Capabilities ApexAI Drawbridge
Capability · Remediation
Response that waits for your yes.
Automated response is only useful if you can trust it. ApexAI Drawbridge prepares each containment or remediation step as a proposal: what to do, why, what it will change and how to undo it. Your team approves, and every decision is kept on record.
Status: In development Response proposals with evidence and rollback are produced today in preview; executing approved actions on your tools is being built and stays off until you enable it; gateway response is on the roadmap.
Why proposal-first
Isolating the wrong server or disabling the wrong account can cost more than the attack it was meant to stop. Much of what looks suspicious in security alerts turns out to be legitimate work: backups, software updates, administrators doing their job. A response system that acts on a single alert will sooner or later act on one of those.
ApexAI Drawbridge is built the other way round. It acts only on a confirmed story, not on a single signal, and it starts from a proposal. The proposal carries the evidence, the exact change it would make, the expected effect and the rollback. A person reads it and decides. Only actions you have approved are carried out, and the result is checked and recorded.
What a Drawbridge proposal contains
The evidence
The case, the entity and the facts that support acting now, with their sources.
The exact change
Which action, on which tool, against which host, account, address or indicator, stated precisely.
The expected effect
What should stop, what should keep working, and what the business may notice.
The way back
How the action is undone, and for time-limited actions, when it lapses on its own.
The safety checks
Critical systems, internal infrastructure and protected accounts are checked before a proposal is offered.
The record
Who proposed, who approved, what ran and whether it took effect, in an audit trail you can export.
From conclusion to action
01
Confirm
The case must hold together as a story with confirmed indicators and behaviour outside the entity’s normal pattern.
02
Propose
Drawbridge drafts the action with evidence, expected effect and rollback.
03
Approve
A person with the right permission approves or rejects it. Higher-impact actions can require two approvers.
04
Act and verify
The approved action is carried out through your existing tools, and ApexAI checks that it really took effect.
05
Undo if needed
If the action causes harm or is no longer needed, it is reversed from the same record.
Guardrails that do not move
- No action runs without approval. Each kind of action is switched on separately, starting with the lowest-risk ones.
- Every switched-on action class starts with a small, capped trial before it is widened, and can be switched off at any time.
- Connections to your security tools are read-only until you grant write access for a specific action.
- Proposals are never built from one alert alone or from severity alone.
- Known authorised scanners, backups and other routine operations are recognised and are not treated as attacks.
- Results say plainly whether an action was applied, failed or was refused.
Where Drawbridge acts
| Area | Examples | Status |
|---|---|---|
| EDR | Contain or release a host, block an indicator, adjust a policy | Proposals in preview; execution in development |
| Network and identity | Block an address, disable an account, revoke sessions | Proposals in preview; execution in development |
| API gateway | Tighten a rate limit, add a challenge, block a client for a set time | Roadmap |
Questions
What is proposal-first remediation?
It is a response model where the system prepares the action, with evidence and rollback, and a person approves it before it runs. Automation does the preparation; people keep the decision.
Will ApexAI ever act without approval?
Not by default. Any automatic execution would have to be switched on by you for a specific kind of action, start as a capped trial, and remain reversible and audited.
Which tools can Drawbridge work with?
The aim is to act through the tools you already run, such as your EDR, firewall and identity provider. Proposals are produced today; execution through these tools is in development.
How do I see what Drawbridge would have done?
Proposals are recorded even while execution is off, so you can review them against what your team actually did before deciding to enable anything.
See ApexAI on your own alerts.
A walkthrough with your team, in observe mode first: ApexAI scores and proposes, nothing acts on its own.