A Softmachines work · Security operations

From assessment to response, one continuous line.

Seca is a self-hostable, multi-tenant AI security operations platform for MSSPs and security teams. It starts with what the estate exposes, carries that context into detection and understanding, and brings a governed response back to the people accountable for the decision.

SecaExposure assessment · AI investigation · governed response

Follow one incident through Seca

The throughline

Know what is exposed. Understand what is happening. Respond with consequences.

Security tooling often covers one slice of this line. A scanner may find an exposed host without knowing what an incident looks like there. A SIEM may detect activity without knowing what exposure made it dangerous. A response tool may act only after someone has already decided what is real.

Seca keeps the line continuous. The same exposure finding can open an incident when it is exploited, and the confirmed incident can guide a scoped action against the exact host. Context does not have to be rebuilt by hand at every step.

Detection and understanding remain the hardest link because a machine noticing something wrong still has to become a person understanding what it means. Seca handles the repeatable synthesis first, then leaves judgment, approval, and accountability with the human.

One incident, a continuous line

Every step keeps the context it inherits.

Know your exposure before anything happens.

Before an alert exists, Seca asks what the estate exposes. It scores firewall hygiene, endpoint hardening, cloud posture, and brand or domain exposure independently. A missing connector does not become a perfect score. The platform says “not assessed” when the evidence is not there.

This is where the line starts. The assessment is not a report that goes stale the day it is generated. Its findings become the context that later explains an incident and guides a proportionate response.

Seca security posture and assessment view showing independently scored domains and honest not assessed states

Detect and understand fast enough to matter.

Precog watches entities that have not crossed an alarm threshold yet. It connects observed behavior, asset exposure, and the likely next technique into a forecast that gives the analyst time to investigate earlier.

A forecast is never presented as a confirmed incident. Seca records what resolves, what does not, and what an analyst dismisses, then scores the model against what actually happened. Intelligence is spent where it can make a difference, without turning speculation into certainty.

Seca Precog forecasting a likely defense-evasion escalation from observed privilege-escalation activity

Make the story checkable.

What happened, in what order, and why it matters arrives as a grounded draft. Every claim remains traceable to the events that support it.

Act with care and clear accountability.

A firewall block, disabled account, or isolated host has consequences for a real person. Seca distinguishes between a response safe to automate and one that needs explicit approval, with reversal built in. The system can move first when the evidence is strong, but it never hides who owns the decision.

Prove the whole line, and every score, honestly.

The compliance view maps evidence already present in telemetry to NIS2 Article 21 requirements and says “not assessed” when the system has no basis for a claim. Article 23 clocks stay attached to the incident, with a one-click evidence bundle and a cross-tenant deadline view for teams responsible for many environments. Proof is a byproduct of the work, not a separate story written afterward.

Keep the protected estate in view.

A person, host, IP address, or mailbox becomes a useful pivot instead of another silo. Identity Correlation connects mail, Zeek, endpoint telemetry from Wazuh, SentinelOne, Microsoft Defender, and Sophos, Precog forecasts, incidents, and assets into a bounded graph, so the analyst can follow one account through the environment without losing the source of each observation.

The graph is a map for investigation, not a verdict about a person. It keeps relationships inspectable and gives the analyst a faster route from a suspicious event to evidence that can confirm or challenge it.

Seca identity correlation graph connecting users, hosts, alerts, and incidents

Seca posture dashboard with NIST CSF and CIS Controls mapping

Keep the evidence alive.

A posture score only matters when an analyst can open it. Seca connects the trend back to NIST CSF and CIS Controls coverage, the evidence behind it, and the gaps it cannot verify. It is not a second assessment: it is the evidence that keeps the first one useful when the next decision arrives.

AI in the line

Let intelligence close the gaps, keep authority human.

Seca does not place a chatbot beside a dashboard. It gives the model grounded evidence, constrained tools, and explicit rules about when it may observe, recommend, start a permitted investigation, or request an action. A confirmed incident or assessment finding can also become the next scoped check, so the line keeps moving instead of ending in a report.

AI can observe

Correlate signals, prepare a grounded narrative, and surface what deserves attention.

AI can investigate in scope

Run read-only probes or permitted checks only within an approved boundary.

People decide

Approve disruption, set risk tolerance, and remain accountable for the outcome.

Seca NAG recommendation to verify an unconfirmed critical CVE on an asset with Zerocool

NAG turns evidence into the next decision.

NAG notices that a critical CVE reported by an endpoint source such as Wazuh, SentinelOne, Microsoft Defender, or Sophos has not yet been actively verified. It does not present the report as settled fact. Instead, it identifies the missing evidence, explains why the exposure deserves attention, and proposes a sanctioned Zerocool assessment.

The recommendation is actionable without becoming automatic. The analyst can accept or dismiss it, inspect the asset context, and decide whether the proposed investigation is proportionate. NAG prepares the work; it does not take ownership of the risk decision.

Seca Operator translating an SPF question into a sandboxed DNS command and grounded answer

Ask a security question in ordinary language.

An analyst asks: “Is the SPF record for softmachines.io valid, and does it match the sending host?” Operator identifies that the answer requires live DNS evidence, translates the request into an appropriate read-only command, runs it inside the agentic sandbox, and returns a structured explanation of syntax, policy, includes, and authorized hosts.

