Platform — Vulneron

02 · Aggregate

SIEM, without the data lake.

Replaces Splunk, Panther, Elastic SIEM. The Aggregate agent reads logs in place — inside your AWS, GCP, or Azure account, against a read-only role you grant. There's no Vulneron-side warehouse to fill and no per-GB invoice to fear at the end of the month.

Zero standing log egress. Bytes leave only when an incident is open — and only the slice tied to that incident.
Pricing decoupled from volume.Your CloudTrail can grow 10× and your invoice doesn't move.
Regulatory math gets easier. Audit and data residency questions get a one-sentence answer: the data didn't leave your account.

See it on your stack→

Your AWS account

CloudTrail3.8B events/day

Logs at rest$0 to Vulneron

Roleread-only · scoped

incident slice only~180s window · 1 principal

Vulneron control plane

Storedincident slice

EncryptionBYOK · KMS

Retention90d default

$0log egress, by architecture

~180stypical slice pulled for triage

3cloud providers · 28 connectors

attack agent · live · sg-114:02:11 — chain #248

01Found public S3 with stale role etl-svc-v2recon

02Assumed etl-svc-v2 via instance metadata leakchained

03Pivoted to iam:PassRole → build-deploychained

04Listed S3 buckets · enumerated audit-trail-prodP1 path

05Stopped before exfil. Reported, ticketed, attached repro.contained

hourlyvs. quarterly pentests

100+live engagements informed the model

~24hfrom fix to retest

03 · Attack

Continuous offensive validation.

Replaces Pentera, XBOW, and the quarterly pentest line item. The Attack agent chains real exploit paths against your live stack every hour — not once a year, by a consultant, against a pre-staged target.

Trained on real engagements. 100+ live pentests across regulated fintech, healthcare, AI startups — not synthetic CTFs.
Scoped per environment. Production is read-only by default; staging gets full chains; you control the scope.
Verifies the fix. Every remediation gets re-tested by morning — no quarterly drift between pentests.

04 · Analyse

Triage that reasons about chains, not alerts.

Alerts arrive in the hundreds. Chains arrive in the tens. The Analyse agent groups raw events into causal chains, scores each against your environment, and writes the verdict in the language a human would use on the next page — not in CEF.

Context-aware. An IAM AssumeRole from an EC2 in us-east-1 is normal; the same call at 03:00 from a residential IP is a chain.
Verdict in seconds. The Analyse agent runs locally in the customer account where possible; only the verdict + supporting slice cross the boundary.
Every verdict is auditable. Reasoning, evidence, model version, and confidence ship with the alert.

How this becomes 24/7 cover→

P1 · chainProduction role assumed from new ASN14:02:11 SGT

Chain length4 events across 11s

Confidence 0.94 · novel

Suppressed17 noisy children rolled into this chain

Why it fired

✓Principal build-deploy never called iam:PassRole in last 90d
✓Source ASN AS396982 — first seen in your environment 22s ago
✓Targetmatches today's Attack agent finding · linked

✓Auto-escalated to on-call. Containment proposal attached.2.1s

Act · containment proposals · last 30d

↻Revoked session for build-deploy · 4 active tokens14:02:14 · auto

⛔Quarantined EC2 i-0a8f via SG vlnr-quarantine14:02:18 · auto

⇆Rolled IAM policy · removed iam:PassRole on build-deploy14:02:24 · paged human

✎Opened PR in infra/iam with codified fix + repro14:02:31 · auto

📓Wrote post-mortem draft · attached chain + repro14:03:42 · auto

0playbooks to author

~2sverdict → first containment

every actionreversible · explainable

05 · Act

SOAR, without the playbooks.

Replaces Tines, Torq, Splunk SOAR. No YAML rulebook to maintain. The Act agent chooses containment in context — revoke tokens, quarantine workloads, roll policy, open a PR with the codified fix — and explains its reasoning before it touches anything.

Every action reversible.Containment ships with the undo command attached; no "press the big red button" surprises.
Boundaries enforced by you. Production-touch actions can require human approval — proposed in seconds, executed when approved.
Codified fix, not just contained. The Act agent opens a PR with the IAM / SG / policy change so the root cause is gone, not just the symptom.

The 24/7 analyst

An analyst that doesn't sleep, blow alerts, or quit.

