exfiltration, persistence, every 5 minutes
- --Vigil — IsolationForest behavioural anomaly on a 7-day per-tenant baseline, every 10 minutes
- --All three write to the same OCSF vault, so evidence stays comparable
Consolidation before reasoning. No alert floods.
Clickdetect is the triage orchestrator. Every ~2 minutes it consolidates the output of Cordon, Sigma, and Vigil into candidate incidents, deduplicates overlapping signals, and calls Forge for a verdict. This is the step that turns thousands of raw detections into the handful of incidents that actually warrant an analyst.
- --Consolidates three detector streams into one candidate incident
- --Deduplicates overlapping signals before any AI cost is incurred
- --Runs every ~2 minutes, fully autonomous
- --Hands off to Forge with the full evidence set attached
Sovereign first. Frontier only when it earns it.
Forge is an on-premise LLM that produces the first-pass verdict — escalate, monitor, or dismiss. Sensitive data never leaves the cluster to reach it. Only high-signal incidents escalate to Apex, a cloud frontier model that writes the narrative, the remediation plan, and the final G-Score. Only anonymised envelopes ever leave your jurisdiction.
- --Forge (on-premise open-weight LLM): first verdict, no third-party AI
- --Apex (frontier model): deep reasoning on high-signal incidents only
- --Only anonymised envelopes leave — no telemetry, no PII
- --Every verdict is explainable: plain-language narrative, evidence trail, MITRE ATT&CK mapping
What one tenant learns, every tenant benefits from.
Flux runs hourly across the whole estate, distilling anonymised attack patterns into shared intelligence and network-wide baselines. A technique first seen against one tenant raises the baseline for all of them — without a single row of tenant data crossing a boundary.
- --Cross-tenant pattern distillation, hourly
- --Anonymised only — no tenant data crosses a boundary
- --Broadcasts shared intelligence and network-wide baselines
- --Improves detection accuracy for every tenant as the estate grows
Live situational awareness. No screen switching.
Mission Control combines the live threat feed, Sovereign Mesh network topology, AI Reasoning Stream, and Security Posture recommendations in one view. The G-Score gives executives a single number to track: severity, confidence, and recurrence weighted into one 0-100 threat gravity index.
- --G-Score: 0 to 100 threat gravity index — 0-40 monitor, 41-60 investigate, 61-79 immediate, 80+ executive escalation
- --Sovereign Mesh: live network topology of all monitored devices
- --Security Posture: daily AI-generated actionable recommendations
- --Intelligence Digest: scheduled email report with trend analysis
Reclaim your security data.
60-day full-platform trial. No credit card. No inbound firewall changes. Live in under an hour.