Case study · in production

Eihwaz: every alert read, every action gated — and all of it on the record.

Eihwaz is our AI-driven cyber-security fleet: a security operations centre (SOC) built on HexaBox — the first fleet the HexaBox Agent Factory built — nine agents in operation through a managed security provider. It reads every alert, investigates it, proposes the response and writes the report — at machine speed, around the clock. Every consequential action passes a tiered authority gate before it can run; your analysts sit in the Driver Seat. Many IT-service and security companies buy their security operations in from somewhere. Eihwaz is a SOC you can own: finished, in production, ready to implement under your brand — a new business you control instead of one you resell.

eihwaz.co ↗▶ Watch the film

What it is

Autonomous AI intelligence. Every consequential action checked before it runs.

Email, identity, endpoints, network, cloud, vulnerabilities, threat intelligence — every alert read, every dot connected, the same rigour at alert 4,000 as at alert 4. The specialists' intelligence runs on the fleet's own trained models and works freely; every action that touches a customer's systems is controlled. The specialists assess, sign and propose — they never execute. Your analyst sits in the Driver Seat: consequential actions wait for a human, the most severe for two.

9agents in operation

7specialists · one SOC hub · Fleet Command

100/100structural score · checks re-run on every change

1tamper-evident record per customer, checkable without us

The customer's own seat

One customer, one calm view.

The Customer Shield: one customer's people in the centre, the seven shield layers around them, the three answers on the right. A simulated customer — tap a person, a layer or an answer.

A case comes inAn alert from one of the customer's sources lands with the specialist for that layer. On the Shield it is a dot on the ring, in the colour of its severity.
An action needs a yesThe specialist proposes a response. Anything that touches the customer's systems waits at the gate; the person answers the three questions on the right.
The decision is on the recordWhat was proposed, who decided and what ran is written to the customer's chain. The counters on the Shield count exactly that.

A simulated customer, on this public site by design. The real seat draws the real customer, behind the login.

Open full screen ↗

How it is built

Seven specialists assess, sign and propose. They never execute.

One hub decides, with a human in the Driver Seat. One coordinator shares learning across customers without moving customer data. Seven specialists, one per domain. All of them built by the HexaBox Agent Factory — itself the first HexaBox agent, governed by the same gate, levels and record as the fleet it built.

HexaGate

Email

Phishing, business email compromise, malicious links and attachments.

HexaWard

Identity

Accounts, sign-ins, privilege changes, takeover attempts.

HexaEndpoint

Endpoints

Processes, malware behaviour, ransomware, lateral movement.

HexaNet

Network

Traffic, intrusion signals, exfiltration paths.

HexaCloud

Cloud

Misconfiguration, SaaS and cloud control-plane events.

HexaImmune

Vulnerabilities

Exposure, patch state, exploited weaknesses.

HexaIntel

Threat intelligence

Indicators that feed every other layer.

Eihwaz SOC · Fleet Command

One incident, one plan, one response

The SOC correlates the specialists' signed assessments into one incident and one plan. Fleet Command takes events in and may act only within its lease.

One incident · from alert to authorized response

What happens between an alert and an action a person has approved.

An illustrated incident. It follows Eihwaz's real action types and mechanisms step by step, in the order they run; it is not a replayed production event, and it carries no customer data, timestamps or figures. Where a step names a rule or a check, that rule exists in the running system.

What came inAn endpoint source reports behaviour on a laptop that matches ransomware: a process encrypting files, run from an unusual location. Fleet Command takes the event in, attributes it to one customer, and hands it to the endpoint specialist under a valid, time-limited permit. The hand-off is on the ledger.

What the agents investigatedThe endpoint specialist assesses and signs its reading. The intelligence specialist checks the indicators. Then Investigate runs its fixed, read-only plan on the incident: the stored record, the live state at the source and the difference between them, the specialist assessments, the governed timeline, the history of the host and of the account, lateral pivots to other hosts (and to other customers, as counts only, never below the anonymity floor), and the SIEM rows. Nothing in the plan can write anything.

