# CloudPeek

> CloudPeek is an agentic AI platform for security operations. It reviews alerts, investigates incidents, checks suspicious account activity, prioritises security weaknesses and looks for signs of unnoticed attacks across an organisation's existing security tools. The operator chooses how much the platform may do, with the customer's data and models under the customer's control, across cloud first, on premises, air gapped and fully disconnected environments.

CloudPeek Limited is registered in England and Wales, company number 16018331, and operates from Bristol. Founders: Oliver (Ollie) Bridal and Craig Hollington. Contact: ollie@cloudpeek.io

## What CloudPeek is

A reasoning and orchestration layer that sits above the security tools an organisation already runs. It reads from those tools, reasons inside the customer's network boundary, and acts back into the same tools at the autonomy level the operator sets. The model runs wherever the customer puts it.

## Who it is for

- Defence and national security: classified, deployed and disconnected networks that never reach the internet.
- Critical national infrastructure: converged IT and OT estates, with the blast radius of every action declared before it runs.
- Regulated industries, including financial services: machine speed operations with the evidence trail regulators, auditors and boards expect.

## What CloudPeek is not

- Not an alert triage point tool. The same platform, record and control model support alert review, incident investigation, checks for account misuse, prioritising security weaknesses and searches for unnoticed attacks.
- An AI SOC platform, not a chatbot "AI SOC analyst". CloudPeek does not replace an analyst with a chat interface. It runs declared workflows with declared scope, and escalates to a human rather than improvising.
- Not a cloud-only service. Cloud is one deployment mode. No external model call is required at any point, in any mode.

## Alert coverage, defined

Coverage means every alert receives an investigation and a written verdict, not a sampled subset. A closed alert carries the reason it was closed. Figures quoted as coverage on this site use that definition. Published coverage figures across this market are frequently not comparable, because most count alerts touched rather than alerts covered.

## The autonomy dial

Autonomy is set per workflow, per environment and per action type, and can be moved in either direction at any time.

- Level 1, Advise. CloudPeek investigates and recommends. Operators decide and act.
- Level 2, Approve. CloudPeek prepares actions end to end. Nothing executes until an operator authorises it.
- Level 3, Act. CloudPeek executes within the limits the playbook declares, with every step traced and explainable.

Level 1 is the default. Guardrails, escalation paths and the kill switch sit with the operator, not the vendor. By default the agent writes nothing to a production system; only what a playbook declares can run, and only once that playbook is enabled. Read and write are separated at connector level.

## Deployment

- Cloud. Multi tenant and managed, with tenant isolation enforced per transaction.
- On premises. Customer infrastructure, keys, retention policy and network boundary.
- Air gapped. Zero external connectivity: no phone home, no sync, nothing to reconnect. Proven in a UK Government proof of concept.
- Deployed and disconnected. Denied environments and classified networks, with one reasoning layer across the estate.

Model layer: frontier, sovereign or open-weight models hosted inside the customer boundary. No external model calls are required in any deployment mode.

## Integrations

Native connectors across SIEM, EDR, cloud, identity, vulnerability management, ticketing and threat intelligence, including Microsoft Sentinel, Splunk, CrowdStrike, Wiz, Tenable, Qualys, Entra ID, ServiceNow, Jira, MISP, AWS, Azure and Google Cloud. A connector builder drafts new tools from an API specification, scopes authentication, separates read from write and runs a security scan before anything joins the catalogue.

## Operating model

Self managed (the customer's team runs the platform), co managed (CloudPeek engineers build and tune workflows alongside the customer's analysts; where most engagements start) or fully managed (CloudPeek specialists operate the platform, with data never leaving the customer's estate).

## Evidence and records

Every investigation and action is a timestamped, append only record carrying its evidence and its reasoning. Records map to the customer's control framework and export for internal assurance, regulators and auditors. Retention and disposal follow the customer's policy. A workflow that exceeds its step budget, hits an unexpected state, or cannot evidence its reasoning escalates to a human rather than retrying; the trail is preserved either way.

## Certifications and recognition

- Cyber Essentials certified
- AWS Qualified Software
- Tech Nation Rising Stars, regional winner

## Platform differentiators

- **Run where your mission requires.** Dedicated hosting, on premises or fully air-gapped. Use one platform across connected and disconnected environments, including operational technology.
- **Choose your models. Keep your tools.** CloudPeek runs on its own orchestration harness. Choose internal, open-weight, sovereign or frontier models for each workload, and query your existing tools where the data lives.
- **Every investigation carries the evidence forward.** Findings, approvals and actions remain available for review and audit. Estate knowledge and investigation history give the next investigation more context than the last.