The command transcript remains visible beneath the answer. The analyst can inspect what was executed and why, rather than trusting an unsupported response. Read-only probes may run automatically; any command capable of changing state stops for approval. Natural language reduces the mechanical work of investigation, while the sandbox, transcript, and approval boundary preserve operational responsibility.

Seca Zerocool agent clarifying the authorised target and planned reconnaissance steps before an assessment

Zerocool expands reach, not authority.

Zerocool is Seca’s bounded external assessment agent for vulnerability scanning and AI-assisted pentesting. Before it begins, it establishes the authorized customer and target. Reconnaissance and vulnerability scans can proceed inside that approved scope; anything intrusive pauses for explicit human approval.

The boundary is part of the intelligence, not a disclaimer after the fact. The agent can do the repetitive fieldwork that makes a vulnerability report useful, while Seca keeps the investigation attributable, inspectable, and tied to the person responsible for the decision.

Show the result and its boundary.

Zerocool returns the evidence it gathered, including the services it could observe, the findings it could validate, and the checks that were restricted by scope. A result that says no vulnerability was confirmed also explains what could not be fingerprinted or tested.

That distinction protects the analyst from a dangerous shortcut: treating incomplete visibility as certainty. Seca makes the next decision easier, but it keeps uncertainty visible and leaves the final call with the people accountable for the environment.

Confirmed

Evidence supports the finding and its source remains available to inspect.

Unconfirmed

The evidence is incomplete; the conclusion stays open rather than becoming certainty.

Out of scope

The system says what it could not check instead of widening authority in silence.

Seca Zerocool console explaining that a vulnerability query does not match the authorized target scope

Scope is part of the answer.

When a known-vulnerability query does not match an authorized target, Zerocool stops instead of quietly widening the search. The analyst can choose an in-scope target or keep the question as an investigation lead, but the agent will not turn curiosity into reconnaissance.

This is what governed autonomy looks like in practice: the system is capable enough to notice a useful path, disciplined enough to show the boundary, and explicit about the human decision required to cross it.

Connected operations

One line across the estate.

Seca brings assessment findings, endpoint, network, cloud, identity, and email signals into one inspectable sequence. Each observation keeps its source, so an exposure can become incident context and a confirmed incident can inform a scoped response. AWS, Azure, and GCP extend the view beyond the local network.

Seca orchestration workspace configuring tenant connectors and monitored entities

Signals already in the line

WazuhZeekMicrosoft 365SentinelOneMicrosoft DefenderSophosAWS · Azure · GCPpfSense · Palo Alto · Fortinet

01 · Observe

Meet the signal where it lives.

Wazuh, SentinelOne, Microsoft Defender, and Sophos contribute endpoint and security telemetry. Zeek reveals network flows, protocols, and unusual behavior. IMAP, Microsoft Graph, and Office 365 connectors add the activity that lives beyond the perimeter, while AWS, Azure, and GCP add cloud context. Seca keeps these systems in place and holds the connective tissue between them.

02 · Understand

Let AI connect what tools see apart.

The same reasoning layer can correlate a suspicious message with sign-in activity, network traffic, and endpoint events, then enrich the sequence with MISP and TAXII threat intelligence. For anti-spam and phishing analysis, it can inspect headers, sender context, SPF, DKIM, and DMARC evidence, URLs, attachments, and social-engineering language, then explain why a message deserves attention.

03 · Respond

Carry a decision back to the control.

Approved actions route through the tenant’s matching connector: block traffic with pfSense, Palo Alto, or Fortinet; contain an endpoint; change an identity control; or act in the cloud. Low-risk steps can be tested first. High-impact changes stop for approval, and the action remains visible, attributable, and reversible.

Seca is not an integration inventory or a replacement for the products already defending the organization. It gives their observations and controls one place to meet. An exposure can lead into a Zeek trace or an alert from Wazuh, SentinelOne, Microsoft Defender, or Sophos, then into a grounded incident and a response routed through the control that owns the change.

Day-two work remains part of that story. SLA clocks and escalation keep responsibility visible as the case moves between people. Threat hunting can continue from the same evidence, while tickets stay synchronized with the investigation. When identity behavior shifts, impossible-travel checks add another layer of context. Slack can carry an approval when a person is needed. Audit history records the path, and a cross-tenant view gives MSSPs a record they can stand behind.

Trust compounds when the whole line can be checked.

Seca’s AI earns a place by doing work an analyst would otherwise do more slowly: scoring exposure, correlating alerts across users and hosts, drafting a grounded incident narrative, mapping techniques, assembling evidence, suggesting a next action, and carrying out a permitted investigation within a defined scope.

That same evidence powers posture and NIS2 reporting, threat-intelligence enrichment, and the operational details that keep a SOC moving after the first alert. The assessment, the incident, and the response remain connected instead of becoming separate records.

Every output remains a proposal an analyst can inspect, edit, approve, reject, or reverse. The system can be opinionated about which signal deserves attention, but it cannot decide an organization’s tolerance for risk, exceed an authorized boundary, or hide uncertainty behind confident prose.

The lasting value is continuity. A smaller team can hold more of the estate in view because the platform handles the mechanical links from exposure to response, while people spend their judgment on the decisions that genuinely need them.

Seca turns security evidence into governed action, without losing the person responsible for the decision.

Return to works