Approvals on the record
At every service review, a client asks what you saw, what you did and who approved it. A provider that answers from a record can show its work. One that answers from memory gets compared with the next tool at renewal.
Clients now ask why they shouldn’t replace you with AI.
AI SOC tools now pitch directly to your clients at renewal, promising to investigate every alert.
The answer is a service the client can inspect: every alert given a disposition, every verdict backed by evidence and every action approved by a person.
Our AI investigates.
It never acts on its own.
ARRTECH builds security software on one rule: software can do more of the work, but people keep the authority.
Every query is scoped to one client, and any action on a client’s network runs through a playbook with a person’s approval.
Start with one client’s alerts. Change nothing else.
Investigation takes the findings and alerts you already receive and records a decision for each, with its reason.
You judge it on real cases, with their evidence, before you commit.
Clients
Which of our alerts did nobody look at?
Cyberdroid AI Investigation, in early access, takes a Cyberdroid AI Detection finding or an ARRTECH SIEM alert and records whether to investigate or monitor, and why. It requires AI Detection, whose caps route a flooding detector’s overflow to shadow.
How was that verdict reached?
Each AI Investigation case carries a verdict, confidence, rationale, key findings, evidence references and next steps. A separate critic step tests the verdict, and unresolved objections stay attached to the finding.
Is the night shift as thorough as the day shift?
AI Investigation runs the same steps on every case, whoever is on shift. A dead feed or an empty query is never read as proof that nothing happened, and an incomplete case is parked, not concluded.
Who can query our data, and who gets the answer?
AI Investigation scopes every query to one tenant, and policy decides who may ask, never the request. A copied recipient receives the reply only when cleared for that client.
What did you do for us, and when?
AI Investigation records every request as Task, Pending approval, Refused or Rate-limited, with an operation id and reason. ARRTECH SOAR keeps an execution history of every playbook run and an SLA dashboard.
Who made the call?
A person. AI Detection never blocks or changes anything, and AI Investigation cannot approve its own work or choose its recipients. An ARRTECH SOAR Operator node emails a person up to five color-coded options and waits. The history shows who chose which option and when.
