Skip to main content

The problem it solves

Context

Over the past decades, attack rates increased unchecked, making it nearly impossible for security analysts to keep up. According to Forrester Research, a SOC team is tasked with investigating 11,000 alerts/day on average. 18% of them are manually reviewed and 32% are false positives, while a concerning 43% are either ignored or touched only by automation. What's even more concerning is that nearly 50% of SOC managers admit that their staff cannot manage to investigate every alert. In a company with 20K+ employees, for example, the number of ignored alerts rises to 36%. The sheer volume of information can be overwhelming, leading to information overload. Sorting through and discerning credible information becomes challenging.

It becomes harder and harder to distinguish useful data from noise, and for every milestone we reach in securing the cybersecurity space, there are attackers using the same technological innovations for improving their attack techniques.

Security experts benefit from sufficient data to draw conclusions when it comes to potential threats. But their day to day job means switching from one tool to another, following tracks of what could be a threat from system to system, screen to screen, until they ultimately decide if they’ve been chasing malicious actions or false positives. The very tools that were meant to give them data - automation tools, in the end - are also the ones slowing them down. The result is burnout, turnover, and lower efficacy than required.

Outcome

  • Reduces significantly the response time to incidents

    Arcanna can handle hundreds of events at the same time, concluding in a matter of milliseconds. The post-decision integrations are triggered immediately, and events that need to be treated with priority are being signalled, therefore saving your analysts valuable time that they would normally spend investigating each and every event. Saving up to 95% of the time they would have spent on false positives, they gain it back to focus on what really matters - threats.

  • Preserves collective knowledge

    We are committed to building ethical and explainable AI. The engine starts without any know-how and evolves inside your organization. All the experience that it manages to absorb, all the data, the models and the practices inferred stay with you and are not being transferred to other companies. The process is transparent and defined such that you can, at all times, retrieve the data and the resulting models, which are going to always be trained in your ecosystem.

  • Addresses staff shortage

    With Arcanna.AI you build your own SOC hero. It learns from the expertise of all your analysts, becoming robust to noise in the data that it ingests, and gives you insights into the decisions it took. A 24/7 analyst that doesn't fatigue and is not overwhelmed by the amount of events it needs to treat.

  • Reduces alert fatigue

    Autonomous decision making means your analysts won't have to spent time on irrelevant or merely informative events. They will have few and few daily alerts to investigate, thus reducing alert fatigue.

  • Consistent results, fully explainable

    Predictive AI is essential for data-driven applications; it learns from historical data to forecast patterns and make decisions on new data. Its decision points have weights assigned to them through training, which tell the importance of a decision point in predicting the target result. Our approach relies on predictive AI, with generative post-decision actions. Thus, every decision Arcanna makes will be justified on pre-existing patterns and can be interpreted into an executive text to understand which data points weighed in the decision, what past data was classified as, and by which analyst.

Docusaurus