Autonomous SOC
The AI carries the volume. People decide what touches your systems.
ApexAI closes proven noise, investigates, correlates and proposes. Every case is scored, every decision is recorded, and nothing that changes a real system runs without a person’s approval.
The loop
01
Ingest
Alerts arrive, signed and deduplicated.
Your SIEM or XDR pushes alerts to a per-tenant endpoint. ApexAI stores no SIEM credentials.
- Per-tenant token, optional HMAC signature with replay refusal
- Idempotency, grouping and dry runs
- Suppression rules are counted, never silent
02
Score
Every case gets a 0–100 risk index.
The risk index combines entity risk with asset criticality and is explained factor by factor. The tier follows from it.
- Entity risk: frequency, diversity, open cases, graph position, reputation, rarity, false-positive history
- Asset criticality
- Tier 0 to 3 follows from the index
03
Investigate
Evidence checks, written down.
BlueTeam AI checks identity, host, network, data and history, writes what it checked and links related cases into attack stories.
- Evidence a person can read and verify
- Related cases linked into stories
- Likely next ATT&CK steps
04
Propose
Actions chosen under signed policy.
Remediate AI and Coordinator AI choose the response under a signed, versioned decision policy. Tier 0 closes proven noise; tiers 1–3 investigate, propose or open incidents.
- Proposals with risk, reasoning and alternatives
- Champion / challenger policies compared in shadow
- Review-capacity aware
05
Approve & learn
People decide; outcomes teach.
A person approves or rejects in the Approvals Inbox. Every verdict is recorded and measured, and new policy versions are promoted only after evaluation.
- Two-person rule per action type; kill switch
- Accuracy measured against people’s verdicts
- Drift checks with automatic rollback
Risk tiers
The tier follows from the risk index. It decides who works the case.
| Tier | Who | What happens |
|---|---|---|
| 0 · Noise | AI, with sampled QA | Closed only below a conformal threshold calibrated on your verdicts, and only for detections people judged benign before. |
| 1 · Investigate | AI | Runs evidence checks, writes down what it checked, links the case to related ones. |
| 2 · Act | A person approves | Containment is proposed with the risk index and the AI’s reasoning. |
| 3 · Critical | Two people + Coordinator AI | An incident is opened; any action needs two approvers. |
A risk index you can read
Each case gets a risk index from 0 to 100, explained by factor, so an analyst can see why a case ranks where it does.
Rolled out in observe mode
Each alert source starts in observe mode. Autonomy grows one stage at a time, per source, on that source’s own evidence.
01
Observe
ApexAI scores, investigates and proposes. Nothing is closed or contained on its own.
02
Measure
Its verdicts are compared with your analysts’ verdicts on the same source’s cases.
03
Step up
A person moves the source up one stage, only past a gate measured on that source’s own cases.
Learning under signature
Signed policies
Decision policies and risk-index versions are signed with ML-DSA-65 and bound to their workspace.
Evaluated before promotion
A new version passes offline evaluation on judged cases, a shadow period, a robustness range and drift checks.
Promotion changes proposals only
Promotion changes what is proposed, never what may run without approval.
Run ApexAI in observe mode on your alerts.
Nothing acts on its own during evaluation. You see what it would have done, next to what your team did.