We build the part that decides

The observation

Two things are simultaneously true about security operations in 2026. Organizations with SOCs are drowning in alerts that resolve to nothing. And organizations without SOCs are being told by a regulator, an insurer or a prime contractor that they must operate a capability they have never had.

Almost every vendor in this category is built for the first group. Their value story is hours saved, which presupposes analysts whose hours can be saved. That leaves the second group (the 40-person defense subcontractor, the regional practice network, the twelve-person registered adviser) with a compliance requirement, a quote they cannot afford, and no answer.

The position

Everyone else automates the do. Intruex automates the think. SOAR platforms execute playbooks, XDR consolidates telemetry, SIEMs fire rules, and all of them assume a human has already decided what the alert means.

We are not a SIEM, a log collector or a detection engine. We take the alerts your existing stack produces and turn them into decisions, with the reasoning, the evidence and the audit trail attached. That is a deliberately narrow scope, and we defend it.

The discipline

Security buyers have learned to discount vendor metrics, and they are right to. Gartner puts genuine AI SOC agent adoption in the low single digits while vendor marketing implies the opposite, and practitioners have noticed.

So every number on this site is sourced. Measured means it was observed in production, with the conditions stated. Modeled means it was derived from pipeline timings, with the derivation shown so you can substitute your own assumptions. By design means it is a property of how the pipeline is built rather than an observation. A figure that can carry none of the three does not go on the site.

The same standard applies to capability claims: each is scoped to the deployment tier where it holds, so a sentence here means the same thing in a procurement document as it does in a browser. How we word things is itself published.

Where we are

In production, SOC 2 Type II certified, and shipping. One month of that production is published in full. July 2026: 728 alerts analyzed, 98.1 percent resolved without analyst involvement, a 48-second median triage time, and 617 of 619 impossible-travel alerts traced to a single root cause with nothing dropped.

We are small on purpose. It means the person answering your technical question is the person who built the thing you are asking about, that an evaluation does not route through three layers of qualification, and that we can deploy on your hardware inside a closed network when a larger vendor would decline the conversation.