Deployment
Three models, chosen by what your policy allows rather than by what we would prefer to sell. The differences that matter are where your telemetry sits and who carries the operational burden.
We run the platform. You connect the sources you want and nothing needs to be installed in your environment. The fastest way to get to a working answer, and the right choice for most teams.
The platform is hosted, but the component that answers questions about your environment runs inside it. Your telemetry is queried locally and only the answer is returned, not the data behind it.
The platform deployed into infrastructure you control, for organisations whose policy or regulator does not permit the hosted model. Scoped case by case, because the operational burden moves to you and that has to be worth it.
Onboarding
Intelligence coverage works from the first login. Everything after that is about making the answers specific to you, and the order below is deliberate: each step makes the next one worth more.
Accounts created, single sign-on connected if you use it, and intelligence coverage live. There is nothing to configure for this part to start working.
Asset inventory imported or discovered, so exposure stops being generic and starts naming your systems. This is the step that determines how useful everything downstream is.
Detection platforms connected with your index and field names, alert routing pointed at the channels your team already watches, and case workflow matched to how you actually triage.
Domains, people and suppliers added to monitoring. Reporting configured for the audiences that need it, including any regulator.
Support
The honest version: this is an early platform, and the compensation for that is unusually direct access to the people building it. If you need a twenty-four hour follow-the-sun desk today, we are not that yet.
Whether telemetry can leave your network usually decides the model in one sentence. Start there and the rest of the conversation is short.