What exactly does each product do?
One card per product states intended use, inputs, outputs, human oversight, known limits and how the product is evaluated. The table compares the two at a glance.
About these cards
Our products are models inside software that sets their limits, so each card describes the whole system you deploy. The format follows the model card (Mitchell et al., 2019). When a card changes, its version and effective date change.
Cyberdroid AI Detection
Status
Available now. Card version 1.0, effective Sep 23, 2026.
Intended use
Behavioral detection for a security operations team. AI Detection finds users, hosts and applications behaving unusually against their own history and their neighbors, and gives analysts the evidence to decide what it means. Intended for security analysts and the people who run detection in your SOC.
Out of scope
- Blocking, remediating or changing anything in your estate.
- Immediate response. Findings are near-hourly: activity from 13:00 to 13:59 is eligible at 14:01, plus processing.
- Treating a score as a verdict, or a graph relationship as proof of intent.
- Any decision about a person based on a score alone. See the Usage Policy.
Inputs and outputs
Reads the export of ARRTECH SIEM, or of a third-party SIEM in a supported export format, from a read-only share you control: identity, network, DNS, process and firewall telemetry, including Sysmon and Windows events. Produces findings with the observed value, baseline, score and threshold, an ordered evidence timeline, intel provenance, telemetry health, attack-chain correlation with MITRE context, and a Markdown report export.
How it works
Powered by the Cyberdroid Neural Engine, it runs five families of analytics: time-series baselines, sequence and process novelty, user and entity behavior, relationship-graph anomalies, and known-threat and intelligence detection. Its 21 machine-learning detectors are each disabled, shadow or production.
Human oversight
AI Detection changes nothing. A person decides, and the ARRTECH Security Suite acts on your team's rules and approvals. A detector alerts only after it is measured in shadow on your data and promoted, and promotion and rollback are recorded.
Evaluation
Side by side with your current tooling, on labeled replay scenarios and at least one representative week, against a scorecard agreed first. See Evaluations.
Known limitations
- Findings are near-hourly.
- It sees only the telemetry in the SIEM's export. It reports when that telemetry is incomplete, but cannot fill the gap.
- Behavior that changes slowly enough can become part of a baseline.
Requirements
Deploys beside the SIEM, in your environment. Runs on CPUs; no GPU is needed.
Cyberdroid AI Investigation
Status
Early access, offered as a design-partner evaluation with written success and stop criteria. Requires Cyberdroid AI Detection. Card version 1.0, effective Sep 23, 2026.
Intended use
Read-only investigation of AI Detection findings and SIEM alerts. It turns "this looks suspicious" into a reviewable case: what the evidence supports, what remains uncertain, and what to examine next. Used by analysts who review cases, administrators who approve tasks and set policy, and requesters who ask by email.
Out of scope
- Remediation, or any change to your estate. Action stays in the ARRTECH Security Suite, on your team's rules and approvals.
- Approving its own work, or choosing who receives an answer.
- Acting as the sole basis for a decision.
- Machine translation of security reports, findings or verdicts.
Inputs and outputs
Reads findings, SIEM alerts and a catalogue of permitted sources and fields, plus plain-language requests by email. Produces a case with a verdict, confidence, rationale, key findings, evidence references and next steps, with objections kept attached. Every request ends as Task, Pending approval, Refused or Rate-limited, with an operation id and a reason.
How it works
The model makes investigative judgments. Deterministic software handles the mechanics, in six steps:
- Assemble the finding and the catalogue of permitted sources and fields.
- State a rationale and what evidence would disprove the hypothesis. Reason from events, never from a score or a MITRE label.
- Query within bounds: software compiles read-only queries, scoped to the tenant and source, within row, time and cost budgets.
- Follow the evidence. Results disclose truncation, and a case whose budget runs out is parked incomplete.
- Challenge the verdict. A separate critic step tests whether the evidence earns the conclusion.
- Write the case. A dead feed or an empty query is never proof that nothing happened.
Human oversight
Your policy and roster decide who may ask and who receives the answer, with no model call. Recipients are checked before and after a reply is written, and approval and delivery are separate authorities. In delegated work, an administrator approves each task and a person accepts the result. See Human in Command.
Evaluation
On a labeled set of hard cases, against success and stop criteria agreed before the first case. See Evaluations.
Known limitations
- A model can reach a wrong conclusion, including when text in the evidence has tried to steer it. See Prompt Injection.
- An incomplete case is a valid outcome, and reasoning depth comes before speed.
Models and requirements
Uses local models served in your environment, authenticated per key, with routing metadata showing which model served each request. An optional online fallback is a policy you configure and can see. Requires Cyberdroid AI Detection; a third-party SIEM connects through a supported export format.
