← Sovereign Stack/Pillar P2Weeks 1–8 · first detection-as-code shipped by week 3ex · Cyber Security

Adversarial Defence Mesh — XDR · SOAR · Identity Graph · AI Red Team

Reseller SOCs sell tickets. We ship a defence mesh that learns: continuous AI red-team agents, identity-graph SOC, posture-as-code in CI, breach-rehearsal drills with measurable MTTR. Security that compounds, not catalogues.

MTTR (P1 incidents)

− 71%

Detection coverage (MITRE)

+ 3.4×

False-positive rate

− 62%

Commission this pillar →See deliverables

Flagship pods

The squads we drop in

SOC-as-Code Pod

AI Red-Team Pod

DORA / NIS2 Readiness Pod

Identity-Graph Pod

Deliverables

Everything that ships

Identity-graph SOC
Unified identity, device and workload graph powering correlation and blast-radius scoring.
Detection-as-code library
Sigma + custom rules under git, CI tests, drift alerts.
AI red-team agents
Continuous adversarial simulation across email, identity, app and cloud surfaces.
Posture-as-code controls
Terraform-bound CIS / NCSC controls, drift detection, auto-remediation.
Regulator dossier (DORA / NIS2)
Auto-generated evidence pack: ICT register, incident reporting, third-party risk.

Pod composition

Security Principal (CISSP / CCSP)
Detection Engineer
AI Red-Team Lead
GRC + Audit Lead

Partners we orchestrate

Microsoft DefenderCrowdStrikeWizSplunkSentinelOkta1Password

Example output · Detection · cred_stuffing.spike.v3yaml

detection: cred_stuffing.spike.v3
trigger: identity_graph.failed_logins
window: 5m
threshold: 40 distinct_users from 1 ASN
enrich:
  - geo.ip
  - threat_intel.bulk_lists
response:
  - sso.lock_session(user)
  - mfa.require_step_up
  - slack.notify(#sec-ops)
  - jira.create(P1, soar_runbook=cs-007)
mttr_target_p95: 6m
last_red_team: 2026-04-21 PASS

Timeline

Weeks 1–8 · first detection-as-code shipped by week 3

1
Weeks 1–2
Identity-graph baseline
Onboard IdPs, EDR, SaaS audit logs into the graph; map crown jewels.
2
Weeks 3–5
Detection-as-code + SOAR
Ship rule library, runbooks, auto-remediation; CI gates on every change.
3
Weeks 5–8
AI red-team continuous
Continuous adversarial drills, MTTR scorecard, regulator dossier signed off.

FAQs

What buyers actually ask

Do you replace our SIEM / EDR?

Usually no — we orchestrate Defender, CrowdStrike, Wiz, Splunk or Sentinel. The mesh is the brain, your tools are the limbs.

How is this different from an MSSP?

We are SLA'd on MTTR and detection coverage, not ticket volume. Detections live in your git repo, not our portal.

DORA / NIS2 ready?

Yes — the regulator dossier is shipped on day one and updated continuously, including third-party ICT risk and 24-hour incident reporting.

What about AI-specific threats?

Prompt-injection, model-exfil and agent-abuse detections ship in the standard library, with red-team coverage on every release.

Commission · P2 Adversarial Defence Mesh

Stand up Adversarial Defence Mesh in Weeks 1–8.

We'll respond within one business day with a scoping note, a fixed-price outcome contract, and a named principal cleared for your domain. Your details sync straight into our concierge queue.

• Outcome-priced — no T&M.
• Sovereign by default — your data, your region, your keys.
• Refund-backed if the contracted KPI isn't hit.