FAQ

Frequently asked questions

The Solomon products, how they are delivered, how AI agents are kept in check, pilots and compliance.

The products

What does VIntercept offer?: The Solomon platform: the Solomon eBPF Client (kernel-level EDR and CDR for Linux), the Solomon Agentic AI Platform (the multi-tenant backend), Solomon SOC (the agentic SOC), Solomon OmniMesh (connectors and remediation), Solomon XGuard (mobile approvals on iOS and Android) and the SolomonPy and SolomonJS SDKs. We also run services on top of it.
What is Solomon SOC?: An agentic SOC with six AI agents that share one memory: Triage, Investigate, Hunt, Detect, Respond and Ask Solomon. Every alert is investigated end to end with evidence you can check line by line; measured investigations finish in < 8 min.
How is the eBPF Client different from a traditional EDR?: It decides on the system call itself, inside the Linux kernel. Credential theft is denied before the read completes and an attacker's process tree is killed in place. In our emulated AI-agent swarm evidence run, containment took < 300 µs.
Do I have to replace my SIEM or EDR?: No. OmniMesh connects the identity, EDR, cloud, SIEM and ticketing tools you already own (35 native connectors today), and the agents work on their data.
Is Solomon XGuard available?: XGuard, the mobile app for biometric, hardware-signed approvals, is available on the App Store and Google Play, with push notifications for every request. Your admins connect it to your identity provider in the VIntercept portal.

How is Solomon delivered?: As multi-tenant SaaS, through Solomon SOC, or as a platform your own products build on with the SDKs. The eBPF Client runs on your Linux hosts and Kubernetes nodes. If you have specific deployment requirements, talk to us.
How is my data kept apart from other customers'?: Each tenant gets its own database, event streams, storage, vector memory and secrets. The tenant is taken only from a verified token claim, never from a header or request body.
Where does the eBPF Client run?: On Linux hosts, containers and Kubernetes nodes, including EKS. It is tested on a 14-target kernel matrix on disposable EC2: Amazon Linux 2023 (incl. the EKS AMI) and 2, RHEL 9, Ubuntu 20.04, 22.04 and 24.04, on x86_64 and arm64.

How do you stop AI agents from doing harm?: Every action an agent proposes first passes a deterministic layer of 10,000+ YARA and Sigma rules and the tenant's autonomy cap, which no alert can exceed. Destructive actions need human approval, and agent identities can propose actions but never approve them.
Can I see why an agent reached a verdict?: Yes. Investigations record the hypotheses they rejected and link every claim to its evidence, and every action and approval is written to the tenant's audit log.
Where do your numbers come from?: Each figure on this site names its source. The security numbers come from our emulated AI-agent swarm evidence run; the method and results are on the evidence page.

Can I try it on my own infrastructure?: Yes. Request a pilot and we will scope a guided pilot on your own workloads with you.
How is pricing structured?: It depends on what you deploy and how much of it. Talk to us for a quote.
Do you work with MSSPs and partners?: Yes. See partners or contact us.
Does Solomon make us compliant with HIPAA, PCI DSS or similar?: No product does that on its own. Solomon keeps the evidence trail many frameworks ask for (how events were detected, investigated, approved and handled), which helps you meet requirements such as HIPAA, PCI DSS, SOX and NIST SP 800-53. For our own security documentation, contact us.

Talk to us, or see the answers on your own workloads in a guided pilot.