Frequently Asked Questions

TDIR stands for Threat Detection, Investigation & Response. Unlike siloed tools, ClearSkies™ unifies these capabilities under one AI-powered platform built by security experts — transforming traditional SOC workflows with automation, contextual insight, and analyst-aware orchestration.

ClearSkies™ adds AI-driven insight and context, automates repetitive tasks, and helps teams detect, investigate, and respond faster — even under pressure. It intelligently analyzes threats and empowers rapid response so your organization recovers quickly with minimal operational impact.

Not at all. ClearSkies™ is fully modular. Start with what you need and expand as your operations grow — without unnecessary complexity or cost. Each module integrates seamlessly into the platform when you're ready to add it.

Yes — ClearSkies™ is built for interoperability. It integrates with third-party tools and enhances what you already use, designed to complement and elevate your existing security investments rather than replace them.

ClearSkies™ is built by world-class security experts with years of hands-on experience. The platform is continuously updated against the evolving threat landscape, with regular penetration tests and security analyses. The provider holds ISO 27001, ISO 9001 and ISO 22301 certifications, and is accredited by the PCI SSC as a Qualified Security Assessor (QSA).

Since ClearSkies™ is cloud-based and delivered as-a-Service, implementation is fast and tailored to your organization's specific requirements — with near-instant results thereafter. No complex on-premises infrastructure setup or heavy administration is required.

With ClearSkies™ delivered through a cloud-based SIEM-as-a-Service model, you can be up and running quickly. Organizations typically start seeing actionable results within 4 to 6 weeks — compared to legacy on-premises deployments that can take up to 18 months.

Continuously. ClearSkies™ receives regular updates — new features, enhancements, and capabilities — driven by real-world SOC experience, technological trends, and customer feedback. A dedicated team of world-class engineers, developers, and data scientists share one goal: delivering world-class, innovative protection.

An Integrated Security Operations Center (ISOC) platform converges detection, investigation, response, telemetry, threat intelligence, automation and AI into one operating workflow — replacing the SIEM-plus-point-tools architecture with a single control plane. Instead of stitching consoles together by hand, an analyst works one enriched, prioritized incident from alert to containment, with the AI’s reasoning visible at every step.

Both. The same core ships as the Client Platform for organizations that run their own SOC, and as a multi-tenant, white-label MSSP Platform for providers delivering managed security to many clients. You can also have us run it for you through Managed Services.

No. The Centric AI Fabric runs on a private, offline LLM purpose-built for cybersecurity. Telemetry and prompts are never exposed to public AI services, and every AI decision stays explainable and auditable inside your boundary.

Across endpoint, identity, network, DNS, cloud and external exposure — from insider threats and credential abuse to advanced threats like APTs, zero-days and ransomware — all correlated on one core and contained through native automation.

Typically 4–6 weeks, depending on environment complexity and module scope. Our Professional Services team handles architecture, migration and tuning.

ClearSkies™ iISOC is the Intelligent - Integrated Security Operations Platform: detection, investigation, response, telemetry, threat intelligence, automation and AI converged into one governed workflow. Instead of stitching consoles together by hand, an analyst works one enriched, prioritized incident from alert to containment, with the AI’s reasoning visible at every step.

It stands for both Intelligent and Integrated. Intelligence without integration is a clever tool that still stands alone; integration without intelligence is a shared console that still leaves your analysts to correlate by hand. ClearSkies™ iISOC holds both at once: an intelligent orchestration layer acting across a fully integrated set of capabilities.

It carries those capabilities, but as coordinated functions of one platform rather than separate products. Next-Gen SIEM, SOAR, endpoint and network telemetry, threat intelligence and an AI SOC analyst all work from one data model, one workflow and one console - and if you want it operated for you, it is also delivered as a managed service.

No - ClearSkies™ is built for interoperability. It integrates with third-party tools and enhances what you already use, designed to complement and elevate your existing security investments rather than replace them. New coverage never means another console to watch.

Your data is signed and encrypted inside your own boundary at the point of collection and stays resident in your region. The Centric AI Fabric runs on a private, offline LLM purpose-built for cybersecurity - telemetry and prompts are never exposed to public AI services, and every AI decision stays explainable and auditable.

Both. The same core ships as the Client Platform for organizations that run their own SOC, and as a multi-tenant, white-label MSSP Platform for providers delivering managed security to many clients. You can also have us run it for you through Managed Services.

