System cards
What each product is for, what it reads and what it produces.
What exactly does each product do?
Each card states a product's intended use, inputs and outputs, workflow, known limitations and evaluation.
About these cards
Each card covers the model and the software around it, in the standard model card format. Any change gets a new version and date.
Cyberdroid AI Detection
Status
Available now to select organizations. Card version 1.0, effective Sep 23, 2026.
Intended use
Behavioral detection for a SOC. It finds users, hosts and applications acting unlike their history or peers, and gives analysts the evidence to decide.
Out of scope
- Response and remediation, which run through ARRTECH SOAR playbooks.
- Immediate alerting. Findings are near-hourly: collection and processing add to the time before a finding is available.
- Treating a score as a verdict, or a graph relationship as proof of intent.
- Any decision about a person based on a score alone. See the Usage policy.
Inputs and outputs
Reads the export of ARRTECH SIEM or a supported third-party SIEM from a share in the organization's environment: identity, network, DNS, process and firewall telemetry. Each AI Detection finding shows the value against its baseline, its score and threshold, an evidence timeline, its intel source and telemetry health.
How it works
The Cyberdroid Neural Engine runs five kinds of analytics, from baselines to threat intelligence. Each of its 21 detectors is disabled, in shadow or in production.
Workflow
Analysts review the findings, and ARRTECH SOAR runs the response playbooks the team has set up. Each AI Detection detector is tested in shadow on the organization's data before it goes live.
Evaluation
Beside existing tools, on replay scenarios and at least one representative week, against a scorecard agreed first. See Evaluations.
Known limitations
- Findings are near-hourly.
- It works from what the SIEM exports and reports any gap in that telemetry.
- Behavior that changes slowly enough can become part of a baseline.
Requirements
Deploys beside the SIEM, in the organization's environment. Runs on CPUs, with no GPU.
Cyberdroid AI Investigation
Status
Early access, as a design-partner evaluation with written success and stop criteria. Card version 1.0, effective Sep 23, 2026.
Intended use
Investigation of AI Detection findings and SIEM alerts. It turns “this looks suspicious” into a case for an analyst to review and accept.
Out of scope
- Response and remediation, which run through ARRTECH SOAR.
- Serving as the only basis for a decision about a person.
- Machine translation of security reports, findings or verdicts.
Inputs and outputs
Reads findings, SIEM alerts, email requests and the list of sources and fields it queries. Writes a case with a verdict, confidence, rationale, evidence and next steps, with any objections attached. The request record includes its outcome and the reason.
How it works
The model makes the investigative judgments. Software with fixed rules handles the mechanics, in six steps:
- Gather the finding and the catalogue of sources and fields.
- State a rationale and what would disprove it. Reason from events, never from a score or a MITRE label.
- Query the data. Software writes each query for the tenant and source, within the task’s access and execution limits.
- Follow the evidence. Results flag when they are cut short, and a case without enough evidence remains incomplete.
- Challenge the verdict. A separate review tests whether the evidence earns it.
- Write the case. A silent feed or an empty query is never proof that nothing happened.
Workflow
Analysts review and accept each case. Policy and roster set who can ask questions and who receives answers. In delegated work, an administrator approves each task and a person accepts the result. See Human in command.
Evaluation
On labeled hard cases, against success and stop criteria agreed first. See Evaluations.
Known limitations
- Each conclusion carries a confidence level, and text in the evidence can influence the reasoning. See Prompt injection.
- An incomplete case is a valid outcome, and reasoning depth comes before speed.
Models and requirements
Runs local models in the organization's environment and records which one answered. An optional online fallback is a policy the organization sets.
