01
Sovereign by default
Single-binary install. Your alerts never leave your network. Local Ollama auto-detected; BYOK frontier optional. Zero telemetry to us, ever.
Sovereign agentic AI SOC · v1 design-partner build
Your SOC.
Your AI.
Your audit chain.
Single-binary, on-prem agentic security operations. 24 open-source connectors including Wazuh. Local AI by default. Hash-linked audit chain. No cloud, no telemetry, no compromise.
Install on Linux · single binary · no daemon
$
curl -sSL https://cybercli.com/install.sh | sh On-prem
100% sovereign · alerts never leave your environment
No telemetry
Zero callbacks · no usage beacons · ever
Audit chain
Hash-linked · append-only · exportable
What you get
Three properties no cloud SOC can offer.
02
OSS-extending, not OSS-locked
Built on 24 open-source connectors including Wazuh (Suricata, ClamAV, nginx, Falco, Keycloak, WireGuard, pfSense, and more). Add proprietary connectors on Pro.
03
Agentic, with a leash
Six-role Cyber Guild (Warden / Knight / Marshal / Herald / Scribe / Governor). Trust Ladder caps autonomy per action class. Every decision hash-chained and replayable.
The roster
24 open-source connectors. 6 proprietary on Pro.
We don't replace your tools — we orchestrate them. Free tier covers the full open-source roster. Pro adds the cloud-identity + EDR substrate that the major vendors gate behind enterprise pricing.
Free · OSS · 24 connectors
- Wazuh
- Suricata
- Zeek
- ClamAV
- Falco
- auditd
- osquery
- pfSense
- OPNsense
- CrowdSec
- WireGuard
- OpenVPN
- nginx
- Apache
- Caddy
- Traefik
- HAProxy
- Coraza
- AdGuard Home
- Pi-hole
- OpenCanary
- Cowrie
- Trivy
- Proxmox
Pro+ · proprietary · 6 connectors
- Microsoft 365
- Google Workspace
- CrowdStrike
- SentinelOne
- Okta
- UniFi
Cyber posture as a first-class signal
CYCON. Like DEFCON, for your network.
A 5-tier posture indicator the whole org reads at a glance. Operators see it in the dashboard chrome; executives see it on the status page. Engine-derived from live events — never set from a toolbar.
5
Steady Watch
Normal operations
4
Heightened Awareness
Increased intel watch
3
Elevated Risk
Force readiness up
2
Active Threat
Pre-incident posture
1
Maximum Defense
Incident in progress