All features
The cost of an incident is a function of dwell time. Ransomware that's isolated on one laptop is an anecdote; the same ransomware given a weekend is an existential event. Containment is where detection turns into protection — and where automation must be at its most careful. Vindex runs at two speeds, deliberately: machine speed for the unambiguous, human speed for the judgement calls.
What's Included
Everything you need, nothing you don't.
Host & network response
- Host isolation at the network layer — the compromised endpoint is cut off while the response channel stays open
- One-click firewall blocks pushed across every gateway from a single console
- Lateral movement paths severed automatically across the estate
Identity & process response
- Account lockdown — compromised credentials disabled, active sessions revoked
- Malicious process termination and file quarantine
- Contain-and-investigate mode that preserves forensic evidence
Human control
- Destructive or ambiguous actions — and anything your policy designates — are packaged with evidence and a recommended plan, and wait for named human approval
- Irreversible actions get an explicit confirmation gate, so a 3am misclick can't take down production
- Isolating your finance server during month-end close is a business decision, not just a technical one — that call always has a name on it
Recovery & rollback
- Full rollback capability for every automated action
- Guided de-isolation and restoration once the threat is cleared
- The complete timeline documented in the audit trail
How it works
Precise at every stage.
01
Confirm
Automated triage scores the threat; the evidence and confidence determine the speed of response.
02
Act at machine speed
For unambiguous evidence — a known-malicious hash executing, a confirmed C2 connection — Vindex isolates immediately and tells you what it did. Waiting for a human here costs you the network.
03
Escalate the judgement calls
Ambiguous or destructive actions route to an analyst with evidence and a recommended plan. Approve, modify, or reject before anything changes.
04
Record and recover
Every action, its trigger, its approver, and its reversal path land in the tamper-evident ledger. Guided recovery restores normal operations.
Engineered for trust
Automation you can hand the keys to.
The AI cannot exceed its mandate
Allowed actions are a fixed, auditable list agreed at onboarding. Guardrails only ever restrict — the platform cannot invent new powers for itself.
Every action is evidenced
What triggered it, the confidence score, who (or what) approved it, when it executed, and how it was reversed.
Reversibility is explicit
Every planned action declares whether it can be undone; irreversible ones always require a human.
Right for you if…
Speed matters most when the attacker is already inside.
A weekend incident would currently wait until Monday morning
You want automated response but can't accept a black box acting alone
Your cyber insurance asks about response times you can't yet evidence
You've seen containment tools cause more disruption than the threats they stopped
You might also need
See containment fire on a simulated attack. Book a demo.
Ready to close the gap?
Get enterprise-grade protection running in minutes. No disruption, no long contracts, no lock-in.