What people ask us most.

armor360 is an AI SOC analyst. It takes the security alerts your tools already raise, investigates each one the way an analyst would and hands your team a plain verdict with the evidence behind it. Your people review the verdict and decide what to do.

No. It detects, investigates, recommends and tells a person. It does not isolate machines, lock accounts or block traffic. Every next step it suggests is for your team to approve and carry out with its own tools.

It makes two kinds of change to your tools, each only after a person approves: adding missing log collection through Elastic Fleet, and switching detection rules on in Elastic. Switching a rule off needs two administrators.

A verdict says whether the alert is a real attack, suspicious, harmless or not sure, how sure the agent is and why, in words a manager can read. Every claim cites the record behind it, and the investigation map shows every question the agent asked on the way.

No. It takes the first look at alerts so your analysts spend their time on the ones that need judgement. People review the verdicts, correct them when they are wrong and make every decision about what happens next.

What changes is where their time goes. Instead of opening each alert cold, they read finished investigations and spend the rest of the day on work that needs their judgement.

During set-up you tell it what your machines do, which business processes they serve, which systems matter most and who to contact. Corrections your reviewers make are remembered, so its picture of your company improves with use.

Wherever you decide. armor360 can run fully on-premises, its AI model included, so alert data does not have to leave your environment. External AI fallback can be switched off. If you prefer, it can be hosted for you instead.

Its own model, fine-tuned by our team for security investigation. You can choose another model, including one you host yourself, and managed providers can choose customer by customer.

It is not a public chat service, and your alerts are not sent to one unless you allow an external fallback. With the fallback off, every investigation runs on the model inside your environment.

On your own hardware, about $0.10 of compute per investigation. That is a running cost, not a price: armor360 itself is priced by quote.

Alerts come from Elastic Security first, and also Splunk, Microsoft Sentinel, CrowdStrike Falcon and Microsoft Defender. Findings go to Slack, Microsoft Teams, PagerDuty, email, Jira and ServiceNow. Threat intelligence comes from MISP, VirusTotal, AlienVault OTX and AbuseIPDB. Sign-in works with Okta, Microsoft Entra ID or any OIDC provider.

Logs can carry text written by an attacker, so armor360’s guard against being talked round sits in code, not only in the prompt. In our tests, no log written to fool the agent turned an attack into a harmless verdict. And a person reviews every verdict.

By quote, sized to the machines and accounts you protect, with no charge per person. The pricing page has a calculator to size a quote and to work out what the first look at alerts costs your team today.

Connect your SIEM, answer the set-up questions about your business and choose who hears about urgent findings. Investigations start on new alerts once monitoring is switched on, and the context you add makes them sharper over time.

Yes. One platform runs a tenant per customer, each with its own people, connections, settings, AI model choice, usage limits and audit trail. Reports can be shared with each customer from their own data only.

Your people. A new rule goes live when a person approves it, after armor360 shows how often it would have fired on your past alerts. Switching a rule off needs two administrators to agree.