01
Four gates before any model sees your data
Every AI request passes a default-deny egress gate, masking, a per-tenant rate limit and an audit record — in that order. Local endpoints on your own network are recorded as zero-egress.
Governed AI
AI that shows its reasoning. And asks before it acts.
The kymeer AI analyst reads the evidence around an alert, explains what it sees and recommends next steps beside the records it relied on. It is advisory by design: response stays with your analysts and your approval policy.
4 gates before any model sees your data
MON 02:1147 spaced login probes across 9 accountsT1110.003
WED 21:14Success on intern account via Tor exit · MFA stale 47 daysT1078
WED 21:18Finance shares enumerated · zero files openedT1083
WED 21:19Account disabled · approved by s.iyer · playbook run loggedSENSITIVE
PROPOSED RULE · BACKTESTED ON YOUR HISTORYtor-vpn-success-after-spray · below promotion threshold · awaiting analyst review
How it works
What the analyst sees — and what it cannot do.
- Reasoning is shown next to the graph path, entities and parsed records — reviewable inside the case.
- Run it on a local model inside your boundary, use Unoblox, or bring your own key for Anthropic, OpenAI or OpenRouter.
- Built-in masking always runs: IP addresses, hostnames, email addresses and user names become numbered stand-ins such as HOST_2 before any model call, and the real values are put back in the answer. Every call is audited.
- One platform switch turns AI egress off. It takes effect within 60 seconds, with no restart.
02
Rules it proposes wait for a person
AI-drafted detection rules are backtested on your recent events with the production engine, and stay inactive until a person approves them.
03
Playbook drafts, never silent changes
The analyst can draft a response playbook. Drafts are never saved automatically: a person reviews and publishes them.
Specifications
| Role of AI | Advisory: explains, recommends, drafts |
|---|---|
| Model options | Local OpenAI-compatible model (Ollama, vLLM, llama.cpp) · Anthropic · OpenAI · OpenRouter · Unoblox |
| Zero-egress | Local endpoints audited as zero-egress |
| Data protection | Default-deny egress · built-in masking with numbered stand-ins · per-tenant token budgets |
| Keys | Provider keys per tenant, AES-256-GCM encrypted, set by a platform administrator |
| Kill switch | Platform-controlled; effective within 60 seconds |
| Audit | Every AI call recorded |