CyberCLI
Sign in →

The product, end to end

Same incident.
Three tiers.
Three response depths.

A spear-phish lands in finance. The endpoint executes Cobalt Strike. Outbound C2 fires. The detection chain is the same on every tier — CyberCLI assembles the picture in 90 seconds. What changes when you pay is how much CyberCLI is allowed to do about it. Watch the four-beat opening below, then switch tiers at the inflection point to see the difference: notify-only, one-click verified action, or a full sequenced multi-action plan under a single human gate.

Scenario is composite — drawn from real adversary tradecraft. Engine state, Guild role activations, Trust Ladder checks, and audit-chain shape are how the product actually behaves today. CYCON elevation is engine-driven on every tier including Free: deterministic posture rules (no AI required) move the dial when signal-scores + multi-substrate correlation cross thresholds. CYCON de-escalation is engine-driven too — after a 4-hour quiet window with the action queue clear, the case CONTAINED, and no high-severity signals, the engine steps the dial down one level per window (operator-configurable to "human triage" per state; CYCON 1 → 2 is always human on Free/Pro). A suppression layer lets operators acknowledge known noise once; pattern-change drift (3× volume, ±2h time, severity escalation) auto-unsuppresses. Flap-lock freezes posture after 3+ auto-drops in 24h. AI-recommended posture (Sentinel role, Overwatch chapter) is doctrine v1.5.

5
T+0
5
T+30s
4
T+1m
3
T+90s

Universal detection chain · 4 beats · ends at CYCON 3 with the case fully assembled

Quiet morning. M365 reports a new inbox rule.

A user in Finance just added an inbox rule that auto-forwards anything matching “invoice” or “wire” to an external address. M365 surfaces it as a low-severity audit event. The engine stays at Steady Watch — most rules are legitimate. Warden picks it up and starts the triage clock.

Connector Microsoft 365 (audit log) — InboxRule created
Trust Ceiling
L2 — Warden may close obvious benign-positives with logged rationale. No containment authority.
{"event":"InboxRule","user":"k.morris@acme.com","conditions":["subject:invoice","subject:wire"],"action":"forwardTo:exfil@protonmail.com","CreationTime":"2026-05-26T09:14:03Z"}

Engine correlates: same user, recent Avanan phish flag.

The engine's correlation layer matches the inbox rule against 24-hour threat-intel context. 18 hours ago, Avanan quarantined a spear-phish targeting the same user — same infrastructure cluster, plausible kill-chain assembly. Warden raises the signal weight; the rule is no longer routine.

Connector Avanan (cloud email security) — Quarantined phishing — same recipient, 18h prior
Trust Ceiling
L2 — observational. Correlation alone doesn't authorize action.
{"avanan":"phish_quarantine","recipient":"k.morris@acme.com","sender":"finance@acme-payroll[.]co","sha256":"4f1c…d92e","detected":"2026-05-25T15:08:11Z"}

Wazuh: same endpoint ran unusual PowerShell five minutes ago.

Wazuh fires on the endpoint k.morris was using. Obfuscated PowerShell — encoded payload, parent process is Outlook. Multi-substrate correlation + EDR fire crosses the engine's posture-scorer threshold. The CYCON dial moves to 4 automatically; no operator click required. Audit chain stamps the transition as SYSTEM-initiated. Notification routing and Trust Ceiling defaults shift accordingly. This is the engine telling itself it's not Tuesday anymore — and on Free tier just as on Business.

Connector Wazuh (EDR) — Suspicious PowerShell + parent=Outlook
Trust Ceiling
L2 — Warden classifies and routes. CYCON elevation is engine-driven via deterministic posture rules — no AI, no operator click. v1 ships this on every tier including Free.
{"wazuh":3304,"rule":"PowerShell encoded command from email client","agent":"WS-FIN-117","parent_image":"OUTLOOK.EXE","cmdline":"powershell -enc YQBhAGEA…","cycon_transition":{"from":5,"to":4,"by":"posture-evaluator-v1","initiator":"SYSTEM","reason":"score=14 · signals=3 · connectors=2 · recommended=CYCON-4"}}

UniFi: endpoint is talking to a known C2 IP.

