Rules that exist but never run.
Detections are written, then disabled during a noisy week and never switched back on.
AI security operations
AI on both sides. Proof on yours.
Always on. Always proven.
Attackers now use AI to break in and spread in seconds. SOCGenX AI agents triage and investigate the alerts in your SIEM, and every verdict ships with the evidence an analyst needs to check it.
Two sides
The same technology now works on both sides of the alert.
Attacker AI
What AI-driven attackers do
- Scan for exposed systems around the clock.
- Write convincing phishing in any language, at scale.
- Move from first access to lateral spread in seconds.
- Exploit new vulnerabilities before a patch ships.
27 sec
fastest recorded eCrime breakout time
CrowdStrike, 2026 Global Threat Report (2026)(opens in a new tab)-7 days
mean time to exploit vulnerabilities, so exploitation often starts before a patch exists
Google Cloud / Mandiant, M-Trends 2026 (2026)(opens in a new tab)80-90%
of a reported cyber-espionage campaign performed by AI, with humans needed only sporadically
Anthropic, Disrupting the first reported AI-orchestrated cyber espionage campaign (2025)(opens in a new tab)
Defender AI
What SOCGenX agents do
- Triage every alert and check it against your telemetry.
- Designed to investigate in seconds, with analysts in the loop.
- Attach the evidence trail behind each verdict.
- Check each finding against the controls your auditors ask about.
The evidence
Every alert our AI agents raise ships with the evidence an analyst needs to check it.
27 sec
fastest recorded eCrime breakout timeCrowdStrike, 2026 Global Threat Report (2026)(opens in a new tab) -7 days
mean time to exploit vulnerabilities, so exploitation often starts before a patch existsGoogle Cloud / Mandiant, M-Trends 2026 (2026)(opens in a new tab) 80-90%
of a reported cyber-espionage campaign performed by AI, with humans needed only sporadicallyAnthropic, Disrupting the first reported AI-orchestrated cyber espionage campaign (2025)(opens in a new tab) 204
nationally significant incidents handled by the NCSC in a year, up from 89NCSC, Annual Review 2025 (Incident management) (2025)(opens in a new tab)
The problem
Green dashboards, dead detections.
A rule can show as active on a dashboard long after the data it depends on stopped arriving. Often nobody notices until an incident.
Log sources that went quiet.
A parser changes or an agent stops sending, and the rule that depends on it goes blind without an error.
Alerts no one can check.
A verdict without its evidence leaves the analyst to start the investigation again.
Coverage
Four levels between a rule and real protection.
A detection only protects you when the rule exists, is enabled, receives healthy data and has been validated against the behaviour it should catch.
- Rule exists
- Rule enabled
- Data healthy
- Validated
How it works
Assess, assure, operate, respond.
Start with a read of your current coverage, then let AI agents keep it proven and working, with your team approving every action.
Step
Assess
A one-off check of which detections really fire.
Step
Assure
Continuous validation that your detections still work.
Step
Operate
AI agents triage and investigate, with analysts in the loop.
Step
Respond
Response recommendations your team approves before anything changes.
Architecture
What stays with you, what we see.
Raw logs and telemetry stay in your environment. SOCGenX works from detection metadata and verdicts, and keeps an evidence ledger you can audit.
Agents
AI agents do the legwork. People make the calls.
Tiered AI agents triage, investigate and recommend a response. Your analysts approve, escalate and tune.
Zero-Day Watch
When a critical CVE lands, we check your exposure.
We check whether you are exposed, deploy a temporary rule that has been tested, and tell your team what changed.
Integrations
Works with the SIEM you already run.
SOCGenX connects to the six SIEMs below through their own APIs, read-only by default. Each tile carries its status.
- Wazuh Available
- Elastic Available
- Microsoft Sentinel Available
- Splunk Available
- IBM QRadar Available
- Google SecOps Available
- Slack Early access
For startups
A SOC 2 or DORA deadline and no security team yet?
Launch gives early-stage teams a starter detection set and managed triage, with an evidence trail built to support your SOC 2 evidence. Launch is in early access.
- Starter detection set
- Managed triage
- Room to grow into Operate
Packages
Pick the level of help you need.
Every package is scoped with you, so prices are not listed here. Talk to us about yours.
Assess
A one-off check of which detections really fire.
- Detection coverage snapshot
- Rule and data health review
- Prioritised gap list
Assure
Continuous validation that your detections still work.
- Scheduled detection tests
- Coverage drift alerts
- Evidence for your auditors
Operate
AI agents triage and investigate, with analysts in the loop.
- Alert triage by AI agents
- Investigation with evidence trails
- Analyst review of every verdict
Respond
Response recommendations your team approves before anything changes.
- Response recommendations
- Approval before any action
- Post-incident evidence pack
Launch
Security operations for early-stage teams, in early access.
- Starter detection set
- Managed triage
- Room to grow into Operate
Trust
Your data boundary stays where you draw it.
- Raw logs stay in your environment.
- Response actions run only after your team approves them.
- Every verdict links to the evidence behind it.
Compliance evidence
Built to support the evidence your auditors ask for
- Built to support your SOC 2 evidence
- Built to support your ISO 27001 evidence
- Built to support your DORA evidence
- Built to support your NIS2 evidence
- Built to support your UK Cyber Essentials evidence
- Built to support your HIPAA evidence
- Built to support your PCI DSS 4.0 evidence
- Built to support your NIST CSF 2.0 evidence
- Maps to MITRE ATT&CK
- Built to support your GDPR / UK GDPR evidence
FAQ
Questions security teams ask.
What is an AI SOC?
An AI SOC is a security operations center where AI agents do the alert work: they triage each alert, investigate it against your telemetry and attach the evidence behind every verdict. In SOCGenX the agents run in your environment and analysts approve every response action.
Where do people stay in the loop?
AI agents triage and investigate. Analysts approve every response action, decide on escalations and tune detections.
Which SIEMs can we connect today?
Wazuh, Elastic, Microsoft Sentinel, Splunk, IBM QRadar and Google SecOps. The agents connect through each SIEM's own API, read-only by default, and the integrations page lists the status of each one.
Does our raw log data leave our environment?
Raw logs and telemetry stay with you. SOCGenX works from detection metadata and verdicts, and records evidence references in the ledger.
How does SOCGenX help with audits?
Each verdict carries an evidence trail you can map to the controls your auditors ask about, built to support your SOC 2, ISO 27001, DORA and NIS2 evidence.
What is the free snapshot?
A read-only look at which of your detections really fire: whether each rule exists, is enabled, has healthy data and has been validated. You get a prioritised gap list.
Can the agents act on their own?
Agents recommend containment steps. Nothing changes in your environment until an analyst approves it.
Attackers automated. So did we.
See how SOCGenX AI agents would work on your alerts, or start with a free snapshot of your detection coverage.