Typically 4–6 weeks, depending on environment complexity and module scope. ClearSkies™ is cloud-based and delivered as-a-Service, so no complex on-premises infrastructure is required - our Professional Services team handles architecture, migration and tuning.

The platform measures itself natively: one audit-ready record per incident, SLA and service dashboards, and outcome-based reporting on the metrics that matter - fewer false positives, faster detection and response, and less analyst time spent on investigations.

A false-positive mark suppresses the domain immediately and retrains the tenant baseline.

A managed device off the corporate network uses whatever DNS the local network provides unless the Agent forwards them back.

Payload content, and direct-to-address connections that issue no lookup at all. Both are the work of the firewall and endpoint layers, which is why the correlated architecture matters more than the refusal itself.

It does, and it will continue to. The question is what it is worth in three years: efficiency gains accrue to the supplier, the client relationship is shared, and the capability is not proprietary at exit. The three-routes comparison on the overview states this without arguing that every provider should switch.

Separation is enforced at the data layer, no tenant holds or infers the data of another, and hosting region is configurable per deployment. The subprocessor terms and the assurance reports are the artifacts to review.

Volume is bought in bands rather than metered without a ceiling, so a busy month meets a known band instead of an open invoice. The console reports ingestion per tenant, so a client that grows is repriced on evidence at renewal. Normalization and filtering happen at collection, so low-value telemetry is dropped before it counts against the band. Under MSSP Ultimate, capacity released by one client is reallocated to another rather than repurchased.

That is the normal case and it is not an obstacle. Endpoint telemetry from the vendor the client already runs is ingested and correlated, and response actions are executed through it where the vendor exposes them. Endpoint Threat Monitoring and Response is licensed only where a client has no incumbent or is replacing one.

The license covers ingestion and analytics for one infrastructure, not multi-tenant delivery. A provider still supplies the tenancy model, the cross-client operations, the correlation across non-Microsoft sources, and the branding layer, and still pays for ingestion above the entitlement. The comparison to run is fully loaded cost per tenant at the volume the provider actually carries, not license cost at zero.

An authenticated scanner covers what is already recorded, and a network scanner covers what is reachable from inside. Neither reaches an asset nobody registered, which is where most intrusions begin.

Active assessment is restricted to the confirmed band, at 70 and above on an evidence-scored model. Suspicious assets are observed passively and never probed, and every promotion and discard is recorded with its reasoning.

In this category those are almost always attribution errors rather than detection errors: shared addresses, parked domains and hosting ranges swept in by resemblance. That is the problem ClearSkies ASM is built around, and the first confirmed scan is run as an attribution review so the evidence model is visible before any finding reaches a report.

ClearSkies ASM does not run inside the OT segment and does not need to. It works the boundary: the internet-facing jump hosts, remote-access services and engineering workstations an attacker would use to reach control systems, discovered without installing anything. Coverage of the operational infrastructure itself is integration-based.

The platform is opinionated about the data model and open about the infrastructure. Thousands of third-party products are normalized to the same schema through the Marketplace, detection logic is portable through Sigma, intelligence exchanges through STIX and TAXII, and customer data remains exportable under documented terms.

A SIEM is a destination for logs. The distinction here is where correlation happens and what acts on the result: normalization occurs at collection, correlation and investigation occur inside the platform, and response executes back through every integrated control under governed authority.

It is translated and validated against the normalized model during a parallel run, with detection parity demonstrated before the incumbent is decommissioned.

Authority is tiered and configurable per tenant. Low-risk containment executes automatically, higher-impact action requires human authorisation, and every action is logged with actor, input, decision, and outcome.

Through banded ingestion and retention by tier, add-on licensing tied to protected surface rather than log volume, and exposure-led scoping.

Deployment supports data residency and sovereignty requirements, with governance mapped to NIS2, DORA, GDPR, ISO/IEC 27001, and the EU AI Act. Residency is confirmed per deployment at scoping.

No. TDIR is the Orchestration Layer of the ClearSkies iISOC platform. It is not licensed, tiered or bought separately and has no standalone deployment.

In that arrangement each product holds its own data model and its own console, and work passes between them at every step. Here telemetry is normalized once, correlated in one core, investigated in one workflow and responded to through one orchestration engine, so there is no hand-off, no data-model mismatch and no separate console.

