Every decision with reasons and a signature
For a public body, detecting an attack is not enough. You have to show why a decision was made, who made it, and that nobody has edited the record since.
What gets in the way today
Few analysts, many alerts
Every suspicious event becomes an alert, and what matters drowns in routine.
Signals are gathered into cases, and a case is raised only when the evidence is sufficient. On open data: 9 cases instead of 429 alerts.
Decisions must stand up to review
A year from now someone will ask: why was this computer isolated, and who decided?
Reasoning for analysts, management and auditors, and every action is approved by a named person. All of it in a signed ledger.
Data must not leave
An agency's telemetry is sensitive information in itself.
The platform runs inside your network and offline. Nothing is sent to an outside cloud.
Built for accountable work
Six UN languages
For inter-agency and international work: interface and explanations in English, Russian, Arabic, Chinese, Spanish and French.
International frameworks
NIST CSF 2.0, ISO/IEC 27001:2022, MITRE ATT&CK. The platform is not tied to one country's regulator.
External verification
The ledger is verified with the public key outside the platform. Auditors need no access to it.
Least privilege
An agent's credential can do nothing but deliver events.
Credential theft
An employee opened a document from an email. What follows is how the platform sees it: four pieces of evidence, one case, a person decides.
- Document started a command toolT1204.002 · User Execution×40028.6%
- Reading the password store in memoryT1003.001 · OS Credential Dumping×2,50099.9%
- Signed in as somebody elseT1078 · Valid Accounts×110>99.9%
- One account reaching many computersT1021 · Remote Services×200>99.9%
What the platform will propose
- Isolate the computer
Cuts the computer off from the network but keeps it running for investigation. The person using it loses access to shared resources.
- Capture the memory
Saves the computer's memory before anything is stopped, preserving proof.
- End all sessions
Signs the account out everywhere, so a stolen session can no longer be used.
Test it on your own data
A pilot runs on one server inside your network. You see what the platform finds there, and how many alerts stop reaching your analysts.
Request a pilot →