Straight answers,
not a sales pitch.

Blacklight is an autonomous agentic SOC that natively includes SIEM, UEBA and SOAR-style response in one platform, then adds the layer none of them have: AI agents that investigate and act, not just collect, correlate or alert. A SIEM stores and surfaces data; UEBA scores behaviour; SOAR runs pre-built playbooks. Blacklight does the analyst's reasoning across all of them, end to end, and shows its work. In today's terms, Blacklight is an autonomous Integrated Security Operations Center (ISOC): a Modern SIEM and a native Security Data Lake with agentic response, converged into one platform, so you don't have to assemble or choose between them.

An Integrated Security Operations Center (ISOC) brings the core of the SOC, detection, investigation and response, into a single platform instead of a stack of separate tools. Blacklight is an autonomous ISOC: it unifies a Modern SIEM, a native Security Data Lake and agentic investigation and response in one place, and runs them autonomously rather than leaving the work to your analysts.

Yes. Blacklight has a native Security Data Lake (SDL) built in, so all your security telemetry is centralised, retained and searchable in one place, with no separate data-lake product to license, pipe in or maintain. Detection, investigation and long-term analytics all run on the same data layer.

Both, by design. Blacklight is a platform, which you or your partner can operate, that delivers a managed outcome: autonomous detection, investigation and response, without a room full of analysts to run it. You keep the control and transparency of software with the effect of a fully-staffed SOC.

It does the work analysts don't want: Tier-1 triage and investigation on every alert, handing your team finished investigations instead of raw alerts. It replaces the grind, not the people: your analysts move to oversight, threat hunting and the decisions that need human judgement. It is equally a force multiplier for an existing SOC and a way to stand one up without hiring ten people.

A co-pilot waits to be asked and makes suggestions; Blacklight acts. It runs the full investigation autonomously on every alert, reaches a verdict and, within the limits you set, takes the response action, then shows the complete reasoning trail. You supervise outcomes, you don't prompt a chatbot.

It replaces your SIEM, not your EDR. Blacklight is your Modern SIEM, with autonomous investigation and response built in, so it consolidates that layer of your stack. It does not replace your endpoint protection: it works alongside your existing EDR and other security tools, ingesting from them, so you keep what's working and retire the SIEM sprawl.

Blacklight investigates across all your connected sources rather than a fixed list of pre-trained alert types. Its agents reason from the evidence in each case, so novel and cross-domain alerts are handled the way a skilled analyst would, without waiting for a playbook to be written. And it works across your whole dataset, not just a handful of predefined fields, so it makes the most of the data you already collect rather than looking at a narrow slice of it.

No. Blacklight runs autonomous detection engineering through its Plugin Hub: it reads your environment, works out what is detectable from the data you actually have, generates candidate detections mapped to MITRE ATT&CK, validates each one against your real data, and deploys only what adds measurable value. It does the relevance, tuning, false-positive control and lifecycle work that normally consumes a detection engineering team, so your people spend their time on judgement, not on maintaining rules.

Every candidate detection passes a QA gate run inside your own environment before it goes live: it is deduplicated against existing detections, scored for value-add, built against your live schema, and shadow-run against historical and live data so its false-positive ratio is measured, not guessed. Anything too noisy is auto-tuned and re-tested; anything that covers no real gap is held rather than shipped. After deployment the platform keeps monitoring each detection, re-tunes as your environment drifts, and retires detections whose telemetry disappears or that a better one supersedes.

It goes a step further. Detection-as-code gave detections version control and testing, but a human still writes and tunes every rule. Blacklight generates, validates and retires the detections autonomously, keeping the rigour and removing the backlog. Coverage is proven, not asserted: the platform maintains a per-environment MITRE ATT&CK coverage matrix, and every deployed detection carries its validation evidence, its measured false-positive ratio and its technique mapping, so you have a current, auditable answer to what you can detect today.

No. Your data is never used to train Blacklight's models or any third-party model. Every model provider is engaged under an enterprise contract that explicitly prohibits training, fine-tuning, evaluation or human review on customer data, and technically Blacklight calls inference-only APIs with zero-retention configured, never a training, fine-tuning or feedback endpoint.

Blacklight treats its specific model stack as proprietary and does not publish which providers it uses; that composition is core intellectual property. What we do disclose in full is how your data is protected regardless of the models involved: inference-only access, contractual no-training terms, zero-retention, per-tenant segregation, and redaction or tokenisation of sensitive identifiers such as PII, credentials, internal IPs and hostnames in transit.

