Core capabilities
Detection through to evidence, in one engine.
The agent team
One job each, strict permissions, a supervisor.
Vindex isn't “an AI” bolted onto a dashboard. It's a coordinated team of specialised agents working the way a great SOC team works, at machine speed.
Triage agents
Classify every alert against MITRE ATT&CK and score it with calibrated confidence.
Enrichment agents
Pull threat intelligence and behavioural context for every indicator.
Threat intelligenceInvestigation agents
Run bounded, read-only deep-dives on high-risk signals — pulling evidence until the picture is clear.
Verification agents
Cross-check conclusions before anything acts on them — a built-in hallucination net.
Response agents
Execute agreed containment actions, and only those.
Explanation agents
Turn every decision into a narrative a human can audit.
Governed, not just capable
How the AI is held accountable.
What makes Vindex different is not that it uses AI — it's how the AI is held accountable.
Deterministic guardrails at four layers
Inspect inputs before the AI sees them, restrict what tools it may use, firewall its outputs, and continuously red-team the whole system. Guardrails can only ever restrict the AI — never expand it.
Deterministic routing
How much AI analysis an alert receives is decided by transparent rules, not by another AI. Costs and behaviour stay predictable.
Bounded reasoning
Every investigation loop has a hard budget and must show progress to continue — no runaway agents. Exhausted budgets escalate to a human, never to silence.
Human authority
Consequential actions require named human approval. The system learns from every analyst decision and earns autonomy only where it has proven itself.
Privacy by architecture
Personal data is anonymised before any AI model call. Threat-intel lookups are the only external calls that ever see a real indicator.
Evidence-gated capability
New automated capabilities are promoted only after statistical evaluation against adversarial test suites — with the evidence hash-bound, human-signed, and auditable. We hold our own AI to the standard your auditor holds you to.
Technical specification
Built on open standards.
Detection framework
MITRE ATT&CK
Triage
Calibrated confidence scoring, seconds per alert
Containment method
Host isolation + firewall block, reversible
Audit format
SHA-256 hash-chained JSON
Platform coverage
Windows · macOS · Linux
Signal sources
Endpoint · Identity · Network · Cloud
Proven on real traffic
Measured, not benchmarked.
Vindex processes live telemetry around the clock — tens of thousands of alerts triaged — and every design decision behind it was measured on real traffic, not benchmarked in a lab.
When something doesn't work, we measure it, fix it, and document it. That engineering honesty is the product.
Explore individual capabilities
Meet your new SOC. See how it works, check integrations, or book a demo.
Ready to close the gap?
Get enterprise-grade protection running in minutes. No disruption, no long contracts, no lock-in.