The AI SOC that investigates every alert, and acts on it.
Most alerts never get a proper look. Kandaro SOC will take the alerts from your EDR, SIEM, identity and cloud tools, together with Kandaro’s own, investigate each one and tell you in plain English which ones matter and why. Then it carries out the response you approved, through the tools you already run.
Alert queue · investigated
- Kandaro DeceptionDecoy NAS login from 10.20.4.77Escalated
- EDREncoded PowerShell on FIN-WS-114Escalated · same machine
- IdentitySign-in from a new country for j.devriesClosed · company VPN exit
- CloudStorage bucket policy changedNeeds a person
Response · waiting for your approval
Isolate FIN-WS-114 through your EDR. It stays reachable for investigation and can be released with one click.
Illustration of planned functionality; details may change before launch.
What we’re building
What Kandaro SOC will do
A verdict for every alert
Each alert will be escalated, closed as benign or handed to a person, with the evidence behind the decision. Nothing sits unread in a queue.
Investigations you can check
Every verdict will show the steps the AI took and the data it looked at, so an analyst can confirm it in minutes instead of redoing it.
A response, carried out
Isolate a machine, disable an account, block an address or stop a hijacked AI agent’s session, through your own EDR, identity provider and firewall, or Kandaro Protection’s agent gateway.
Alert, ask first or act
Set per trigger. A decoy hit has no innocent explanation, so you can let it act on its own there, and ask first everywhere else. Your own scanners go on an allow-list.
Built to resist manipulation
Alerts contain text written by attackers. It will be kept apart from the AI’s instructions, and rules set a minimum severity the AI can raise but never lower.
Every action on record
Every alert, verdict and action kept as an audit trail: what was done, why, on whose approval and how to undo it.
Part of the Kandaro platform
Deception gives it certainty. Emulation keeps it honest.
A decoy hit has no innocent explanation, so Kandaro SOC will use Deception incidents as fixed points when it weighs other alerts from the same machine, and can cut off whoever touched a decoy straight away. Emulation will attack on a schedule and show whether Kandaro SOC caught and stopped each step. Protection gives it a way to stop a hijacked AI agent.
- Every finding explained in plain English
- Same account, same MFA, same Console
- Same alert channels and webhooks
How it responds
It acts through the tools you already run.
Kandaro SOC does not install anything on your machines. Your EDR, identity provider and firewall can already isolate, disable and block; Kandaro SOC tells them when, after you have agreed.
01
Connect
You give Kandaro SOC access to your EDR, identity provider or firewall, limited to the few actions below.
02
Decide
It investigates the alert and proposes a response, explained in plain English.
03
Approve
You approve it in the Console, Slack or email. Or, for triggers you trust, let it act on its own.
04
Act and undo
Your own tool carries the action out. Every action is logged and can be undone.
Isolate a machine
Through your EDR, the security software already on every laptop and server. The machine is cut off from the network but stays reachable for investigation, and is released again with one click.
Planned connections
- Microsoft Defender for Endpoint
- CrowdStrike Falcon
- SentinelOne
Disable an account
Through your identity provider, where your company accounts live. The account is disabled and signed out everywhere, so a stolen password stops working at once.
Planned connections
- Microsoft Entra ID
- Okta
- Google Workspace
Block an address
Through your firewall. Traffic to or from an attacker’s address is blocked at the edge of your network, for as long as you choose.
Planned connections
- Palo Alto Networks
- Fortinet
- OPNsense
Planned, not available yet. Which connections come first is decided with our founding supporters.
Early access
Be first in line.
Kandaro SOC is in development. Join the waitlist and we’ll invite you to early access, and tell you about pricing before launch.
Need protection today? Kandaro Deception is live.