The AI-native SOC platform
Every security decision.
Explainable.
One trail from the first signal to the final approval — with the evidence, the AI's reasoning and the response recorded as they happen. Nothing is reconstructed for the audit.
| TIME | USER | SOURCE IP | DESTINATION | SIGNAL |
|---|---|---|---|---|
| 21:14:03 | a.rao | 185.220.101.47 | vpn-gw-02 | TOR |
| 21:13:47 | svc-backup | 45.84.107.54 | m365 | SPRAY |
| 21:12:58 | a.rao | 102.129.145.8 | entra-id | NEW GEO |
| 21:11:21 | a.rao | 10.14.22.8 | adfs-01 | OK |
The operating problem
Security teams lose context between tools.
A signal in one queue, evidence in another tool, the response in a third, the audit trail written afterwards.
Not another click. A decision that cannot be shown, checked or defended.
Signal, evidence, reasoning, action and approval in one record, as it happens.
One decision loop
Six moments. One evidence trail.
Each moment hands its evidence to the next. Nothing is re-typed, re-exported or re-explained.
- 01CollectAgents, collectors, connectors
- 02DiscoverSearch and the signal queue
- 03TriagePriority and ownership
- 04InvestigateGraph, events, logs, threat intel
- 05RespondActions and approvals
- 06GovernAudit and review
↻ Govern feeds back into Collect: reviews and coverage gaps shape what you collect next.
Built in, from day one
Content your SOC can use on the first day.
Shipped with every tenant. Your team can switch any rule off, per tenant.
Governed AI
AI that shows its reasoning.
And asks before it acts.
The AI analyst explains what it sees beside the records it used. It is advisory by design — your analysts and your approval policy decide.
GOVERNED AI
- Run it on a local model inside your boundary — recorded as zero-egress.
- Or bring your own key; identifiers become numbered stand-ins before any call.
- Every AI call is audited. One platform switch turns egress off within 60 seconds.
GOVERNED RESPONSE
- Every action carries a danger level: Safe, Sensitive or Destructive.
- Destructive actions need two people: the person who starts the run cannot approve it.
- Any playbook can be dry-run first. AI drafts are never saved without a person.
Built for India's regulators — and beyond
The clocks start when the incident does.
kymeer ships dashboards for the deadlines your team actually works to.
CERT-In reporting clock
RBI reporting clock
GDPR notification clock
Log review with recorded sign-off
Investigate
See the path, not just the score.
Users, hosts, services and destinations live on one entity graph. The path behind a detection — who touched what, through which relationship — becomes evidence inside the case.
OT visibility
See the plant without touching the controllers.
- Modbus
- DNP3
- S7comm
- OPC-UA
- IEC-104
- IEC-61850
- EtherNet/IP
- PROFINET
- BACnet
- FINS
- SLMP
- OT inventory
- IEC 62443 zones
- Remote access
- Controller integrity
- Safety systems
- NERC CIP evidence
Where it runs
Your evidence stays under the law that governs it.
One sign-in at app.kymeer.com routes you to the cluster that holds your tenant. Only the data needed to route you — email, tenant ID and region — is held globally.
India
A kymeer cluster in a Tier IV data centre in India. The facility is certified to ISO 27001 and SOC 2.
Singapore & EU
Regional Google Cloud in Singapore, and in Germany for the EU with disaster recovery in Finland.
On-prem & air-gapped
Your own Kubernetes or a single node, with licences that verify offline.
Regions: India · Singapore · European Union · MSSP multi-tenancy →
Trust Center
Trust you can inspect.
Each control states what is built, where it applies and what evidence is available. No badges we have not earned.
kymeer Partner Network
Bought through partners.
Built with them.
kymeer never sells direct, never sells services and never contacts a partner's managed-service clients. Your partner owns the relationship; kymeer stands behind it.
Standard path to every customer
kymeer invoices the distributor; the distributor invoices the partner. Pricing still comes from kymeer.
The MSSP runs kymeer as a managed service. Clients raise tickets with the MSSP; kymeer never contacts them.
Evaluate with your evidence
We will not quote you a benchmark. We will run one with you.
Use your sources, your analysts and your workflows. Success criteria are agreed before the test — not invented after it.
Scope
One tenant, named users, and the sources that matter most to you.
Connect
Your partner connects those sources through agents, collectors or connectors.
Select
Two or three use cases that reflect real work: a hunt, an investigation, a report.
Baseline
We record how each use case runs today: tool switches, time to first evidence, what was missing.
Run
Your analysts work the same use cases in kymeer. We watch; we do not drive.
Decide
Results against the criteria agreed in writing before day one.
Typical duration and what you need to bring are agreed in writing before day one.
Questions, answered
What CISOs and MSSPs ask first.
What is kymeer?
kymeer is a security operations platform: collection, detection, investigation, response and reporting, with the evidence for every decision kept in one trail. It is delivered only through certified partners.
Is the AI making decisions for my analysts?
No. The AI analyst is advisory: it explains what it sees and recommends next steps beside the evidence. Response actions carry danger levels and approvals, and destructive actions always need two people.
Can kymeer run without sending data to an AI provider?
Yes. Point it at a local model inside your network and calls are recorded as zero-egress, or switch AI off entirely. If you use a cloud model, IP addresses, hostnames, email addresses and user names are replaced with numbered stand-ins first, and every call is audited.
Where does my data live?
For SaaS, in the regional cluster that holds your tenant: in India, a Tier IV data centre certified to ISO 27001 and SOC 2; in Singapore, regional Google Cloud; in the EU, Google Cloud in Germany with disaster recovery in Finland. Only account-routing data (email, tenant ID, region) is held globally. For on-prem and air-gapped installs, entirely inside your environment.
What sources can I connect?
Windows, macOS and Linux through the kymeer agent; anything that sends syslog, JSON, CEF, LEEF or key=value through the collector; and API connectors. Logs no parser recognises go to the Parser Factory, which learns their shape and adds it to kymeer's shared parser for that device type only after it passes an automated quality check. Parsers carry structure only: never your log lines or your tenant's identity.
How fast is it?
We would rather measure that with you than quote a number. A kymeer evaluation records your current workflow first, then runs your use cases on your data against criteria agreed in advance.
How do I buy kymeer?
Through a certified partner. Tell us what you need and our business team will introduce the right partner. MSSPs and integrators can apply to the partner programme.
Does kymeer hold certifications such as ISO 27001 or SOC 2?
kymeer does not claim ISO 27001 or SOC 2 certification in its own name. The India data centre that hosts kymeer is certified to both. The Trust Center lists each control we have built and what evidence is available.
Latest
From the team.
Running a SOC as a managed service on a multi-tenant platform
For an MSSP, every new client adds another boundary to defend. What the platform must enforce, what the provider owns, and the questions to settle before onboarding the next client.
Product update · v2026.10October 2026 release notes
Sign-in without passwords, tier-aware roles, daily ingest allocations with early warnings, built-in AI masking and a Parser Factory that learns from unparsed events.
BlogOT visibility without agents on controllers
You cannot install agents on PLCs, and auditors still ask about zones, remote access and controller changes. Start from the network data you already collect.
Prove the fit
in your environment.
Agree the scope. Run the use cases. Make the decision from observed results.