A space per customer.
Each customer is a tenant with its own SIEM connections, people, sign-on, model settings, usage limits and audit trail. Your analysts move between the customers they look after; customers see only their own.
Partners
Built for providers who run many customers.
Managed security providers and resellers run armor360 for their customers from one platform, with each customer kept in a space of its own and your analysts reviewing verdicts instead of working each alert from nothing.
What providers wrestle with.
A provider’s analysts do the same first checks across many customers, each with different tools, systems and expectations. Margins live or die in that first look.
Volume grows with each customer
Every new customer brings its own alerts. Without a change in how the first look is done, growth means hiring at the same rate.
Every customer is different
The same alert means different things in a bank and a factory. Analysts carry each customer’s context in their heads, or not at all.
Customers want to see the work
A verdict without evidence is hard for a customer to accept, and harder to defend in a review or an audit.
Separation must be strict
Customer data must never mix. Shared tools make that a matter of discipline rather than design.
One queue of finished first looks.
Alerts from each customer are investigated as they arrive and sorted with likely real attacks first, so your analysts review verdicts instead of working each alert from nothing.
Evidence customers can read.
Each verdict carries its evidence, and investigations can be shared as reports in HTML, Word or PDF, written for the people who receive them.
Campaigns per customer.
Alerts from the same attack on a customer’s machines are joined into one campaign, with its stages, the machines and accounts touched, and one plan whose steps wait for approval.
One platform, a space per customer.
Each customer with its own connections, people, settings and audit trail. An illustrated example.
One platform, a tenant per customerIllustrated example
Customer A Elastic Security armor360 AI, on-premises 4 people, own audit trail
Customer B Splunk armor360 AI, hosted 2 people, own audit trail
Customer C Microsoft Sentinel Their own model 3 people, own audit trail
What a provider gets.
A space per customer
Each customer has its own data, tools, model settings and people. One customer never sees another’s.
One place to work
Your analysts review verdicts for many customers, with the evidence for each one.
Reports customers can read
Findings written for people outside security, shared as HTML, Word or PDF.
People decide
armor360 recommends; your analysts and your customers decide what happens next.
Their sign-on
Okta, Microsoft Entra ID or any OIDC provider, set per customer.
A record of every step
Who approved what, and when, kept for each customer.
Bringing on a new customer.
- 1
Create their space
A new tenant with its own settings, usage limits and audit trail.
- 2
Connect their tools
Read access to the customer’s SIEM, Elastic Security first, and the channels where findings should go.
- 3
Record their context
What their important machines do, which business processes they serve, and who to call.
- 4
Set people and sign-on
Your analysts and the customer’s own people, through Okta, Microsoft Entra ID or any OIDC provider.
- 5
Review and report
Your analysts review verdicts; the customer sees the evidence and the reports.
Frequently asked questions
How are partners priced?
By quote, like every armor360 deployment, sized to the customers and machines you protect, with no charge per analyst. Partner terms are agreed with each partner.
Can we run it on our own hardware?
Yes. The platform and its AI model, fine-tuned by our team, can run in your own environment, or be hosted for you. A customer with strict data rules can also run it on their own hardware.
How is each customer’s data kept apart?
Each customer is a separate tenant with its own connections, people, settings, AI model choice, usage limits and audit trail. Corrections your analysts make for one customer are used for that customer only.
Can customers see the investigations?
Yes, if you choose. Customers can have their own people in their space, and investigations can be shared as reports in HTML, Word or PDF.
Does armor360 take actions in customers’ environments?
No. It investigates, gives verdicts with evidence and recommends next steps. Your analysts and your customers decide and act, under the agreements you already have with them.
Can we try it first?
Yes. A free pilot on one or two customers’ alerts, with your analysts reviewing, shows how it fits your service before you commit.
Read next
See where your team’s time goes. Then decide.
Start a free pilot on your own alerts, or put in your own numbers first.