Sovereign AI security that proves itself.
An AI SOC analyst, continuous attack validation, and the platform under both — working with the EDR, XDR and NDR you already run.
Every Phoenix product runs on your own hardware and reasons with a local, open-weights model you host. We don't ask you to trust the model. We show you the receipts.
More signal than any human can read.
That isn't a defect — it's what a comprehensive ruleset does. The industry's fix is an AI analyst that reads the stream for you. Almost every commercial version of that fix ships your logs to somebody else's cloud model.
Volume defeats attention
When a channel emits hundreds of alerts a day, it stops being read. Not through negligence — through arithmetic.
Rules only find the known
A detection rule is a hypothesis written in the past. It can't fire on the attack nobody wrote a rule for — and it can't tell you it didn't.
Quiet failures are the deadly ones
A SIEM that stopped receiving logs looks identical to a quiet night. So does triage that has been silently failing for three days.
For regulated, sovereign and air-gapped operators, shipping logs to a cloud model isn't a preference — it's often prohibited outright, or gated behind approvals that never come. Phoenix is the other answer.
One loop: attack, detect, build — all on your hardware.
Continuous, authorized adversarial validation of your own estate. It doesn't scan for theoretical weaknesses — it safely proves which are real, ranks them by what's exploited in the wild, and hands you an evidence-backed fix list.
An autonomous SOC analyst that triages every alert, reads the raw log firehose for what no rule matched, hunts across days of data, and reports with the underlying log lines attached — so a human can spot a wrong conclusion in seconds.
The sovereign AI platform underneath it all: an OpenAI-compatible API and MCP server with 15 specialized security agents and 50+ tools, wired into Wazuh and OpenSearch, with identity and audit built in.
Exposure → detection → response, without a byte leaving your walls.
Receipts, not claims.
Four principles, taken straight from how the software is actually built.
Authority lives in code, not the model
The model can name an action from a fixed list; it can never invent one. It can request a firewall block, but a check in code it can't see or change decides whether to run it. Assume it's fallible, misreading, even jailbroken: it can still only act inside that fixed, code-owned boundary. That holds across model releases.
Nothing is armed before it is measured
Every automated gate goes through three stages — watch, rehearse, then act (observe → shadow → enforce). It records the decision it would have made against live traffic before it is ever allowed to act on one.
Silence is the enemy, not error
The system is built to make its own failure noisy. A process that stops working is caught by a separate watchdog, because a stuck process can't raise its own alarm.
Provable non-egress
No customer log, alert or internal indicator leaves your network. Public indicators (a file hash, an external IP) are checked against reputation feeds only through one auditable chokepoint, and only for the feeds you switch on. It's enforced in code: the build fails if any module outside that chokepoint can open a socket — an architecture you can audit and test behind your own deny-all firewall.
The rooms hosted-AI vendors are structurally excluded from.
Regulated finance & healthcare
Where log egress to a third-party model is a compliance non-starter.
Government, defense & OT
Air-gapped and critical-infrastructure environments the cloud cannot set foot in.
Any SOC drowning in alerts
That wants an AI first pass it can actually check, line by line.
The rule that customer data never leaves the building looks like a handicap. It forces a safety argument you can read in an afternoon — a worse analyst than a frontier model, and a better thing to put in front of a firewall. Read the full argument →
Ready to see the receipts?
[email protected] · on-prem · local model · zero egress