Skip to content

53,600 AI-swarm attacks. Every one stopped in the kernel. 0 bytes leaked.See the evidence

Solomon SOC · agentic security operations

Every alert, answered with evidence.

Six AI agents share one memory and investigate every alert the way your best analyst would: they ask the questions, run the queries and reach a verdict you can check line by line, in under 8 minutes.

Request a pilot Open the console
Investigate · SOL-2291 · svc-deploysimulated
  1. hypothesisSession token replayed from a second network after MFA fatigue
  2. queryidp.signins | principal = "svc-deploy" | last 6hidp
  3. result14 sign-ins · 2 ASNs · 9 MFA pushes denied, then 1 approvedE1
  4. querymemory.baseline("svc-deploy", "login_hours")memory
  5. resultusual 08:30–18:10 UTC · this sign-in 02:14 UTCE2
  6. querycloud.audit | actor = "svc-deploy" | after 02:14cloud
  7. resultListBuckets ×31 · first time in 30 daysE3
  8. rejectedVPN egress change: no matching change ticket, ASN not owned
Malicioushigh confidence · 3 evidence itemsRespond: revoke sessions · needs approval

A simulated investigation. Every result links to its evidence.

Measured

Agentic investigation1
< 8 min
agents, one shared memory2
6
lower AI cost per investigation3
92%
native connectors through Solomon OmniMesh4
35
  1. 1Measured end-to-end Solomon SOC agentic investigations (owner-confirmed, 19 Oct 2026).
  2. 2Agents in Solomon SOC (Triage, Investigate, Hunt, Detect, Respond, Ask Solomon), all reading and writing one shared memory: SolomonSOC frontend/src/site/content/agents.ts.
  3. 3VIntercept proprietary multi-model routing vs blind model calls, median of 100 tickets, answer quality held at 100%.
  4. 4Connectors in the portal's integrations catalog today; the number updates as the catalog grows.

The agents

Six agents. One memory.

Each agent does one job well and hands off to the next. They read and write the same memory, so what Investigate learns today, Triage and Hunt use tomorrow.

  • Triage · weighs

    • Ranks every alert by what it could cost you, with a one-line reason
    • Groups duplicates into one case and checks entity baselines and past verdicts
    • Closes known-benign, sends to Investigate, or puts it in front of a human now

  • Investigate · traces

    • Plans which sources to query before it runs anything
    • Records rejected hypotheses and why
    • Reaches a verdict with a stated confidence and links every claim to evidence

  • Hunt · probes

    • Proposes hunts from recent verdicts, threat intelligence and changes in behavior
    • Runs them on a schedule or on demand
    • Promotes confirmed findings to cases

  • Detect · codifies

    • Turns what investigations learn into new or tuned rules
    • Backtests each change against your historical data before anyone ships it
    • Maps coverage to MITRE ATT&CK, with version history and rollback

  • Respond · contains

    • Proposes the smallest action that stops the threat, least disruptive first
    • Shows the blast radius and how to roll back each step
    • Requires approval for destructive actions by default

  • Ask Solomon · answers

    • Answers in plain language about any case, entity or time window
    • Cites the cases and evidence it used
    • Sees only the data the asking analyst is allowed to see

Memory

Solomon remembers how everything behaved.

For every host, identity and service, Solomon keeps a timeline of facts: what was true, from when, until when. That is how it can tell a sign-in is unusual for this account at this hour, or show exactly what changed on a host between last Tuesday and now.

Baselines such as login hours, network peers and API patterns are learned per entity, not hard-coded.

Memory · iam_principal · svc-deploy15 Sep – 14 Oct 2026
role
reader → poweruser
6 Oct
mfa
push → reset, re-enrolled
9 Oct
new peer
203.0.113.140
10 Oct
sign-ins
14 that day · baseline 3–5
11 Oct
verdict
SOL-2291 malicious
12 Oct

Ask what was true at the moment of the incident, not what is true now.

Control

Autonomy you dial up.

Set, per agent and per action, whether Solomon suggests, asks for approval each time, follows your policy or acts on its own. Every auto-close is in the audit log, and every action the agents propose still passes the platform’s deterministic rule layer.

Each customer’s data is isolated in its own schema and tenancy is enforced on every request, so the same console serves single teams, multi-entity companies and MSSPs. Analysts work in it at solomonsoc.com.

Autonomyexample · per agent, per action
Close known-benign alerts
acts on its own
Revoke a user's sessions
follows your policy
Rotate credentials
asks each time
Isolate a host
suggests only
Destructive actions show blast radius and rollback first.kill switch

Solomon platform

The rest of the loop

Let’s stop the swarm, together.

Run Solomon against your own workloads in a guided pilot. We’ll show you the kernel log, the investigation and the approval, on your infrastructure.

Request a pilot Talk to us