How the evidence is kept apartEvery piece of evidence is registered in one of four classes that are never mixed: observed (a record a machine produced), live (read at the source just now, with the time it was fetched), derived (Eihwaz's own reading, always with the rule it applied and the evidence it rests on) and stated (what a person told us). Each entry carries its hash. The findings are rules with names — the tool runs from an unusual place, the account has never been seen on this host, the activity is outside working hours, the source still rates it malicious and not mitigated — and each finding points to the evidence that triggered it.

How the report is writtenA model writes the summary from the facts and nothing else: every identifier, address and hash in a sentence must exist in the registered facts, or the sentence is dropped and the drop is counted. The report then lists the questions only a person can answer — who was using the account, is the tool legitimate here, who authorised it, has anything been preserved, who at the customer has been told — because those answers are stated evidence, and the system does not invent them.

What was proposed, and why that levelThe SOC hub correlates the signed assessments into one incident and one plan, and proposes the response: isolate the laptop. Isolating a device changes the customer's systems, so the action carries level T3 — a named, logged-in person must approve. The action decided its level; nobody could request a lower one.

What the person decidedIn the Conversation Cockpit the analyst asks what happened and gets an answer built from the record. The proposal is shown with its reason, its evidence and its level, and the analyst approves. The approval is bound to that exact action and that exact approver, signed with a key the agent never holds, valid once. Had the analyst held it, nothing would have run; had anyone changed one letter of the action, the approval would not count.

What ran, and what can be checked afterwardsThe action adapter isolates the laptop, once. The gate decision, the approval and the execution are written to the customer's chain, which links into the customer's record. The case file is append-only: a statement added later, say from a phone call with the customer, becomes a new version with its own hash and the previous one's hash inside it. The customer sees the outcome in their own seat; an auditor can recompute the chain without Eihwaz present.

Real interface · fictional customer and data · the same components the analyst uses

**step 02–04The Case File**The fixed plan has run. The summary is written from the facts — one sentence was dropped for naming something not in them. Each finding carries its rule and its evidence. The timeline is classed observed · derived · live. Below it, the questions only a person can answer.

**step 03The evidence register**Four classes, never mixed. Every entry has a type, a source, a time and its own hash.

**step 06The Conversation Cockpit**The analyst asks what happened. The answer is built from the record and cites its sources: the specialist assessment, the finding, the action adapter and its level.

**step 05–06The decision**Recommended by the SOC, level T3. A reason is required and recorded with the approver’s name. The approval runs the action once; it cannot be reused.

What this shows is the mechanism, in the order it runs. A documented incident from production will replace it when one can be published in anonymised form.

Outside in — and back

From the customer's world to the customer's own seat.

The customer's worldPeople and mailboxes, the IT environment, cloud services, sites. Cyber incidents are born here: phishing, ransomware, account takeover, lateral movement, misconfiguration, exploited vulnerabilities, exfiltration.

Fleet Command takes it inThe customer's own sources are polled; every event is attributed to one customer; every hand-off is recorded, and Fleet Command acts only with a valid, time-limited permit.

Seven specialists assess, sign, proposeEach signs its assessment and proposes actions. None executes.

The SOC correlatesOne incident, one plan, one response — under the gate.

The Driver SeatOne analyst in the loop: approves, overrides, holds. Manual is one gesture away. The levels: T1 runs on its own on the record; T2 one analyst confirms; T3 a named person approves; T4 two people, two keys.

Action adaptersIsolate host · block indicators · quarantine · disable account — only after the gate said yes.

HexaRecord, and the customer's seatWhat came in, who decided, what went back — one chain per customer, verifiable offline — and visible in the customer's own seat.

Federation Command above

Governs a fleet of fleets: issues each Fleet Command its time-limited permit, sees counts only — never names, never a customer's content — and keeps a signed ledger of cross-fleet effects.

Partners in front

A security provider sees the whole tree with its own analysts and branding; each reseller sees its customers and its report inbox; a direct customer hangs straight under the provider. One fleet, every customer kept separate.