UniFi flow logs show WS-FIN-117 has opened a sustained outbound connection to 185.220.x.x — a Cobalt Strike controller on the latest threat-intel drop. The picture is now end-to-end: phish → execution → C2. The score crosses the CYCON-3 threshold; the engine moves the dial again. Total elapsed: 90 seconds, zero clicks. The case is fully assembled and what happens next depends on tier.

Connector UniFi (network) — Sustained outbound to known C2 IP
Trust Ceiling
L2 — assembly only. The case lands in the queue; what happens next depends on your tier.
{"unifi":"firewall.flow","src":"10.42.7.117","dst":"185.220.103.7","port":443,"bytes_out":18432,"duration_s":47,"intel":["mandiant.cs","crowdsec.community","cisa.aa24-318a"],"cycon_transition":{"from":4,"to":3,"by":"posture-evaluator-v1","initiator":"SYSTEM","reason":"score=28 · signals=4 · connectors=3 · recommended=CYCON-3"}}

The picture is assembled · case ready · the demo turns interactive here

What happens next depends on your tier.

Same incident chain, same evidence, same correlation. The difference is how much CyberCLI is allowed to do about it.

▼ Try it — pick a tier below ▼
Tap a tier →

The walkthrough below rewrites itself for the tier you pick.

Business tier preview · v1.1 + v1.x — The Business depth below (multi-action Marshal plans · Scribe compliance writeups · cross-site Regent view) ships in v1.1 (single-action) and v1.x (multi-action chains). v1 today routes Warden triage + Herald notify; Business's extra agents and compliance role land as the orchestrator + Scribe LoRA calibrate. See pricing for the v1 vs v1.1 / v1.x split.
Response boundary · Business+
AI can do
Correlate · Verify · Sequence multi-action plan · Execute approved plan · Write case
AI needs approval for
ANY destructive plan without explicit operator approval
Human decision point
One Approve/Deny on the FULL sequenced plan, then audit-tail review

Knight verifies the payload. TRUE_POSITIVE.

Knight pulls the PowerShell artifact, re-detonates in sandbox, queries EDR — TRUE_POSITIVE, Cobalt Strike loader. Verdict + evidence land on the case in under 30 seconds.

Connector Knight (sandbox + EDR) — Verification verdict: TP
Knight Detection
Verifies — TP confirmed via re-detonation
Trust Ceiling
L3 — Knight runs pre-approved low-blast verification playbooks. Containment still gated.
{"knight":"verify","case":"C-2026-05-26-0914","verdict":"TRUE_POSITIVE","confidence":0.94}

Marshal sequences a multi-action plan. Operator gets ONE approval.

Marshal sequences four coordinated actions ordered by blast radius and reversibility: (1) isolate WS-FIN-117 via the Wazuh agent, (2) block the device at the edge via UniFi, (3) disable k.morris's account via Microsoft 365, (4) revoke k.morris's active sessions via Microsoft 365. All four reversible. The whole plan goes to the operator's queue with ONE approval prompt: [Approve Full Plan] [Approve Subset] [Deny]. Operator clicks Approve. Paladin executes the approved plan under the AuthorityBridge gate — 14 seconds of human input gates four substrate actions.

Connector Paladin → multi-substrate (Bridge-gated) — Plan approved; Paladin executes the sequence
Marshal Command
Sequences the four actions, orders by reversibility
Paladin Shield
Executes the approved 4-action plan across substrates under the AuthorityBridge gate
Trust Ceiling
L5 — plan authorized as a single approval_id. Each action carries its own audit row + rollback path.
{"audit":"a8f3…c129","approval_id":"AP-2026-05-26-0914-PLAN","executor":"Paladin","actions":[{"wazuh":"isolate_agent"},{"unifi":"block_client"},{"m365":"disable_user"},{"m365":"revoke_sign_in_sessions"}],"reversible_all":true}

All four actions confirm. Scribe writes the case.

