Book a demo →
Silence the
alert noise
Carpent investigates every alert at AI speed, discards the noise and only escalates what truly matters to your team.
Or try the live demoHow the agents resolve it
Each agent does its part. Only the critical decision reaches a person.
Alert received
EDR · CrowdStrike- powershell.exe -enc · FIN-LT-0231
Triage agent
Critical priority- 3 related alerts · Finance
Investigation agent
Rebuilds the chain- Identity✓185.220.101.47 · Tor
- Email✓Invoice_0923.docm
- Network✓cdn-sync[.]net
Thinking…
Containment agent
Automatic containment- ✓ Host isolated
- ✓ Sessions revoked
- ✓ Domain blocked
Escalated to analyst
Needs approvalDisable m.ortega's account
ApproveRejectCase CAS-1042 closed
3 min 42 s
The problem
Attackers already move at AI speed. They find a way in and move through a network in minutes.
A SOC that investigates every alert by hand runs at human speed and always arrives late. Agents take the repetitive work and your analysts keep the decisions.
The Carpent platform
Carpent connects to the tools you already run and turns thousands of signals into a small set of investigated cases.
See integrationsIntegrates with your ecosystem
EDR, SIEM, identity, email, cloud and any source with an API, webhook or syslog.
01 · Investigate
Every alert, investigated the way your best analyst would
The agent pulls context from EDR, identity and network, checks indicators against threat intelligence and rebuilds the attack chain. Every step is written down and auditable.
- 00:00.4EDRpowershell.exe -enc spawned by winword.exe on FIN-LT-0231
- 00:03.1Entra IDm.ortega signed in from 185.220.101.47 12 min ago
- 00:05.8Threat intel185.220.101.47 · Tor exit node · 14 reports
- 00:09.2EmailAttachment Invoice_0923.docm received at 02:51
- 00:14.6NetworkBeacon to cdn-sync[.]net:443 every 60 s
- 00:21.0AgentChain phishing → macro → C2. Containment advised.
Entities
FIN-LT-0231
m.ortega
185.220.101.47
cdn-sync[.]net
MITRE ATT&CK
T1566.001
T1204.002
T1059.001
T1071.001
Verdict · Agent-07
True positive
Confidence 0.97
02 · Contain
Containment in seconds, within the limits you set
Isolate a host, disable an account, revoke sessions or block an indicator. You decide what it does on its own, what needs approval and what it never touches.
| Action | Scope | Mode |
|---|---|---|
| Block IOC at firewall | All | Automatic |
| Isolate endpoint | Workstations | Automatic |
| Isolate endpoint | Servers | With approval |
| Revoke sessions | All | Automatic |
| Disable account | Users | With approval |
| Disable account | Executives | Recommend |
| Quarantine email | All | Automatic |
Guardrails
- Max 20 actions / h
- Exclude DC-01, DC-02
- 24/7 approval
03 · Escalate
Your team only gets what needs human judgement
An escalated case arrives summarised with what happened, what has already been done, the evidence behind it and the decision still pending. Approve it from Teams or Slack without opening six consoles.
- CAS-1042Pending
- CAS-1041Contained
- CAS-1039Closed
- CAS-1036Closed
- CAS-1033Closed
Alerts → cases · 7 d
Macro phishing in Finance. C2 was established for 4 min before containment.
- ✓ FIN-LT-0231 isolated
- ✓ m.ortega sessions revoked
- ✓ cdn-sync[.]net blocked
- ✓ 12 emails quarantined
Disable m.ortega's account and force a credential reset?
Add-on modules
Beyond the alerts
The same platform looks for the gaps before an attacker does. Every finding enters the case flow like any other alert.
AI pentesting
Offensive agents test your applications and perimeter continuously and validate every finding with a proof of exploitation.
$
✓ 214 routes and 38 forms mapped
✓ Authentication and permissions tested
● IDOR on /api/orders/:id
✓ Exploit reproduced, report ready
Your security teamPhishing simulation
Email, SMS and voice campaigns tailored to each department, with on-the-spot training for whoever falls for them.
Brand protection
Finds lookalike domains, fake profiles and fraudulent apps, and handles their takedown.
