Use cases
Triage and investigation first. Then the rest.
Running on the same platform, in your tools, at the autonomy level you set. Two of them are already proven in production at scale, and they are where almost every deployment begins.
Where CloudPeek is proven
The two that carry the shift.
Triage
Incident triage
Every alert worked, not just the top of the queue
Detection volume outruns the rota, so the queue decides what gets looked at rather than the risk. CloudPeek works each one and either escalates it with evidence or closes it with a written reason.
Up 100%
alert coverage in live production
ingest · enrich indicators · resolve entities · correlate history · verdict with reasoning
Investigation
Investigations
Escalations investigated properly, in minutes rather than days
When triage escalates, the real work starts: reconstructing a timeline across sources, establishing scope, reaching a root cause and writing it up so somebody else can act on it.
10x
faster investigations, 16,000+ run in 2026
open · reconstruct timeline · establish scope · determine root cause · write up
And the work that follows
The same platform, the same record.
Identity
Identity compromise
Impossible travel, token reuse, consent grants and privilege escalation, investigated against sign in history, device posture and known travel patterns.
sign in review · device posture · consent audit · session revocation · forced reauthentication
Exposure
Exposure and vulnerability
Findings assessed against exposure, exploit availability and business criticality, rather than a severity score read in isolation.
asset ownership · internet exposure · known exploited status · patch route · verification
Hunting
Threat hunting
Hunts expressed as playbooks, run on a schedule across the estate, mapped to ATT&CK techniques, with findings written back to the knowledge layer.
hypothesis · query across sources · cluster results · technique mapping · record
Response
Containment
Isolation, revocation, blocking and patching prepared as a plan with scope declared, held for approval unless you have set the workflow to act.
scope declared · blast radius bounded · approval gate · execute · verify
Assurance
Assurance and audit
Every investigation and action is a timestamped record, exportable for internal assurance, regulators and auditors, rather than reconstructed at audit time.
append only trail · control mapping · export pack · retention under your policy
