SOCGenX
AI-Operated SOC with Continuous Proof — Always on. Always proven.
SOCGenX moves your security operations centre onto AI agents that run inside your own environment, and then keeps proving that it works. Every engagement starts with an assessment of which log sources, detections and alert paths really fire. From there, AI agents triage and investigate around the clock, with analysts reviewing every verdict and approving any response before anything changes. The SOCGenX platform is only the control plane — reports, agent status, approvals and case flow — so your security data never reaches SOCGenX. Every agreed log source, detection and alert path is checked continuously inside your environment.
Key Features
Powerful features designed to solve your security and development challenges.
Starts With an Assessment
A one-off check of your log coverage, log health and MITRE ATT&CK coverage: which detections really fire, which sources have gone quiet, and a prioritised gap list. The assessment fee is credited to the first-year contract.
Continuous SOC Assurance
An agreed, versioned checklist of log sources, detection rules and alert paths is tested on a schedule. When coverage drifts — a source stops sending, a rule stops matching — you hear about it before an attacker finds it, and your auditors get the evidence.
AI Agents Inside Your Environment
Triage, investigation and data processing run on your side, on your infrastructure or in your own cloud account. The SOCGenX control plane only sees fleet metadata and opaque case status; case evidence is read in the browser directly from your environment.
Tier 1 Speed, Tier 2 Investigation
Agents triage every alert against your telemetry, investigate it, and attach the evidence trail behind each verdict, so an analyst can check the reasoning instead of starting from a raw alert.
Graduated Autonomy
Agents move from shadow mode to advising, then to gated actions, and only then to pre-authorised actions. Write actions need an evidence threshold, a rollback path and an approval. Nothing changes in your estate without your sign-off.
Works With the SIEM You Already Have
Wazuh and Elastic are available today. Microsoft Sentinel, Splunk and IBM QRadar are in early access, and Google SecOps is on the roadmap. Alerts and approvals reach your team through the panel, Slack, Teams or email.
Compliance Evidence Mapping
Findings are mapped to the controls your auditors ask about, so the same evidence trail that proves detection also supports your ISO 27001, SOC 2, NIS2 and DORA evidence.
Zero-Day Watch
When a new vulnerability is disclosed, agents check your exposure and your detection coverage for it, and report what is affected and what is already being watched.
Key Benefits
Why organizations choose this solution
Round-the-clock triage and investigation by AI agents, with analysts in the loop
Your security data never reaches SOCGenX — only the control plane does
Proof, not promises: 100% of the agreed checklist is checked continuously
Keep your existing SIEM instead of migrating to a new one
Every verdict ships with the evidence an analyst needs to check it
Response actions only with your approval, and with a rollback path
Use Cases
Common scenarios where this solution excels
Assess — a one-off check of which detections really fire
Assure — continuous validation that your detections still work
Operate — AI agents triage and investigate, with analysts reviewing every verdict
Respond — response recommendations your team approves before anything changes
Launch — security operations for early-stage teams, in early access
Mid-sized organisations with an existing SIEM and more alerts than analysts