Solution · Security

Catch an agent or a workload behaving oddly.

A boundary stops what you did not grant. Detection tells you when something inside the boundary starts acting unlike itself.

The security triage queue in the AuthFI console.

Findings to triage

Each finding says in plain words what was seen. You confirm it as real or dismiss it, and that verdict is what detection learns from.

What changes

The problem as most companies have it today, and the same thing with AuthFI.

Today: Alerts are raw events nobody has time to read
With AuthFI: A finding says what was seen, in a sentence
Today: A compromised workload looks like any other
With AuthFI: Running a new program, looking up a new name and reaching it is recognised as a sequence
Today: Detection is a black box that is always sure
With AuthFI: Accuracy is shown as measured, or as not yet measured
Today: Findings pile up with no outcome
With AuthFI: A person confirms or dismisses each one

How it works

Each step, on the screen you would use.

Findings

Findings a person can act on.

Each finding names the subject, what happened and how serious it is, and waits for a verdict.

A sign-in after a burst of failures

Two sign-ins too far apart

A workload that ran something new and reached it

The security triage queue in the AuthFI console.The security triage queue in the AuthFI console.

Context

The record behind every finding.

Open the record for the same subject and see what it did before and after, and what was refused.

The same subject across sign-in, tools and the machine

Refusals beside successes

Export to your tools

The audit record in the AuthFI console.The audit record in the AuthFI console.

See the findings on your own estate.