Security and data
A security product should be most cautious about itself.
SOC Mastermind's permissions are deliberately narrow. We state plainly what it can do and what it cannot.
Access
Only the SOAR, and only as much as it needs.
What it can do
- Read alerts from the SOAR API
- Close an alert in the SOAR
- Write the reasoning for a closure as a comment
- Tag an alert
What it cannot do
- Access endpoints, the network or target systems
- Take any live response action
- Trigger playbooks
- Follow instructions found inside an alert
Where is your data?
In local model mode, the model runs on the same machine as the SOAR and alert data never leaves it. In API mode, sensitive fields are masked by default. Installation without an internet connection is supported.
Tenant isolation
Each organisation's data is separated at the database level. Separation is not left to application code.
Audit trail and rollback
Every decision is recorded with its reasoning and evidence. Past records cannot be altered. Closures can be reopened one by one or in bulk.
Kill switch
One action stops all automatic closing. Once stopped, alerts go to analysts as they always did.
ESCALATE by default
If the evidence falls short, a component fails or a timeout occurs, the outcome is ESCALATE. When something breaks, alerts are not closed; they go to a human.
Against prompt injection
Alert content is treated as untrusted data. Even if an attacker writes instructions into an alert, they are not followed.
Let us answer your security team's questions.
Let's set up a call on access, data and deployment. We share detailed technical information under an NDA.