Detected before it is suffered

Every type of event has its rule and its threshold. Reuse of a session token opens a critical incident immediately, with no counter. More than five 2FA failures in a minute, for one user or from one address: high-severity incident. More than ten login failures in a minute from the same address: incident. An API key used from an address never seen before: incident, to be confirmed.

• Session reuse: critical, immediate, all sessions revoked
• Burst of 2FA failures or 2FA activation failures: high
• Burst of login failures from the same address: monitored
• API key from a new IP address: flagged

Every incident carries a severity, a status and its history. Repeated events are aggregated over a short window rather than opening ten incidents for a single attack. AI then reads the incident and adds a summary, a recommended severity and suggested actions — so that a human decides quickly, with the right material.

• Critical, high or medium severity; status tracked through to closure
• Aggregation of repeats over a short window
• Summary, recommended severity and suggested actions from AI
• Full history of every incident

Suspicious activity on an API key triggers an alert email to the account administrators. Security logs are kept for the same minimum periods as the audit log, and automatic purges are themselves traced.

• Email alert on suspicious API key activity
• Sessions revoked automatically in the event of reuse
• Logs kept with minimum retention periods
• Automatic purges logged