Skip to content

Platform

Early access

From a single signal to a defensible verdict

Cryvanta is a detection pipeline with an AI analyst as its backbone. The plumbing narrows a flood of endpoint events down to real findings; the analyst reasons about each one — and shows its work, and its brakes, to the human in the loop.

Sensor
Rust, user mode
Transport
Mutual TLS
Rules
Sigma, edge + cloud
Region
EU-hosted

The pipeline

Five stages, one continuous path

Each stage does one job well and hands off to the next. The design keeps the endpoint fast and deterministic, and puts the expensive reasoning in the cloud where it can be governed.

  1. 01SENSOR

    Endpoint sensor

    A lightweight Rust agent watches the endpoint and emits structured telemetry. It runs in user mode — no kernel driver — so a sensor fault degrades to lost telemetry, not a downed machine.

    Windows now · macOS & Linux on the roadmap

  2. 02DETECT

    Detection engine

    One Sigma evaluator, compiled into both the sensor and the collector, matches normalised events against the rule corpus. Because it is literally the same code on both sides, rule semantics can't drift between edge and cloud.

    One rule set, edge + cloud

  3. 03CORRELATOR

    Collector & correlation

    Findings stream over mutual-TLS to a collector that re-evaluates in the cloud, stitches related events per host and per tenant, and writes a durable record.

    Multi-tenant · EU-hosted

  4. 04ANALYST

    AI analyst desk

    An LLM reasons over each finding with the events around it — rules on the obvious cases, investigates the ambiguous ones, and proposes new detections.

    The backbone, not a bolt-on

  5. 05CONSOLE

    Operator console

    A multi-tenant console where a human sees what the analyst decided, why, and anything it chose to hold for review.

    Where a person stays in command

Under the hood

The parts, named

Most platform pages show five rounded boxes and an arrow. This is the actual workspace — seven repositories, in the order they are built — because the part that is hard to copy isn't the diagram.

cryvanta/7 repositories · one pipeline
  1. sensorcaptureRust, user mode. Windows today; a fault costs telemetry, not the machine.
  2. protowireThe shared schema every stage agrees on, so nothing normalises twice.
  3. detectrulesOne Sigma evaluator, compiled into the two crates marked above and below.
  4. correlatortransportMutual-TLS ingest, cloud-side evaluation, durable per-tenant records.
  5. triageanalyzeThe LLM analyst. Verdict, rationale, confidence — under a hard spend cap.
  6. evalevaluateDetection regression, so a rule change cannot quietly cost coverage.
  7. socconsoleMulti-tenant operator console. Where a person stays in command.
One rule set, edge and cloud. The detection engine is a library, not a service — the same compiled code evaluates on the endpoint and again in the collector, so a rule cannot mean one thing in one place and something else in the other.

The analyst desk

The model does the analyst's reading

A human analyst spends most of their day reading logs and deciding what matters. That's the work we automate — using the smallest model that clears the bar for each task, not the biggest one for all of them.

01

First-pass verdict

Every finding gets a fast, cost-efficient model that labels it true positive, false positive, needs-more-info or escalate — with a rationale and a confidence score.

02

Deep investigation

When the finding isn't clear on its own, a stronger model pulls the surrounding events, weighs competing hypotheses, and writes up what it found before deciding.

03

Closed-loop hardening

Once a pattern recurs, a new Sigma rule is drafted from the cluster and validated by a real Sigma compiler before an operator sees it. Drafts that don't compile are flagged as such rather than shown as ready to ship, and every one waits in an accept/reject queue.

The provider is pluggable. Default to Anthropic, or point the analyst at an EU-hosted model to keep reasoning in-region — the same bring-your-own-model choice that underpins our sovereignty story.

Safety brakes

Autonomy is only safe with brakes

An AI that can act on your estate needs to know when not to. Cryvanta's brakes are first-class features, not disclaimers — and the more autonomous behaviours start in shadow or off, so you enable them as you build trust.

Holds on irreversible actions

Quarantine, isolate, kill — anything you can't cleanly undo can be held for a human sign-off instead of executed automatically.

Argues against itself

A separate pass plays devil's advocate against the verdict. If the case for acting is weak or the evidence is thin, it pumps the brakes.

Shadow before enforce

New autonomous behaviour runs in shadow first — it shows what it would have done, with no effect — so you can watch it before you trust it. Off by default.

Spending is capped

A hard budget cap stops model spend before a call is made, so an autonomous system can't run up an open-ended bill.

Straight talk

The pipeline, the analyst and the console are real and running. The endpoint sensor is Windows-only today, several of the autonomous behaviours ship in shadow mode, and the platform is in early access rather than general availability. We'll show a design partner exactly what's enforced, what's shadowed, and what's still ahead.

See it on your own telemetry

Join the early-access programme and we'll walk the pipeline end to end — including every brake — against a scenario that matters to you.

Join early access About the AI SOC