From the kernel to a human signature, in one loop.

How it works

Speed without trust is useless.

CISOs won’t let a probabilistic AI touch production on its own. Solomon splits the work into four layers so you get both: kernel speed and a human gate.

1. 1 · Kernel actsSolomon eBPF ClientApproved containment executes on the host in under 300 µs, before lateral movement.< 300 µs›
2. 2 · AI agents thinkSolomon Agentic AI PlatformAutonomous multi-agent response. Every proposed action passes a deterministic layer of 10,000+ YARA and Sigma rules.10,000+ rules›
3. 3 · Agentic investigationSolomon SOC + OmniMeshAn analyst starts an agentic investigation that reasons across every connected tool with high-impact forensics.< 8 min›
4. 4 · Human approvesSolomon XGuardA biometric, hardware-signed approval on a phone for any critical AI-agent action.1 tap

Products

Five products, one memory.

• Kernel actsSolomon eBPF ClientLinux EDR and cloud workload protection. Contains AI-agent swarms inside the kernel, before lateral movement.Containment< 300 µsExplore eBPF Client →
• AI agents thinkSolomon Agentic AI PlatformMulti-tenant SaaS and PaaS. Autonomous agents analyse every signal, and every action they propose first passes a deterministic layer of 10,000+ YARA and Sigma rules.Deterministic rules10,000+Explore Agentic AI Platform →
• Agentic investigationSolomon SOCSix agents, one memory. Every alert triaged, investigated and answered with evidence you can check line by line.Agentic investigation< 8 minExplore SOC →
• Correlate and remediateSolomon OmniMeshConnects the cloud, identity, EDR, SIEM and ticketing tools you already own, correlates their signals end to end and acts back on them.Native connectors35Explore OmniMesh →
• Human in the loopSolomon XGuardBiometric, hardware-signed approvals on your phone for any critical action an AI agent wants to take, including your employees' own coding, ops and personal agents.Every approvalsingle-use grantExplore XGuard →
• DevelopersSolomonPy and SolomonJSSDKs that bring Solomon intelligence (detections, hosts, investigations) into your own applications and third-party tools.SolomonPy →SolomonJS →

Measured

What the loop delivers.

Containment¹

< 300 µs

Deterministic rules²

10,000+

Agentic investigation³

< 8 min

Native connectors⁴

35

1. 1Emulated AI-agent swarm evidence run, 1 Oct 2026: credential-file theft denied in 6–34 µs, process-secret dumps in 15–31 µs, attacker process tree killed in 31–130 µs, IMDS theft in 55–200 µs (medians).
2. 2YARA and Sigma rules applied in the Platform's deterministic layer (owner-confirmed, 19 Oct 2026).
3. 3Measured end-to-end Solomon SOC agentic investigations (owner-confirmed, 19 Oct 2026).
4. 4Connectors in the portal's integrations catalog today; the number updates as the catalog grows.

Foundations

Built to be trusted with production.

• Multi-tenant from day one

  • Each customer is its own tenant with its own identity organisation
  • Tenancy is enforced on every request, from verified claims only
  • Built for enterprises and for MSSPs running many customers

• SaaS and PaaS

  • Use Solomon as a service, with the SOC console and XGuard on top
  • Or build on it: SolomonPy, SolomonJS and the REST API through the gateway
  • Bring Solomon intelligence into your own tools and workflows

• Deterministic governance

  • Every action an AI agent proposes is checked against 10,000+ YARA and Sigma rules
  • Policies and commands are signed by the Platform and verified on the host
  • Critical actions can require a human signature in XGuard before they run

• One way in

  • Endpoints, consoles, mobile apps and SDKs reach the Platform only through the gateway
  • Endpoints use mutual TLS; people sign in with OIDC
  • No client talks to Platform databases or queues directly