Shipped.Most security tools hand you a wall of events and wish you luck. Issue № 5 — a page where the platform does the first investigation and hands you a conclusion.
Lead item
Findings: investigations that write themselves up
Every 30 seconds, the platform looks at your organization's recent activity for the patterns that usually mean trouble: beaconing to a suspicious host, large or high-entropy uploads, a burst of blocked attempts against one app, a run of failed logins. When something trips, an AI investigator picks it up. It pulls the device's access events and inspection results, checks how the two line up, and writes a finding: what happened in plain sentences, the specific events behind it on one timeline, how confident it is, and a suggested next step. Then you read it. The investigator is read-only: it can look at anything it needs to, and it can never change a policy, a zone or a setting, so the worst a wrong conclusion can do is be wrong. Every finding has a one-click Helpful / Not helpful, with room for a line on why, and you can change your mind later.
It's opt-in. To write a finding, the investigator sends details of the flagged activity to an AI model provider, with names, internal addresses and paths replaced by placeholders first. An organization admin has to turn it on, and until they do, nothing is investigated and none of your events are read for it. You can turn it off at any time.
Open Findings →Next up
There is a version of this feature that acts on its own: block the device, change the policy, close the case. We chose not to ship that one first. An investigation earns trust by being right in front of a person, many times, before it is allowed to do anything else.— the Threatmatic team