UniFi confirms isolation. M365 confirms rule deleted + MFA challenge issued. Avanan confirms six related messages quarantined. Each connector callback writes the verdict back to the case in parallel. Scribe drafts the incident summary — disposition, timeline, evidence pointers, audit-chain receipt, ATT&CK mapping. CYCON de-escalates.

Connector All four substrates — All actions confirmed successful
Scribe Record
Composes the case + summary
Trust Ceiling
L2 — write-only to case. No further outbound actions during de-escalation.
{"case":"C-2026-05-26-0914","status":"CONTAINED","actions_completed":4,"actions_failed":0,"summary_chars":847,"attck":["T1566.001","T1059.001","T1071.004"]}

Herald notifies. Audit chain sealed. Back to Steady Watch.

Herald pushes operator + on-call notifications with the plain-English summary and the audit-chain receipt. The hash-chained audit log finalizes with cryptographic receipts. Engine sees: case CONTAINED, action queue empty, no new high-confidence signals — surfaces the "Ready to drop" banner. The operator clicks the dial back to 5. Total elapsed: 5 minutes. Total operator input: one approval at T+2m + one CYCON click here — same dial as Free and Pro, dramatically less time-on-task because the four-action sequenced plan collapsed all the cleanup into the one upfront approval.

Connector Notification + audit + dashboard — Banner surfaces · operator drops CYCON to 5
Herald Voice
Routes notifications · confirms the dial-back · seals the chain
Trust Ceiling
Operator-driven dial — same v1 model as every tier; the difference is the collapsed manual tail. (v1.5 Sentinel will auto-recommend the drop.)
{"notification":"sent","channels":["slack","email","queue"],"audit_chain_sealed":true,"chain_root":"7b21…001a → a8f3…c129","cycon_now":5,"transition_by":"operator","operator_active_minutes":~0.5}

Same chain. Your tier sets the ceiling.

That's the product.

Every action carries a reversible rollback path. Every approval carries a hash-chain stamp. Every Guild role operates inside a charter and a tier-bound Trust Ceiling. You can audit every step. You can revoke any action. You own the keys.

Meet the roster
The Cyber Guild
23 specialized AI roles, 8 in-instance chapters + 1 Crown Layer.
Why you can let them act
Trust Ladder
8 calibrated levels. v1 ships L3 (AI proposes) for writes. You dial per action, per connector, per CYCON state.
Substrate
Connectors
Wazuh, UniFi, M365, Avanan, and 20+ more.
Pick your tier
Pricing
Free forever for 10 endpoints. Founder Pro $299/yr locked for life.

The beacons are lit the moment the signal crosses the line — every tier, no human required.

The math behind the dial · free-tier capable

Why CYCON moved. How it gets back.

The Free-tier substrate engine — Vector + VRL + the SOC pipeline — is enough by itself to move CYCON. Warden (Pro AI triage) makes what you read in the queue richer, but the dial decision is made by deterministic math on the severity your connectors already emit. No AI required.

Why it goes up

Severity → score → CYCON

Each accepted event lands a signal at a normalized severity from the connector's VRL (Wazuh rule_level, UniFi DPI rules, suricata, etc.). The substrate sums point values inside a 600-second sliding window:

info0 pts
low1 pt
medium4 pts
high10 pts
critical25 pts

Plus a multi-connector bonus: (distinct connectors − 1) × 3. A coordinated burst across UniFi and Wazuh hits the threshold faster than the same volume from one source.

window scoreCYCON
≥ 801 · Max Defense
≥ 452 · Active Threat
≥ 223 · Elevated
≥ 104 · Heightened
< 105 · Steady Watch

How it comes back

Quiet window + lifecycle gates

Every 60 seconds the engine asks four questions. All four must say "yes" before CYCON steps down one level:

  • ① Has the alert phase been quiet? No high or critical signal in the last 4 hours (configurable). Every elevation resets this clock.
  • ② Is the queue clear? No actionable signals in the window that haven't been dispositioned — AI-judged, operator-judged, or auto-archived as benign.
  • ③ Are there no pending approvals? No open ActionItems in the work loop. (Open approvals = operator is mid-incident.)
  • ④ Are all cases closed? No open investigation containers.

