Fine-tuned for investigation
Our model is fine-tuned by our team for the work armor360 does: asking the next question, reading what a search returns, weighing evidence and writing a verdict a person can check.
Our AI model
Our own model, on your hardware.
armor360 runs on its own AI model, fine-tuned by our team for security investigation. It can run fully on-premises, the AI included, so alert data does not have to leave your environment.
Security data is the last thing to send away.
Alerts carry user names, machine names, file paths and the shape of your network. Sending them to someone else’s model is a decision many organisations cannot make.
Where does the data go?
A cloud model means alert data leaves your environment with every question the agent asks.
Rules about residency
Regulators and contracts often say where data may be processed, and by whom.
Cost that grows
Paying per question to an outside model makes every extra investigation a new bill.
A general model
A model trained for everything is not trained for the questions a security analyst asks.
Your alert data stays inside your network.
Run fully on-premises, the platform and the model sit beside your SIEM, and a cloud fallback can be switched off.
Where your alert data goesIllustrated example
Fully on-premises, the AI included
The platform and the model can run on your own hardware, inside your network. With external AI fallback switched off, investigations run without alert data leaving your environment.
- Platform and model on your hardware
- External fallback can be switched off
- Or hosted for you, if you prefer
About $0.10 an investigation to run
Running the model on your own hardware costs about $0.10 of compute per investigation. That is a running cost, not a price: armor360 is priced by quote, with no charge per person.
Guarded against being talked round
Logs can carry text written by an attacker. armor360’s guard sits in code, not only in the prompt, and in our tests no log written to fool the agent turned an attack into a harmless verdict.
How the model runs.
- 1
Install where you choose
The platform and its model run on a server with a suitable GPU inside your network, or we host them for you if you would rather not run hardware.
- 2
Set the boundary
You choose whether anything may fall back to an external AI model. Switch the fallback off and investigations run only on the model you host.
- 3
The model investigates
Our model, fine-tuned by our team, asks the next question, reads what each search returns, weighs the evidence and writes a verdict that cites its records.
- 4
People review the output
Verdicts and recommendations go to a person, who agrees with them or changes them. The model takes no response action, and each approval is recorded.
AI you can run, check and control.
Your hardware
The model runs where your data is.
No cloud required
External AI fallback can be switched off.
Evidence first
Every claim in a verdict cites its record.
Per-customer settings
Providers choose the model and limits for each customer.
Predictable cost
About $0.10 of compute per investigation.
People decide
The model recommends. It takes no response action, and any change to your tools waits for a person.
AI on alerts, with a general cloud service and with armor360.
TopicA general cloud AI serviceWith armor360
Where data goesAlert details are pasted into, or sent to, a hosted AI service outside your environment with each question asked. The model can run on your own hardware, so alert data need not leave your environment.
Fit for the jobA general model answers security questions reasonably well but was not shaped for working through alerts. Our own model is fine-tuned by our team for security investigation: choosing questions, reading results and weighing evidence.
Running costCharges grow with the amount of text processed, so each extra investigation adds to a bill that is hard to predict. On your own hardware, running cost is about $0.10 of compute per investigation, an estimate of cost rather than a price.
FallbackSome tools quietly send work to an outside model when the local one is busy, undoing the point of running locally. External AI fallback can be switched off, so a busy model means a short queue, not data leaving.
Checking answersA chat answer gives a conclusion without the records behind it, so it has to be checked all over again. Each verdict cites the records it relied on, so a person can check any claim against its source.
Frequently asked questions
Is the model built from scratch?
No. It is our own model, fine-tuned by our team for security investigation. Fine-tuning shapes a capable model for one job, in this case working through alerts the way an analyst would and writing verdicts that cite their evidence.
What hardware does it need?
A server with a suitable GPU inside your environment. We size it with you from the number of alerts you expect, as part of the quote. If you would rather not run hardware, armor360 can be hosted for you.
Can we use a different model?
You choose which model the agent uses, including one you host yourself, and whether anything may fall back to a cloud model. Managed providers can set this customer by customer.
Read next
More of the platform
See where your team’s time goes. Then decide.
Start a free pilot on your own alerts, or put in your own numbers first.