Blacklight grounds every conclusion in the evidence it actually gathered, and each investigation runs through a Devil's Advocate check that argues the opposite case before a verdict is set. When it is uncertain or the stakes are high, it escalates to a human rather than acting. Every decision is shown with its evidence, so a wrong turn is visible and correctable, not buried in a black box.

Blacklight autonomously resolves the large majority of Tier-1 alerts, eliminating up to 95 to 99% of false positives and escalating fewer than 2% of alerts to human analysts, with triage accuracy benchmarked at around 98% against expert analyst decisions.

You decide. Blacklight runs on a spectrum you control: notify-only (it investigates and recommends, your team acts), collaborate (it acts on your approval), or authorised autonomy (it contains high-confidence threats automatically and reports what it did). High-impact or ambiguous actions default to human approval, and every action is logged and reversible.

Yes. You set the boundaries per action type: what it may contain automatically, what needs sign-off, and what stays notify-only, and you widen autonomy as trust builds. Actions are bounded, auditable and reversible.

Yes, and this is central to the platform. Every investigation exposes the full reasoning trail: what was checked, which sources were queried, what evidence was found, the Devil’s Advocate challenge and why the verdict was reached. Glass box, not black box.

Blacklight connects to your existing sources by API, so you're live in under 90 minutes, with no data migration or playbook-building first, and it's running its first investigations within the first 24 hours.

Nothing to rip out. Blacklight connects to your existing tools across endpoints, network, cloud, identity, email, databases, applications, vulnerability scanners, physical security and more, using both push and pull. That covers standard PUSH such as syslog, WMI and Logstash, PULL such as APIs and micro-services, file processing, and the standard logging protocols and formats: ODBC, JDBC, SNMP; CEF, CSV, JSON.

Yes, in the regions we support. You choose your hosting region at contract, and your data at rest stays in that region. In-country deployment is available where we operate, which matters for regulated and sovereign environments. Tell us the jurisdiction you need and we will confirm what is available.

Beyond named connectors, Blacklight ingests any standard format and protocol through its universal push and pull pipeline, and auto-parses incoming data, structuring and normalising it automatically, so its agents can make full use of a source even when there's no pre-built connector for it.

Yes. Blacklight is ISO/IEC 27001 certified and operates to formal information-security controls across the platform.

Your data lives in your own dedicated instance. We host across multiple regions, globally and locally, and you choose your hosting region at contract from the regions we support. Your data at rest stays in that region.

Every client runs on a dedicated, single-tenant instance, not a shared platform with logical separation. Your telemetry, alerts and case data are never co-mingled with, or reachable from, another client’s instance, and each instance is encrypted with keys unique to you. Only the minimum context needed for a given inference call leaves that boundary, with sensitive identifiers redacted or tokenised in transit, and access is least-privilege and audited. MSSPs and partners get a multi-tenant console to manage every client from one interface, which governs their team’s visibility only: each client remains a separate tenant with separately segregated data.

You control retention, and at contract exit Blacklight runs a documented deletion process across primary stores, replicas, caches, backups and any third-party model context. Encrypted data is crypto-shredded by destroying your per-tenant encryption key, rendering it mathematically irrecoverable. Your data is available for export for 30 days from termination before deletion runs, and a certificate of completion can be issued on request.

Blacklight is priced in tiers based on your daily data volume, or endpoint count. The important part: every tier includes the entire platform. All features and functionality are native and included, with no modules, add-ons or upsells. You don't pay extra for Automation, UEBA, threat intelligence or automated response the way you would when assembling a legacy stack.

Blacklight consolidates a stack that typically costs a mid-market organisation 1.5 to 3 million dollars a year, SIEM, SOAR, XDR, UEBA, threat intelligence and the 24/7 analyst headcount, into a single platform: replace six tools and a ten-person SOC with one. Independent research backs the direction: organisations using AI and automation extensively save 1.9 million dollars per breach and contain incidents 80 days faster (IBM, 2025).

Yes. A proof-of-value on your own telemetry is the natural next step after a demo: we run it so you see real results in your environment before you commit, never something we ask of you on a first call.

Yes. Blacklight supports multi-tenant deployment for MSSPs and partners, so a provider can run autonomous SOC services across a customer base from one platform, under an operator licence.