Replaces the 3–5 analyst follow-the-sun rota that costs $300–500K/yr to staff and forever to recruit. Most breaches start at 2 AM Saturday. Vulneron is the one on shift — every signal triaged, every escalation reasoned, every page already has a verdict and a containment proposal.

Page only when a human is needed. 96% of signals close without one. The 4% that page you arrive with a verdict, not a question.
Hands off to your team in their language. Slack, PagerDuty, Linear, Jira, email — with the chain, repro, and proposed action attached.
Always available · always learning.Yesterday's contained incident sharpens today's detections.

on-shift · last 24hno humans paged

02:00–06:002,148 events · 47 chains · 3 contained · 0 paged

06:00–10:001,910 events · 38 chains · 2 contained · 0 paged

10:00–14:003,402 events · 61 chains · 4 contained · 1 paged (production touch)

14:00–18:002,994 events · 52 chains · 3 contained · 0 paged

18:00–22:002,180 events · 41 chains · 2 contained · 0 paged

22:00–02:001,756 events · 33 chains · 1 contained · 0 paged

Asset graph · last sync 14:02 SGT

Cloud accounts12

Identities2,118

Secrets in scope88

Public surfaces14

Repos204

SaaS connected31

Exposed data stores2

Privileged roles48

01 · Assess

Every asset, identity, and exposure — in one graph.

Before agents can act, they need a model of the world. The Assess agent builds a continuous graph of every account, identity, secret, surface, and dependency — across cloud, code, SaaS, and humans. Updated continuously, queryable by every other agent.

Continuous, not quarterly. The graph re-syncs on every change event, not on a calendar.
Identity-aware. Service principals, OIDC federations, and break-glass humans all land in one model.
Queryable. "What can build-deploy reach in production?" gets an answer in seconds.

06 · Adapt

Detection-as-agent, not detection-as-code.

A five-year-old static rules library misses anything novel. The Adapt agent watches your stream and generates new detection logic from your data — every contained incident becomes a sharper signal for the next one. Rules emerge from your environment, not a sprint backlog.

Zero rules to author. No detection-as-code repo, no YAML sprawl, no SOC engineer in the loop.
Drift-free. When your environment changes, the detection adapts the same day.
Diff-able. Every new detection is a reviewable artifact — accept, reject, or tighten in one click.

agent-generated · last 7d · accepted by your team

D-0291etl-svc calling iam:PassRole from outside us-east-1caught 38s

D-0292Lone push to main without preceding CI runlive

D-0293build-deploy writing to audit-trail-prodlive

D-0294Okta MFA reset from new device + new ASN within 5 mincaught 1.4m

D-0295Postgres role analytics_ro running COPY to external bucketlive

—Rules written by humans this week0

Data in customer custody

Your logs never leave your cloud. The only architectural decision that matters.

Every other SIEM vendor pipes your logs into their data lake. You pay the egress. They carry the regulatory burden — until they don't. We refused to build that, so the math, the contracts, and the audit story all changed.

No data lake

There is no Vulneron-side warehouse to subpoena, leak, or charge you for. The agent runtime reads logs in your account, with a role you scope.

Incident-only egress

The only bytes that leave your account are the minutes-long slice an active chain needs for triage. Verdict reached, slice expires.

BYOK encryption

Incident slices are encrypted with keys you hold in your KMS (Scale plan and up). Rotate, revoke, observe — same controls as your own data.

Residency you choose

Workspaces pin to us-east-1, eu-west-1, or ap-southeast-1. The inference path stays in-region. Auditors get the diagram up front.

Connectors

Day-one coverage across cloud, identity, and code.

All connectors are read-only by default. Production-touch actions require an explicit role binding you grant during onboarding. Missing one? We ship new connectors weekly — write to founders with what you need.

Cloud

AWSGCPAzureCloudflareDigitalOcean

Identity

OktaGoogle WorkspaceEntra IDJumpCloudAuth0

Workloads

KubernetesECSLambdaCloud RunVercel

Code · CI

GitHubGitLabBitbucketCircleCIBuildkite

SaaS · data

SnowflakeDatabricksPostgresMongoDBSalesforce

On-call · ticketing

SlackPagerDutyLinearJiraincident.io

Six agents. One loop. Zero data leaving your cloud.

One loop, six phases. Each phase is its own agent — autonomous, observable, accountable.