The hub that decides — with a human in the loop, in the DriverSeat: every specialist's findings become one incident, one plan, one governed response.
One overview that learns for everyone: each customer's defence learns from every other's — without any customer's data leaving their walls. Signals shared only when at least five customers carry them. A confirmed movement becomes a governed, human-approved block across the fleet.
Phishing, BEC and malware triage at inbox speed — every message read, every link and attachment assessed.
Signs its assessment · proposes actions · never executes · every step on the HexaRecord chain
The specialists' assessments run on the fleet's own trained models, on the fleet's own hardware. The advisory assistant that answers questions and writes investigation reports is a separate, configurable model — never in the decision path.
One incident, one governed loop: born in the customer's world, taken in under lease, assessed and signed by the seven specialists, correlated into one plan, gated by the CCAS tier that fits, and carried back as a governed response — every step on the HexaRecord chain. Press play, or pause to read any step.
Detection finds what it was told to find. Investigation finds the rest — across the whole history, every source included. A fixed, read-only plan runs first; the report is written from those facts alone, and a sentence naming anything not in the facts is dropped and counted. Ask a follow-up and the assistant answers with read-only queries, each one listed and replayable. It cannot execute, block or propose.
Foundation (17 playbook modules), Specialist operations (62 modules) and Threat Hunter — a practical graded by the fleet against a planted intrusion. A question mark on every screen answers in the product's own words: over 330 entries, five role tracks, a nine-step Test Drive. Every analyst decision becomes a labeled example the specialists train on next.