## Platform pages

Start with the [CloudPeek Platform overview](https://www.cloudpeek.io/platform/) for the workspace, product views and operator controls. Its [Architecture subpage](https://www.cloudpeek.io/platform/architecture/) explains how the tools, models, network boundary and security harness fit together, with deployment and control FAQs.

## Platform features

CloudPeek is an agentic security operations platform that investigates and automates work across your existing tools, using your choice of models and deployment.

- **Investigations** Findings, approvals and actions remain available for review and audit. Estate knowledge and investigation history give the next investigation more context than the last.
- **Automations** Build automations on the same reasoning layer and hand off tasks to agents you already run. Set authority per workflow, environment and action type.
- **Deployment** Deploy CloudPeek with dedicated hosting, on premises or fully air-gapped. Use one platform across connected and disconnected environments, including operational technology.
- **Tooling & integrations** Connect internal tools and remote MCP servers, add any external API as a custom provider, or let the builder agent draft a new tool for your review. Choose internal, open-weight, sovereign or frontier models for each workload, and query your existing tools where the data lives.

## Architecture FAQs

- **How does CloudPeek work with the tools we already use?** CloudPeek connects to your existing security, cloud, identity and ticketing tools. It gathers context from them, investigates what happened and prepares the next step. Your tools remain in place, and approved actions go back through those same connections.
- **Where can we run CloudPeek and its models?** Run CloudPeek in the cloud, on your own infrastructure, or in a disconnected environment. Choose local, open-weight or sovereign models to suit your workload and policy. A frontier model is also an option where you permit external connectivity.
- **Does our data have to leave our network?** No external model connection is required. With a local or air-gapped deployment, the models and case record stay inside your boundary. A disconnected deployment has no phone-home telemetry or online licence check. Any permitted external connection follows the policy your team sets.
- **What can CloudPeek change in our systems?** Your team defines the tools and actions each workflow may use. Start read-only, then enable response steps that CloudPeek prepares for operator approval. Read and write permissions are separate, and each workflow has limits on its scope, duration and number of steps.
- **What happens when an investigation needs human judgement?** If a workflow reaches its limits, encounters an unexpected state or cannot support its reasoning with evidence, it stops and escalates to your team. The investigation record is preserved so an analyst can review what happened and decide the next step.
- **Who stays in control of the response?** Your authorised operators set the guardrails, approval requirements and escalation paths. Your team holds the kill switch and can stop a workflow. CloudPeek works within the authority you give it.
- **How are different customers’ records kept separate?** In the managed service, records are scoped to their customer’s tenant. The database applies that boundary to each transaction, keeping customer access separate even when infrastructure is shared.
- **How long do we keep investigations and audit records?** Retention and disposal follow your organisation’s policy. The case record keeps findings, approvals and actions available for review and audit. New entries add to the history rather than rewriting earlier steps.

## Agent plugin services

### Vulnerability Intelligence

A free, live agent plugin service that brings vulnerability intelligence into the assistant your team already uses. Research a vulnerability, check what affects a product, or review what changed.

- [Installation guide](https://docs.cloudpeek.ai/docs/agent-plugins-vulnerability-intelligence/)
- [Agent plugin on GitHub](https://github.com/Cloud-Peek/agent-plugin)
- [Live read-only MCP service](https://mcp.cloudpeek.ai/vulnerability/mcp)

