All resources FAQ
Resources · FAQ
Frequently asked questions
Straight answers about what ApexAI does, what it does not do, and what is available today. Where something is in preview, in development or on the roadmap, we say so.
Product and autonomy
What is ApexAI?
ApexAI is an AI-native SecOps platform. Its core is an autonomous SOC that detects, investigates and verifies at machine speed and prepares response for people to approve. Around it sit the ApexAI API gateway for API, AI and MCP traffic (in development), ApexAI Data Gate for data protection at field level, and post-quantum cryptography. One platform instead of a stack of point products.
What does “autonomous” mean here?
ApexAI hunts, triages, investigates and proposes on its own, continuously. Autonomy is not a setting you switch on for everything: each capability earns it from evidence on your own cases, starting in observe mode, and people keep the decision on any change to a real system.
Does ApexAI replace our analysts?
No. It takes over routine triage and investigation so analysts can spend their time on decisions that need judgement. People approve actions, review a sample of what ApexAI handled alone, and their verdicts are what it learns from.
Can ApexAI change our systems without approval?
No. Containment, blocking, disabling accounts and any other change are prepared as proposals with evidence, expected effect and rollback, and a person approves them. Critical cases can require two approvers. Closing proven noise on its own is switched on per source, only after its results match your analysts’ verdicts.
How do we know its conclusions are right?
Every conclusion carries its evidence and reasoning, and when the evidence is not enough the case says so. ApexAI’s decisions are compared continuously with your analysts’ settled outcomes, and you can see where they agree and where they do not.
What is available today, and what is not?
Triage, investigation and entity cases run in preview, in observe mode next to analysts. Response proposals are in preview; executing approved actions on your tools is in development. The ApexAI API gateway and its AI and prompt protection are in development and offered as early access. Each page on this site marks its status.
Deployment and data
Is ApexAI SaaS?
No. ApexAI is deployed on your infrastructure: on-premise or in your private cloud. You run it, and your security data stays in your environment.
Does any of our data leave our environment?
Outbound connections are used only for security work, such as threat-intelligence feeds and vulnerability lookups. The default AI models run locally. A cloud model is optional, off by default, and when enabled it is called through a server-side gateway under your policy.
Can ApexAI run in a restricted or air-gapped network?
ApexAI is built to run on your own infrastructure with local models, which suits restricted networks. Requirements for fully offline sites, such as how updates are delivered, are agreed per deployment. Contact us with your constraints.
Can we run several organisations or customers on one deployment?
Yes. Each organisation or customer is its own workspace with isolated data, cases, approval rules and audit trail. Managed service providers also get a single operations view across workspaces.
Which language models does ApexAI use?
Local models that run on your infrastructure by default, specialised for security tasks and improved with your own settled outcomes. A cloud frontier model can be enabled by policy for selected tasks, with sensitive values masked.
Integrations
Which SIEM and EDR platforms does ApexAI work with?
Elastic and CrowdStrike Falcon, including multi-tenant Falcon consoles, are connected read-only today, and Palo Alto Cortex XSIAM is connected read-only in preview. Alerts from other SIEMs can be pushed over signed webhooks, and CEF and syslog are supported. Microsoft Sentinel is the next integration.
Does ApexAI need write access to our security tools?
No. It connects read-only first, and its connectors refuse write calls in code. Write access is granted later, only for a specific action you decide to enable.
What if our log source is not supported?
Records from a new source are kept and mapped by the standard ETL, and a dry run shows how each alert would be read before anything is stored. ApexAI also learns each environment’s field layout, so differently configured SIEMs can be onboarded as they are.
Does ApexAI use threat intelligence?
Yes. It reads open and commercial threat-intelligence feeds, including STIX/TAXII and MISP sources, attack-surface findings and leak data, and links them to your own hosts, accounts and domains.
Do we have to give up our SOAR playbooks?
No. ApexAI works alongside the tools you run. Playbooks remain useful for fixed, well-defined steps; ApexAI takes on the triage and investigation in between.
Security, privacy and PQC
How does ApexAI protect sensitive data?
ApexAI Data Gate protects sensitive fields before ETL, analytics or APIs read them: encrypted, masked or dropped by policy, field by field. Computation can also run on encrypted values with fully homomorphic encryption, so the plaintext is never exposed to the server.
What does post-quantum ready mean for ApexAI?
Platform licences are signed with ML-DSA, key exchange uses ML-KEM, and the SOC signs its decision policies with ML-DSA. ApexAI can also scan your code for quantum-vulnerable cryptography and produce a cryptography bill of materials to plan your migration.
Is every AI decision recorded?
Yes. Conclusions, proposals, approvals and actions are kept in an audit trail with who or what made them and why. Audit entries are signed, including with a post-quantum signature.
Does ApexAI protect AI applications and agents?
ApexAI Parley Guard, which protects prompts and AI agent tool calls against prompt injection and jailbreaks, is in development as part of the ApexAI API gateway. It is offered as early access.
Is ApexAI certified?
We do not claim any certification on this site. Ask us for the current status and how the platform supports the frameworks that apply to you.
Buying and pilots
How is ApexAI priced?
Prices are not published. ApexAI is licensed for your own infrastructure, as the whole platform or module by module, and every licence includes the Core. Contact us for a quote based on your scope.
Can we license a single module?
Yes. Modules can be licensed on their own, and every licence includes the Core: identity, console, security mesh and audit trail.
Can we run a pilot?
Yes, talk to us about an evaluation. Every evaluation starts in observe mode on your own alerts, so ApexAI records what it would have done next to what your team did, and nothing acts on its own while you measure it.
How soon do we see results?
Conclusions appear as soon as alerts flow in. Deciding to switch anything on takes longer: it rests on enough of your analysts’ verdicts to compare against, usually gathered over the first weeks.
See ApexAI on your own alerts.
A walkthrough with your team, in observe mode first: ApexAI scores and proposes, nothing acts on its own.