Cryvanta AI SOC
Early accessAn analyst desk that never clocks off
Cryvanta's AI analyst triages, investigates and rules on detections around the clock — and shows you every step it took, and every time it chose to hold. It's in early access with design partners today, EU-hosted, and runs on the model you choose.
- Stage
- Early access
- Sensor
- Windows today
- Hosting
- EU only
- Model
- Yours
The desk
Every verdict comes with its reasoning attached
A score tells you nothing you can act on. The analyst shows the events it correlated, the hypotheses it weighed, what it did — and where it stopped and waited for you.
Evidence
- 09:41:02process.createwinword.exe → powershell
- 09:41:02net.connect185.104.· · ·:443
- 09:41:03file.write%TEMP%\up1.dat
- 09:41:03registry.set…\Run\OneDriveSyncer
- 09:41:04process.createrundll32.exe up1.dat
PowerShell download cradle
T1059.001
Analyst reasoning
- Correlated 5 events on WKS-0413 within 2s
- Parent chain matches T1059.001 download cradle
- No change ticket, no maintenance window
- Host holds finance shares — blast radius high
The night shift
Nobody reads forty thousand events
Alerts do not stop at 5 p.m., and the queue that greets a human at 09:00 is mostly nothing. The work worth a person's attention is the last line of this list — and finding it is the job.
One night · one estate
18:00 → 06:00 CET
41,900
Endpoint events
Everything the sensors saw across the estate between 18:00 and 06:00.
312
Rule matches
What the Sigma corpus flagged, at the edge and again in the cloud.
46
Correlated findings
Matches stitched into incidents per host, so one intrusion is one item.
5
Escalated to a human
Cases the analyst could not close on the evidence it had, with its reasoning attached.
1
Held for approval
An irreversible action the analyst wanted to take and would not take alone.
Capabilities
The reading, the reasoning, the response
Alerts don't stop at 5 p.m., and nobody can read every one at 3 a.m. Cryvanta works the queue at any hour — and leaves the judgement calls a human wants to keep.
Triage every finding
The analyst reads each detection with the events around it and decides whether it's real, benign, or worth a human's time — with a rationale attached, not just a score.
Investigate the hard ones
When a finding is ambiguous, it gathers the surrounding activity, weighs competing explanations, and writes up its reasoning before it commits to a verdict.
Contain, when you allow it
It can quarantine a file or stop a process — but irreversible actions hold for a human unless you've explicitly told it otherwise.
Sharpen its own detections
Patterns it sees repeatedly become proposed detection-rule changes, compile-checked and put in front of an operator before they go live.
What's live
What's working, and what isn't yet
Early access means genuinely useful and genuinely unfinished at the same time. Here's the honest split so you can decide if now is the right time to start with us.
Live today
- AI analyst: triage, investigation and verdicts
- Windows endpoint sensor + cloud pipeline
- Safety brakes, most shipping in shadow mode
- Multi-tenant console with per-tenant isolation
- GDPR erasure & audit-log retention controls
Ahead of us
- macOS and Linux endpoint sensors
- General availability beyond design partners
- SOC 2 and independent certification
- Self-service tenant onboarding
The safety brakes and the pipeline are covered in depth on the platform page.
Sovereignty
Your model, your region, your ceiling
Your model
Run the analyst on Anthropic, or an EU-hosted model that meets your residency rules.
Your region
Telemetry, findings and history stay in the EU. Nothing has to leave the continent.
Your budget
A hard spend cap sits in front of every model call, so autonomy never becomes an open tab.
Design-partner programme
Shape it while it's being built
We're taking on a small number of EU organisations as design partners. You get the platform early and a real say in where it goes.
Direct line to the builders
You work with the people writing the code. Feedback lands in the product in days, not quarters.
Your scenarios, prioritised
We tune the analyst and the detections against the threats that actually matter to your estate.
Honest reporting throughout
You'll always know which behaviours are enforced, which are shadowed, and what's still on the bench.
Join the early-access programme
If you're an EU organisation weighing up AI-native detection and response, we'd like to hear what you're up against. No pressure, no oversell.