## Pages

- [CloudPeek](https://www.cloudpeek.io/): Agentic security from dedicated hosting to air-gapped. Choose your models and tools, keep evidence in your boundary and control each response. Free, live intelligence plugin.
- [Products](https://www.cloudpeek.io/products/): The CloudPeek Platform and free, live Vulnerability Intelligence agent plugin service.
- [Founders](https://www.cloudpeek.io/founders/): Craig Hollington and Oliver Bridal, with public profiles and independent company records.
- [CloudPeek Platform](https://www.cloudpeek.io/platform/): CloudPeek is an agentic security operations platform that investigates and automates work across your existing tools, using your choice of models and deployment.
- [Platform architecture](https://www.cloudpeek.io/platform/architecture/): Answers to CloudPeek architecture questions: connecting your tools, choosing models, keeping data in your boundary, operator control and audit records.
- [Blog](https://www.cloudpeek.io/blog/): Perspectives on agentic security operations, organisational knowledge and model choice from the CloudPeek founders.
- [Your security knowledge should outlast your AI agents](https://www.cloudpeek.io/blog/security-knowledge-outlasts-agents/): Craig Hollington on building an agentic SOC whose knowledge, decisions and evidence stay with the organisation as analysts, models and tools change.
- [What CloudPeek does for your team.](https://www.cloudpeek.io/use-cases/): CloudPeek reviews alerts, investigates suspicious activity and helps your team decide what to do next. Get clear findings, practical next steps and a record you can explain.
- [Some run it themselves. We are here either way.](https://www.cloudpeek.io/services/): CloudPeek is a platform first, and it stands on its own. Services are an option, not a requirement: specialists behind the product who can deploy into hard constraints, support your accreditation route, and take as much or as little of the running as you want to hand over.
- [FAQ](https://www.cloudpeek.io/faq/): The questions a security review opens with, answered plainly. If yours is not here, ask it on the demo and we will answer it the same way.
- [Advisors](https://www.cloudpeek.io/advisors/): CloudPeek's advisors bring decades of experience from the Ministry of Defence, global security leadership, venture investment and the technology services industry. They advise us on product, deployment and how we work with customers in sensitive environments.
- [Team](https://www.cloudpeek.io/team/): CloudPeek is built by operators and builders who know this domain. CloudPeek Limited is registered in England and Wales, company number 16018331.
- [Tell us what you’re working through.](https://www.cloudpeek.io/demo/): Start with a conversation about your team’s challenges, your environment and the outcomes you want. We’ll explore where CloudPeek could help and agree the next steps together.
- [Privacy policy](https://www.cloudpeek.io/privacy/): How CloudPeek Limited handles personal information collected through this website. Last updated 20 August 2026.
- [Terms and conditions](https://www.cloudpeek.io/terms/): The terms on which you may use this website. Last updated 20 August 2026.
- [The platform, extended.](https://www.cloudpeek.io/applications/): Use CloudPeek’s free, live Vulnerability Intelligence agent plugin service inside the assistant your team already uses.
- [Vulnerability Intelligence](https://www.cloudpeek.io/applications/vulnerability-intelligence/): A free, live agent plugin service that brings vulnerability intelligence into the assistant your team already uses. Research a vulnerability, check what affects a product, or review what changed.
- [Incident triage](https://www.cloudpeek.io/use-cases/incident-triage/): CloudPeek reviews security alerts and recommends what needs attention and what can be closed. Your team gets a clear next step and the evidence behind each decision.
- [Investigations](https://www.cloudpeek.io/use-cases/investigations/): CloudPeek gathers the evidence behind an incident and explains what happened, what was affected and what to do next. Your team gets a clear report to review and act on.
- [Identity compromise](https://www.cloudpeek.io/use-cases/identity/): CloudPeek checks unusual account activity to help your team decide whether someone’s access has been misused. It prepares the steps to protect the account and keeps a record of the decision.
- [Exposure and vulnerability](https://www.cloudpeek.io/use-cases/exposure/): CloudPeek helps your team decide which security weaknesses to fix first. It connects each finding to the affected system and its owner, prepares a proposed fix and checks the result after an approved change.
- [Threat hunting](https://www.cloudpeek.io/use-cases/threat-hunting/): CloudPeek regularly checks your connected tools for signs of attacks that may have gone unnoticed. Your team gets findings to investigate and a record of what was checked.

## Discovery

- [Sitemap](https://www.cloudpeek.io/sitemap.xml)
- [Crawler policy](https://www.cloudpeek.io/robots.txt)

The team URL is a legacy alias of the Founders page. The sitemap lists canonical pages only.

## Browser agent tools

In browsers with WebMCP enabled, visiting a page exposes describe_cloudpeek and navigate_cloudpeek through document.modelContext. Current-page tools control navigation, saved product screenshots, saved intelligence views and available disclosures. The read-only describe_cloudpeek tool returns the page directory, public product resources and current interface state.

On the Talk to us page at /demo/, prepare_cloudpeek_demo_request fills the first-conversation contact form for review. The user clicks Request a conversation to send first name, last name, work email and company to CloudPeek through HubSpot. CloudPeek then gets in touch to discuss the team’s challenges, environment and desired outcomes and agree the next steps. The form does not auto-submit when an agent fills it.

## Maintenance

Page links are generated from the site's active routes.