When all four are clear: one step down per quiet window. 3 → 4 → 5 takes at least 8 hours by default. Flap-lock: three auto-drops in 24h freezes the dial for 24h so a noisy environment can't yo-yo posture.

The loop · substrate-only · free tier 

  device log
     │
     ▼
  ┌──────────────────────────────────────────────┐
  │  Vector + connector VRL                       │   normalizes vendor fields →
  │  (free, ships with every install)             │   severity_normalized
  └──────────────────────────────────────────────┘
     │
     ▼ /run/cybercli/syslog.sock
  ┌──────────────────────────────────────────────┐
  │  SOC pipeline                                 │   dedupe, ingest, emit Signal
  │  (free; no AI required at this stage)        │
  └──────────────────────────────────────────────┘
     │
     ▼
  ┌──────────────────────────────────────────────┐
  │  Posture scoring (600s window)                │
  │  info=0 · low=1 · med=4 · high=10 · crit=25  │
  │  multi-connector bonus: (N-1)×3              │
  └──────────────────────────────────────────────┘
     │                          │
  score < 10                score ≥ 10
     │                          │
     ▼                          ▼
  ┌─────────┐         ┌──────────────────────┐
  │ CYCON 5 │         │ CYCON 4 / 3 / 2 / 1  │  ←  beacons lit · audit-chain row
  └─────────┘         └──────────────────────┘
                              │
                              ▼
                  ┌──────────────────────────────────────────────┐
                  │  Digest lane (parallel to posture)            │
                  │  Free:  human-only · echoes severity_normalized │
                  │  Pro:   Warden AI triage · richer summary       │
                  └──────────────────────────────────────────────┘
                              │
                              ▼ every 60 seconds
                  ┌──────────────────────────────────────────────┐
                  │  De-escalation tick                           │
                  │  quiet window? queue clear? actions clear?   │
                  │  cases closed?                               │
                  └──────────────────────────────────────────────┘
                              │
                       all yes (after 4h)
                              │
                              ▼
                  ┌──────────────────────────────────────────────┐
                  │  set_defcon(target, direction="deescalate")  │   one step down ·
                  │                                              │   audit row recorded
                  └──────────────────────────────────────────────┘
                              │
                              ▼
                       back toward CYCON 5

Free tier on its own

Substrate moves CYCON. Operator reads the queue, dispositions signals, closes cases. Auto-de-escalation works the same way it does on Pro.

Add Warden (Pro)

Same elevation math. Warden replaces the human-only digest with AI triage — richer summary, confidence, recommended action. Dispositions still gate de-escalation; AI just gets to set them faster.

Operator override

Manual POST /v1/cycon/drop at any time. Sets a 30-minute operator hold against auto-elevation so a known-handled event doesn't flip the dial right back.

Source-of-truth files: src/cybercli/posture/config.py (point table + thresholds), src/cybercli/posture/scorer.py (window + bonus), src/cybercli/posture/deescalation.py (quiet window + flap-lock), src/cybercli/pipeline.py:_deescalation_gates_satisfied (gate composition), src/cybercli/cli/setup.py:_deescalation_tick_forever (60-second periodic tick).

v5.4 · tier-toggle restructure · shared opening + Free/Pro/Business denouement · response-boundary strips · grayed-CTA + ghost-clock on Free · canonical scenario shared with /guild role chips