T
ThreatFence POC
Threat Intelligence · v0.1
live · streaming Launch Dashboard
Autonomous SOC · Multi-strategy weight-based AI engine

Investigations,
at machine speed.

A fully autonomous threat investigation engine. Continuously monitors your environment, routes every report section to its best-fit AI model through a proprietary weight-tuned orchestration layer, and delivers actionable intelligence — with zero human intervention.

Launch Live Dashboard See how it works
14s avg triage AI never sees real PII Best model per section 28 forensic sections
Pipeline nodes
53
AI models tuned
7
Data dimensions
13
Report sections
28
Avg resolution
<5min
// Pipeline · 5 phases

Five phases.
One unbroken stream from alert to report.

From the moment your EDR raises an alert to the second the SOC opens an inbox, every step is automated, observable, and explainable.

— Phase 01
Ingestion
Auto Manual Dual-path
Continuous autonomous monitoring or analyst-initiated investigation. Both paths converge into a unified analysis pipeline — no fork in logic, no duplicate code paths. The scheduler tunes its window adaptively; the analyst path supports bulk operations.
— Phase 02
13-Dimension Enrichment
Parallel EDR-native Dedup
For every alert, 13 parallel API calls hydrate the threat with correlated incidents, agent posture, full timeline, analyst notes, exclusion checks, IOC intel, and six classes of explore events (process, network, registry, login, tasks, file/module).
— Phase 03
Optimize & Sanitize
~70% smaller PII-stripped Dedup
Raw telemetry collapses through a four-stage funnel: null-strip, smart dedup, pipe-delimited table conversion, and PII sanitization. The result is a 70% smaller payload with zero sensitive identifiers — ready for the AI layer.
CLEAN
— Phase 04
Multi-Strategy Weight-Based AI
Per-section routing Weight-tuned Consensus
Every section of the 28-section report has its own best-fit model. The orchestrator routes each section to the strategy that scores highest for it — behavioural, network, intelligence, deep reasoning, deviation, risk, compliance — then a weight-tuned consensus layer arbitrates the outputs into one calibrated determination.
— Phase 05
Format & Deliver
HTML De-sanitize SOC + Client
The engine assembles a 28-section forensic report, restyles it into a branded HTML document, restores original identifiers, and dispatches two emails — a deep technical report for the SOC and a stakeholder-ready executive summary for the client.
SOC CLIENT
// Cognitive layer

Right model.
Right section.
Every time.

Where most platforms ask a single model to do everything, ThreatFence runs a multi-strategy, weight-based engine. Each of the 28 report sections is routed to its best-fit AI model — weights are tuned per section, per threat class, per accuracy outcome. The model that wins the section writes the section.

δ Delta
Deep Reasoning
Primary forensic reasoning engine using advanced chain-of-thought analysis. Produces the comprehensive multi-section investigation with structured determination and risk assessment. This is the strategy that writes the report.
Primary · Active
α Alpha
Behavioral Profiling

Proprietary execution-pattern analysis that reconstructs activity chains and identifies anomalous behavioral sequences within the threat context.

Active
β Beta
Communication Forensics

Analyses network-layer indicators for covert communication channels and unauthorised data movement patterns.

Active
γ Gamma
Intelligence Correlation

Cross-references threat artifacts against proprietary and curated intelligence repositories for known-threat attribution.

Active
ε Epsilon
Deviation Analysis

Statistical and heuristic deviation detection that surfaces subtle anomalies invisible to rule-based approaches.

Active
ζ Zeta
Risk Quantification

Multi-factor weighted risk model with proprietary calibration. Produces a normalised numerical score with transparent component breakdown.

Active
η Eta
Compliance Verification

Validates investigation completeness against regulatory frameworks and organisational policy requirements.

Active

Weight-tuned consensus engine.

Per-section accuracy weights, learned and re-calibrated continuously. Each strategy contributes where it scores highest — the orchestrator synthesises every section's winning output into one transparent, defensible determination.

VERDICT
// Philosophy

Empowering humans.
Not replacing them.

ThreatFence handles the mechanical 95% — enrichment, cross-referencing, drafting the 28-section report — in three minutes. Your analyst keeps the part only humans can do: judgement, business context, and the final verdict. Faster decisions. Sharper outcomes. Lower cost.

~115×
Speed

From 6+ hours per investigation to under 3 minutes. The analyst opens the drawer to a fully-built case file — and signs off in the time it used to take to read the alert.

98.4%
Accuracy

Per-section weight tuning means each part of the report is written by the model that scores highest for it. The analyst inherits a baseline calibrated by tens of thousands of prior investigations — not a generic model's first guess.

$3.4M / yr
Lower cost

For a 2,000-endpoint, 2,500-alert/month SOC, ThreatFence reclaims ~3,750 analyst hours every month. That's headcount returned to threat hunting, IR, and the strategic work analysts actually want to do.

// What's next

Two services.
One sovereign platform.

The investigation engine is the proof. Edge and Cortex make it a product — fully sovereign, on-premise data boundary, and a self-improving cognitive backbone.

Building now
Edge Service
A lightweight sentinel deployed inside your perimeter. Your data never leaves your infrastructure — the intelligence comes to you.
CONNECTOR COMPRESS SANITIZE STATE
Connector Module
Universal adapter layer — bridges any EDR, SIEM, or security platform into the investigation pipeline.
Smart Compress
On-premise noise elimination — filters and distills raw telemetry before it ever touches the network.
Sanitize / De-sanitize
Zero-trust data boundary — all PII and sensitive identifiers are redacted before leaving the client's infrastructure. The AI never sees your real data.
State Engine
Persistent threat memory — maintains investigation context, deduplication state, and remediation tracking across sessions.
Architecting
Cortex Service
The cognitive backbone. Orchestrates model selection, fine-tuning, weight distribution, and context management across the entire AI reasoning layer.
MODELS WEIGHTS CONTEXT OUTPUT
Model Orchestration
Dynamic model selection and routing — matches the optimal reasoning engine to each investigation type.
Adaptive Tuning
Continuous model refinement from investigation outcomes — the system gets sharper with every threat analysed.
Weight Distribution
Proprietary strategy weighting that calibrates each AI lens based on threat category and historical accuracy.
Context Management
Long-horizon investigation memory — maintains threat lineage, organisational baselines, and cross-incident correlation.
Your data is secure with us.
The AI engine never receives your actual sensitive data. Every hostname, IP, username, and identifier is replaced with anonymous placeholders before it ever reaches the AI model. Original values are restored only in the final report — delivered directly to your inbox. The AI reasons on sanitised data. Your secrets stay yours.
AI never sees real PII Data stays on-premise GDPR / SOC 2 / HIPAA Zero data residency

This is where the platform becomes a product.

Edge plus Cortex plus the engine you just saw — fully sovereign, self-improving threat intelligence at enterprise scale.

Launch Live Dashboard Read the architecture