Frequently asked questions

SDefender is an autonomous pre-breach defense platform. It unifies SIEM and SOAR into a single agentic SOC, collects events from across your network, detects threats at the first move of the attack (the reconnaissance stage) and responds automatically, before attackers can breach your environment.

Yes. SDefender operates as an agentic SOC: AI agents analyze the live event stream and propose response actions and new detection rules grounded in security best practices; once a responsible engineer approves, the rules take effect immediately. SDefender ships its own MCP (Model Context Protocol) server, so it can connect to commercial or self-hosted AI models. When a public model is used, sensitive identifiers such as IP addresses, hostnames and usernames are obfuscated before anything goes out and restored only inside your environment.

Legacy tools correlate events and raise alerts, then wait for an analyst to run a playbook, so response is measured in hours or days. SDefender goes further: its Smart Automatic AI scores activity in real time and triggers high-speed automated defense in about 0.12 seconds for covered actions, with far less manual triage and fewer playbooks to maintain. It detects attacks pre-breach, keeps false positives to typically fewer than three a month, and reduces the need for a 24/7 triage team.

Available now: Agentic SOC, Exposure Management, and Security Posture Management for firewall configurations. Cloud Security Posture Management (read-only AWS account assessment), Endpoint Security (EDR) and SDefender Desk will be available soon; Security Awareness Training is planned.

For currently available products, start with Agentic SOC if your main problem is alert triage, slow response or lack of 24/7 SOC capacity. Start with Exposure Management if you first need to discover exposed assets and prioritize vulnerabilities. Start with Security Posture Management if firewall, cloud configuration, compliance or policy drift is the immediate risk.

Each currently available product can be deployed independently, but they are designed to reinforce each other. Exposure Management finds exploitable weaknesses, Security Posture Management removes risky configurations, and Agentic SOC uses that context to detect and respond earlier. Products marked as coming soon or planned should be treated as roadmap modules.

Exposure Management gives the SOC asset and vulnerability context: exposed services, weak identities, high-risk systems, KEV intelligence and OSINT signals. That helps the Agentic SOC distinguish routine noise from activity around assets that would matter most in a real attack.

Security Posture Management audits firewall and cloud configurations against CIS benchmarks, live CVE intelligence and compliance frameworks. It helps remove permissive rules, risky services, policy gaps and misconfigurations before they become incident paths.

Yes. A pilot can focus on one clearly scoped outcome: faster SOC response, attack-surface reduction, firewall posture cleanup or compliance evidence. The pilot should produce measurable findings before you expand the platform.

Available now: Agentic SOC, Exposure Management, Security Posture Management and Cloud Security Posture Management. Will be available soon: Endpoint Security (EDR) and SDefender Desk. Planned: Security Awareness Training. CSPM supports AWS now; Azure, GCP, Microsoft 365, OCI and Zadara remain on the roadmap.

SDefender intervenes at the earliest observable stage of the cyber kill chain, reconnaissance: it detects scanning, enumeration and probing against your perimeter before any payload is delivered or compromise occurs.

The automation engine executes countermeasures in roughly 0.12 seconds once a decision is made. End to end, from first signal to completed action, covered automated responses average about 0.56 seconds, versus hours or days for an analyst-driven SOC.

No. By scoring behavior in real time and acting automatically, SDefender dramatically reduces noise: in production deployments, typically fewer than three false positives per month reach the SOC.

Both. SDefender is designed for on-premises and cloud environments, and your log and event data stays inside your own environment.

SDefender ingests events over the standard syslog protocol and through agents such as NXLog, Filebeat and Fluentd, as well as direct sources. Universal log collection is built on the open-source Vector Remap Language (VRL), so many standard and customer-specific log formats can be normalized during onboarding. Administrative alerts are delivered over email, Microsoft Teams and Telegram.

SDefender assigns a dynamic Penalty Score to suspicious sources. As repeated triggers raise the score past a configured threshold, the platform automatically blocks, quarantines or throttles the source. Actions exposed over a remote connection or API can usually be automated, while Role-Based Access Control plus a full audit log keep operations governed.

SmokeScreen is SDefender's proprietary deception technology. It creates decoy environments that lure attackers away from critical assets and gather intelligence on their tactics, exposing intrusions early — without relying on signatures.

It is a vulnerability assessment tool that discovers your assets and runs external, Active Directory, Linux, cloud and identity scans, enriches findings with OSINT and known-exploited (KEV) threat intelligence, and ranks everything worst-risk-first. The same assessments can support penetration-testing and audit needs.

It audits firewall and cloud configurations against dedicated CIS-style benchmarks and a live CVE feed across 15 platforms (auto-detected on import), and cross-maps every finding to 8 compliance frameworks (PCI, NIST, ISO 27001, HIPAA, STIG, NERC, CMMC and NCSC), with AI-generated remediation.

Yes. SDefender is ISO 27001 (information security management) and ISO 27701 (privacy information management) certified.

Full implementation can take a few weeks, but you see results long before that. As soon as your firewall is connected, deploying and configuring the first rules takes 1–2 hours, and the first traffic-analysis results appear within 15–30 minutes. From there, a dedicated team tunes the Smart Automatic AI to your environment over the following weeks, after which the platform runs autonomously. In every deployment and pilot to date, the client's own administrators and security teams have been surprised by what SDefender uncovered in their traffic.

Pricing is tailored to your environment and scale. Book a demo or pilot and we will prepare a quote — onboarding takes about a day, full autonomous operation is typically reached in 2–4 weeks, with complete feature access and a dedicated security expert throughout.