It covers one infrastructure, not multi-tenant delivery. Tenancy, cross-client operations, correlation beyond Microsoft and the branding layer remain yours to build.

It does, and it will continue to. The question is what it is worth in three years: efficiency accrues to the supplier, the client is shared, nothing is proprietary at exit.

True in some markets. The platform has run production security operations across more than 30 countries for two decades, and the evidence is available before contract.

No. Prevention remains essential, and Active Defense assumes it will sometimes be bypassed. The deception layer sits alongside the existing controls and covers the ground after the perimeter.

Decoys and beacon traps are not real assets and hold no production data. The layer sits among real assets but touches none of them, which is what makes it acceptable in an operational technology environment.

Not directly. The add-ons do not exchange intelligence with one another. Every signal routes through the TDIR engine, which correlates it and returns the detection outcomes.

A decoy has no legitimate use. No user, process or administrator has a reason to authenticate to it or to open a planted file, so an interaction is not evidence of risk, it is evidence of an intruder.

Activity that looks legitimate everywhere else: an attacker using valid stolen credentials, or performing reconnaissance that resembles administrative work. Those are ambiguous on a real asset and unambiguous on a decoy.

Decoys impersonate genuine operating systems and applications and expose the same protocols and ports real services use, and the Modbus decoy presents a configurable device fingerprint. Realism and placement are reviewed as part of the ongoing optimization service in section 9.

Human control is raised rather than removed, from manual execution to supervision, and every action is recorded through the TDIR Engine as a defensible audit trail. Human analysts retain supervisory control with defined escalation paths.

They never act on another product’s raw intelligence: every signal reaches them as a correlated detection from the TDIR Engine, and every action they take flows back through it.

Each AI-SecOps Autonomous Analyst acts only within the autonomy boundaries defined for a given tenant, asset class and risk level. The phase in force is a configuration decision, made per tenant.

No. ETMR is designed to run alongside it. The existing product keeps catching what it catalogues, and ETMR adds continuous behavioral monitoring, inline containment banded by confidence, and the full record an investigator needs afterward. Onboarding sets the exclusion policy for both before enforcement is turned up.

No single signal produces a confirmed verdict. Weighted contributions from several independent detection sources decide the confidence band, and inline containment is reserved for the Confirmed band. Lower bands are contained, flagged or logged according to tenant policy.

Behavior. Fileless and living-off-the-land activity that never drops a recognizable file, credential theft from process memory, beaconing from an unexpected process, and rapid file modification characteristic of ransomware.

Onboarding establishes the baseline detection and exclusion policy for both agents before ETMR enforcement is turned up, which is part of the professional-services wrap above.

Not directly. The add-ons do not exchange intelligence with one another. Every signal routes through the TDIR engine, which correlates it and returns the resulting detection outcomes to ETMR, so the agent acts on a correlated picture rather than on another product’s raw finding.

That capability is retained and consumed. The question to test is what it sees outside its own boundary: whether an account that authenticates through it one day and directly against Active Directory the next is one subject with one baseline or two partial records.

Receiving the events and evaluating them are different capabilities. Event data without a per-identity baseline, privilege context and entitlement state does not produce an identity verdict.

Automation is permitted only at the Critical band, only where multiple independent signals concur, and only where tenant policy allows it.

Every authentication and authorization event, in real time, from on-premises directories, cloud identity providers and federated access, for human, service and machine identities alike, normalized into one event stream.

A learned baseline per user and per service account, covering login times, locations, devices and access, and detection of deviation against it.

Dedicated scrutiny for elevated accounts: escalation, group-membership change, service-account misuse and standing or shadow administrative rights, with anomalies on those identities treated as higher severity.

A maintained library covering credential stuffing, password spraying, Pass-the-Ticket, Kerberoasting, token theft and account manipulation, alongside continuous posture assessment for dormant high-privilege accounts, non-expiring passwords and absent multi-factor authentication.

Identity context injected automatically into alerts raised elsewhere: the account, its role, its privilege, its current risk and its recent access, with a per-identity risk score that travels with every correlated event.

Response modeled at the identity as well as at the host: suspend or disable, revoke sessions, force a reset, trigger step-up authentication, as one-click analyst actions and as automated playbooks, with a full audit record.

A normalized schema, real-time push and pull-based transports, MITRE ATT&CK tagging on every applicable detection, and correlation identifiers preserved end to end, so an analyst can pivot from an alert back to the identity evidence without a manual lookup.