What the customer sees

Am I protected? What happened? What do you need from me?

Every customer of the provider has their own seat — calmer than the operator's, limited to their own world: the people, the laptops, the cloud services, the sites, and the agent that watches each of them. A simulated customer: drag to pan, scroll to zoom, tap anything to open its profile.

A case comes inAn event starts somewhere in this world — a mailbox, a laptop, a cloud service. Watch for the pulse on the node where it begins.
An action needs a yesThe agent watching that part proposes what to do. Tap a node to see its profile and which agent covers it; actions that change the customer's systems wait for a person.
The decision is on the recordEvery decision about this world ends up in the customer's own chain, and shows in their seat — not only in the operator's.

The Technical World of a simulated customer: office LAN, edge, server room, warehouse, mail and collaboration, public cloud, SaaS and the identity plane

A simulated customer, traffic simulated — on this public site by design. The real seat draws the real world, behind the login.

Open full screen ↗

What makes it different

Sovereign, honest, and teachable.

Sovereign AI

No external dependencies in the decision path.

In Eihwaz the specialists' assessments run on the fleet's own trained models, on the fleet's own hardware, so no customer content leaves for a decision to be made. The advisory assistant that answers questions and writes reports is a separate, configurable model, never in the decision path. This is a choice Eihwaz makes for a security operation; HexaBox itself allows any model, including external providers, and the customer's declared policy decides what may leave and what may not.

Investigate

Start from one thing. See what it is connected to.

Detection finds what it was told to find; investigation finds the rest, across the whole history. A fixed, read-only plan runs first; the report is written from those facts alone — a sentence naming anything not in the facts is dropped and counted.

The Driver Seat

Clear. Honest. Take the wheel.

The autonomy gauge, the trust level, live decisions — and one amber card asking for a human. A supervisor learns it in an afternoon; overdue work stays red; manual override is one gesture away. Autonomy is a dial, not a leap of faith.

SOC Academy

Trained and examined on the real thing.

Foundation, specialist operations and a threat-hunter practical graded by the fleet against a planted intrusion. Every analyst decision becomes a labelled example the specialists train on next.

Industry background, not an Eihwaz result: in IBM's Cost of a Data Breach 2024, organisations using security AI and automation extensively identified and contained breaches 98 days faster on average than those that did not, and extensive use in prevention workflows was associated with USD 2.2 million lower average breach costs than no use. Eihwaz is built to put that kind of speed under human authority.

What it gives the provider

Machine speed, human authority.

One fleet, every customer kept separate.

Multi-tenant isolation inside one fleet; signals shared across customers are counts only, never names — and only when at least five customers look alike.

Audit material as a by-product.

The incident evidence a NIS2 review asks for comes out of running the agents, against the requirements your team has defined.

Eihwaz is proof of one vertical — not a boundary for the HexaBox architecture.

The fleet at work · not a black box

See every agent at work. Then take the wheel.

The Wind Shield for the Eihwaz fleet: sources, Fleet Command, the seven specialists, the SOC, the gate and the actions. Simulated here — drag to orbit, tap a container to open its graph; live behind the login.

A case comes inFollow an event from a source on the left, through Fleet Command and Dispatch, to the specialist that reads it.
An action needs a yesAfter Door 2 and the SOC pipeline the proposal reaches the gate — the ring marked 'a person decides'. Pre-authorized steps pass; the rest wait.
The decision is on the recordWhat leaves towards 'Response actions' has been decided, and the Ledger at the bottom holds the receipt. The autonomy gauge counts what ran on its own.

The Wind Shield: a fleet drawn as containers

A simulated fleet with simulated events. Behind the login the same view draws the real fleet and shows problems as they are.

Open full screen ↗The four zoom levels →

For your offering

Are you ready to go AI-first in your SOC operations?

Eihwaz is finished and in production. Implement it under your brand, with your analysts in the loop and your customers in their own seats — a SOC business you own. Twenty minutes on your screen is the right first step.

Talk to us eihwaz.co ↗