Security forthe agenticera.
Ahlume agents hunt for threats, write the detections to catch them and publish them into the SIEM and EDR you already run, at machine speed. Our analysts review every hunt and rule before it goes live.
Meet the agents. They never sleep, and never ship alone.
Attackers already work at machine speed. Ahlume agents give your defence the same pace: they hunt, research, correlate and draft. A named analyst reviews every draft, and no agent publishes or tests anything on its own.
Vesper hunts, then writes the rule so it never has to hunt for that again.
Vesper turns every new threat into hunts across your logs and detection rules for your SIEM and EDR. Hunts look back; rules watch forward. A detection engineer approves each one before it goes live.
- Picked up the new advisory on an exploited VPN flawAgent
- Hunted back through 30 days of your sign-in and network logsAgent
- Drafted rules for Sentinel and Defender XDR, mapped to ATT&CKAgent
- Opened the rules for review, with notes on what to tuneAgent
- Approved. Rules published to your SIEM and EDREngineer
From new threat to live detection in minutes.
When a new attack breaks, Vesper drafts the hunts and detection rules for your platforms straight away. Once a detection engineer approves them, they're published into the tools you already run. No new agent on your endpoints, and no new console for your team to watch.
- Microsoft Sentinel
- Microsoft Defender XDR
- CrowdStrike Falcon
- SentinelOne
Every rule is mapped to MITRE ATT&CK, so you can see what you're covered for and where the gaps are.
- 09:12Lumen publishes the advisory after analyst review
- 09:14Vesper drafts hunts and rules for Sentinel and Defender XDR
- 09:20Vesper hunts back through 30 days of your logs: nothing found
- 09:31A detection engineer reviews and approves the rules
- 09:32Live in your SIEM and EDR
// Hunt: exploitation of the edge VPN flaw DeviceNetworkEvents | where Timestamp > ago(30d) | where RemotePort == 443 and InitiatingProcessFileName =~ "vpnd" | where RemoteUrl has_any (iocDomains) | summarize hits = count() by DeviceName, RemoteIP
Find what you didn't know you had. Fix what's under attack.
Most exposure tools hand you a list of thousands. Glint finds every asset tied to you, then Lumen's threat intelligence tells you which exposures attackers are using today, so you start with the handful that matter.
Discover
Every domain, host, certificate and cloud service tied to you, including the ones nobody listed.
Exposed
Services open to the internet that shouldn't be: remote desktop, admin panels, databases.
Vulnerable
Known flaws in what's exposed, checked against the versions you actually run.
Being exploited
The flaws attackers are using right now, according to our threat intelligence. Fix these first.
Example figures for a mid-sized company.
And people for the work agents can't do.
Testers, detection engineers and incident responders, organised the way our mark is drawn: your estate, the systems behind it and your core.
Everything an attacker can see, watched every eight hours.
Hosts, certificates, leaked passwords, lookalike domains and the suppliers you depend on, with our analysts on everything Glint and Lumen find.
Who we help
Growing businesses
A security team you don't have to hire: agents watching around the clock, and people to test, fix and respond.
Private equityAhlume Diligence
Price cyber risk into the deal, see it fall through the hold, and prove it at exit, across every fund.
Portfolio companies
One list of what to fix, monitoring of you and your suppliers, and evidence your fund and insurer will accept.