Why where it runs matters
Security alerts carry the names of your machines and people, your internal addresses and what your systems were doing. For many organisations, and for regulated ones in particular, sending that to an outside AI service is not an option.
armor360 can run inside your environment with a language model you host, so investigations happen where the data already is.
What fully internal takes
A deployment that keeps alert data inside your environment needs three things settled:
- Local AI endpoints: the language model runs on your own hardware or private cloud.
- External AI fallback turned off, so nothing is sent to a cloud model if the local one is busy.
- Outbound access reviewed for threat-intelligence services, telemetry and other integrations.
Choosing a model
armor360 runs on its own AI model, fine-tuned by our team for security investigations, and it runs on your hardware like the rest of the platform. Local-model support also lets you choose another model suited to your organisation’s workflows, agreed as part of deployment.
What stays the same
Wherever it runs, the platform is the same: the same verdicts and evidence, the same campaigns and hunts, the same approvals and audit trail. Your people still review and decide.
Or have it hosted
If you would rather not run it yourself, we can host armor360 for you and connect it to your Elastic security system. Your team signs in to review the results and decide what happens next.