◆ company.comcompany-login.com✓ Taken downcompany.co✓ Taken downcompany-support.net✓ Taken downExposed credential monitoring
Watches leaks, forums and dark web markets and alerts you when credentials from your domain turn up.
combolist_2026_10.txt○ 1 284 551- s.muller@gmail.com••••••••••forum_dump_554
- a.rossi@hooli.xyz•••••••combolist_910
- c.smith@northwind.io•••••••••••combolist_975
- j.muller@initech.co•••••••••••forum_dump_974
- e.nielsen@outlook.com•••••••••••telegram_838
- a.smith@initech.co•••••••••••forum_dump_308
- e.rossi@outlook.com•••••••paste_209
- l.costa@contoso.com•••••••••combolist_985
- v.smith@outlook.com••••••••••••stealer_log_519
- s.romero@northwind.io•••••••stealer_log_445
- s.fischer@northwind.io••••••••••forum_dump_333
- n.moreau@contoso.com••••••••••forum_dump_935
- p.muller@initech.co•••••••stealer_log_498
- n.kowalski@outlook.com••••••••telegram_559
- c.romero@proton.me••••••••forum_dump_941
- m.nielsen@gmail.com•••••••••stealer_log_330
- a.fischer@northwind.io•••••••••telegram_799
- a.fischer@gmail.com••••••••••••telegram_978
- t.smith@northwind.io•••••••forum_dump_583
- d.smith@outlook.com••••••••combolist_820
- t.smith@outlook.com•••••••••••telegram_336
- p.smith@northwind.io••••••••forum_dump_900
- r.moreau@globex.com••••••••••stealer_log_308
- e.novak@fabrikam.net••••••••paste_436
- l.garcia@fabrikam.net••••••••combolist_168
- m.silva@outlook.com•••••••••stealer_log_928
- e.novak@acme.io••••••••••••paste_598
- m.garcia@globex.com•••••••••telegram_416
- a.fischer@yahoo.es•••••••••stealer_log_601
- t.garcia@gmail.com•••••••forum_dump_659
- s.moreau@initech.co•••••••combolist_318
- c.kowalski@vandelay.com••••••••••paste_838
- v.dubois@acme.io•••••••••••combolist_433
- a.garcia@vandelay.com••••••••••forum_dump_707
- n.kowalski@yahoo.es•••••••••forum_dump_533
- v.novak@fabrikam.net•••••••combolist_340
- c.lopez@yahoo.es••••••••••••telegram_886
- l.lopez@acme.io•••••••••forum_dump_314
- e.smith@contoso.com•••••••telegram_896
- l.moreau@proton.me•••••••••••combolist_681
- l.costa@proton.me•••••••••••telegram_313
- n.fischer@northwind.io•••••••••combolist_696
- m.costa@contoso.com•••••••paste_280
- v.fischer@hooli.xyz•••••••••••forum_dump_386
- d.silva@globex.com••••••••••telegram_395
- s.silva@northwind.io•••••••••••telegram_994
- l.romero@northwind.io••••••••••paste_242
- p.romero@contoso.com•••••••••forum_dump_275
- e.silva@acme.io•••••••••••combolist_734
- r.lopez@northwind.io••••••••••paste_772
- v.rossi@outlook.com•••••••••forum_dump_236
- d.costa@proton.me••••••••••stealer_log_439
- m.ortega@company.com•••••••••combolist_412
- v.garcia@vandelay.com••••••••paste_448
- r.moreau@initech.co•••••••••telegram_856
- s.muller@contoso.com••••••••combolist_458
- c.smith@fabrikam.net••••••••••••forum_dump_639
- s.kowalski@fabrikam.net•••••••telegram_357
- n.muller@initech.co••••••••••paste_727
- d.novak@globex.com••••••••••••stealer_log_441
- l.silva@vandelay.com•••••••forum_dump_174
- d.silva@outlook.com••••••••••paste_581
- r.dubois@proton.me••••••••forum_dump_443
- d.lopez@contoso.com••••••••stealer_log_192
● Matchcompany.comCombolist on a forum, 12 Oct
AI speed. Human judgement.
Agents do the repetitive work at AI speed, which no shift can match. Your team keeps the decisions that actually matter.
Book a demo< 90 s
From alert to full investigation
96%
Alerts resolved with no human input
12×
More capacity per analyst
Configurable autonomy
You decide the autonomy
Start in observation and raise the level once you have watched it work. Every action is configured separately, per asset type and per schedule.
Your SOC, or ours
For teams with their own SOC
Carpent is deployed in your environment and your analysts run it. More capacity without growing headcount.
- SaaS in the EU, in your cloud or on-premises
- Dedicated tenant, SSO and full API
- No limit on analysts or sources
Run by
For organisations that would rather not build a SOC. Our team runs Carpent for you, 24/7, with analysts who respond.
- 24/7 monitoring and response
- Our own analysts on every escalation
- Monthly report for leadership
Deployment and control
Built to be audited
- NIS2
- DORA
- ISO 27001
- ENS
- GDPR
- 01
Every action, logged
An immutable record of what each agent queries, concludes and executes.
- 02
Explainable reasoning
Every verdict carries the chain of evidence behind it.
- 03
Your data stays in the EU
European data residency. Your data is never used to train models.
- 04
Deployed your way
European SaaS, in your own cloud or on-premises, with minimal outbound connectivity.