CloudPeek - FAQ

By default, nothing. Every write is declared, scoped and separately enabled, and only what a playbook declares can run once you enable it. Read and write are separated at connector level, so a workflow that has not been given a write tool cannot acquire one.

No. CloudPeek runs where you put it, including fully disconnected. In a disconnected deployment there is no phone home, no telemetry, no licence check and nothing to reconnect.

Whichever one you choose. Frontier, sovereign or open-weight models inside your boundary. No external model call is required at any point, and the choice can differ by environment.

Point the connector builder at its API specification. It drafts the tools, scopes the authentication, separates read from write and runs a security scan before anything joins your catalogue. Namespaced, versioned and sandboxed.

Every investigation and action is a timestamped, append only record carrying its evidence and its reasoning. It maps to your control framework and exports for internal assurance, regulators and auditors, retained and disposed of on your schedule.

At level one, on a workflow you already understand, against real data in test. You move a workflow up a level when a body of clean runs says it is ready, and you can turn it back down at any time.

An agentic AI platform for security operations. It triages, investigates, hunts and contains across your existing stack, at the level of autonomy you set, with your data and your models under your control, whether you run cloud first, on premises or fully disconnected.

Defence and national security, critical national infrastructure where IT meets OT, and regulated industries including financial services.

Yes. It operates with zero external connectivity: no phone home, no sync and nothing to reconnect, including on deployed and classified networks. Air gapped operation has been proven in a UK Government proof of concept.

Native connectors across SIEM, EDR, cloud, identity, vulnerability management, ticketing and threat intelligence, including Microsoft Sentinel, Splunk, CrowdStrike, Wiz, Tenable, Qualys, Entra ID, ServiceNow, Jira, MISP, AWS, Azure and Google Cloud. Anything else goes through the connector builder.

Three, set per workflow, per environment and per action type. Level 1, Advise: CloudPeek investigates and recommends. Level 2, Approve: it prepares actions and nothing executes until an operator authorises it. Level 3, Act: it executes within the limits the playbook declares.

Every alert receives an investigation and a written verdict, not a sampled subset. A closed alert carries the reason it was closed. Touching an alert is not covering it.

It stops. A workflow that exceeds its budget, hits an unexpected state or cannot evidence its reasoning escalates to a human rather than retrying. The full trail is preserved either way.

No. It runs declared workflows with declared scope and escalates to a human rather than improvising. Guardrails, escalation paths and the kill switch stay with your operators.

Yes. CloudPeek runs self managed, co managed or fully managed, where our specialists operate the platform on your behalf and your data never leaves your estate. You can move between tiers as your team grows into it.