Threxen is a fleet of AI agents that watch your telemetry every second, score it against attacker behaviour, and contain a compromise before a human ever sees the dashboard. One platform — many isolated tenants — built to operate inside the legal boundary of CFAA, NIS2, and DORA.
Agents live
247
+6 last hour
Open hunts
4
−2 last hour
Containments (24h)
11
+3 last hour
▸ live stream from tenant:eu-west-1 · sample redaction applied
02 · Capabilities
Each agent family operates continuously on the same telemetry plane. They don't hand off and forget — they share verdicts, cross-corroborate, and only escalate when their confidence overlaps.
Watchdog agents continuously score telemetry against attacker behaviours — adversarial-AI prompts, lateral movement, credential abuse, supply-chain tampering — and surface a verdict in seconds, not at end-of-shift.
agent.class = watchdogs
Confirmed compromises trigger immediate isolation: poisoned sessions revoked, tunnel interfaces shut, lateral pathways severed at the host. Every action is auditable and reversible by a human analyst.
agent.class = containment
Deceivers lay high-fidelity decoys — decoy documents, forged SaaS endpoints, fake kubeconfigs — and live-poison adversary tooling as it touches them. Attackers waste hours inside a perimeter that is already known.
agent.class = deceivers
Profilers fingerprint the actor — toolchain overlap, behavioural cadence, infrastructure history — and produce a sealed evidence packet a human reviewer (or regulator) can sign off on without re-running the analysis.
agent.class = profilers
03 · Kill chain
Threxen doesn't wait for a SOC analyst to triage. Detect → Contain → Deceive → Attribute runs without paging a human until a forensic packet is ready to review.
Telemetry is scored by behaviour, not signatures. Adversarial-AI prompt patterns, lateral Kerberos abuse, OAuth replay, supply-chain manifest drift.
Verdicts above threshold trigger autonomous host isolation, session revocation, and tunnel teardown. Mean time-to-contain: under one second.
Compromised attackers are routed into a deception mesh with high-fidelity decoys. Their tooling is fingerprinted and live-poisoned.
A sealed evidence packet — actor confidence, toolchain map, regulatory framing — lands on a Tier-2 analyst desk, ready for action.
04 · Tenancy
Regulators don't trust shared multi-tenant SaaS. Threxen runs every customer — and every business unit, subsidiary, or jurisdiction inside each customer — as its own cryptographic enclave. Operators can't read tenant data, and a breach in one tenant can't reach another.
Per-tenant key envelope
Every customer — and every BU, subsidiary, or jurisdiction inside it — gets its own cryptographic key envelope. Threxen operators cannot read tenant data.
Sector-pinned storage
PHI stays in HIPAA-only data planes. Card data stays in PCI-isolated CDE views. EU operational data stays in EU-only jurisdictions.
End-to-end encryption
At rest and in transit. Keys never leave the tenant envelope; rotation, escrow, and HSM-backed bring-your-own-key are first-class.
Forensic replay
Every agent decision — every hunt, every containment — is sealed with a hash chain your auditor can re-verify months later.
Tenant lattice
logical view▸ each hexagon = one cryptographic key envelope · edges = signed audit lane · no shared egress
05 · Policy packs
Every regulated framework Threxen supports ships as a policy pack: a set of detections, containment rules, evidence formats, and reporting cadences the relevant regulator already recognises.
PHI access boundaries, audit trails, BAA-grade isolation across covered-entity tenants.
status: pinned · audit: continuous
CDE segmentation, card-data-flow whitelisting, key-evident forensic replay of every containment.
status: pinned · audit: continuous
US-only data egress, FIPS-validated key envelope, continuous-control reporting aligned to NIST 800-53.
status: pinned · audit: continuous
ICT-risk register, third-party-provider incident timelines, and operational-resilience testing posture for EU financial entities.
status: pinned · audit: continuous
Essential-entity incident reporting timelines, supply-chain risk register, and sector-specific escalation policies.
status: pinned · audit: continuous
Active defence is bounded inside the customer perimeter — no offensive operations against third-party systems, ever.
status: pinned · audit: continuous
Brief a defence architect
Thirty minutes. A sample stream. Watchdog agents scoring it in front of you and a containment verdict landing in real time — no slides, no forward-deployed engineer. NDA available; procurement not required.
Quick request
form · ~60sWe'll come back with a tenant topology, the active policy packs, and a one-line mailto your auditor can read.
Mission differentiator
Watchdog, Deception, Containment — the three traits every Threxen tenant ships with on day one. They are how a SOC stops being its own bottleneck.
Watchdog agents run continuously on every tenant stream — adversarial-AI prompt patterns, lateral SMB, OAuth replay, supply-chain drift — and surface a verdict in seconds, not at end-of-shift.
Deceivers lay decoy documents, forged SaaS endpoints, and fake kubeconfigs — then live-poison adversary tooling the moment it touches them. Attackers waste hours in a perimeter they have already lost.
Confirmed compromises trigger immediate isolation: poisoned sessions revoked, tunnel interfaces shut, lateral pathways severed at the host. Every action is auditable and reversible by a human analyst.
Compliance
Every badge ships as a governed policy pack — detections, containment rules, evidence formats, and reporting cadences the relevant regulator already recognises.
06 · Pricing
Pick the entry point that matches your sector and the regulators you report to. Scale up without re-architecting tenants.
For platform teams getting a first defence posture live.
For regulated teams running containment in production.
For multi-jurisdiction operators and US federal work.
▸ billed monthly · annual = 2 months free · procurement / PO accepted on Business and Enterprise
07 · For your analysts
Threxen contains autonomously but never silently. Tier-2 analysts receive a sealed evidence packet for every hunt — actor confidence, toolchain overlap, the detections that triggered, and a one-click reversible trail. They approve, reverse, or escalate. The agent does not.
watchdog-04
Lateral SMB enumeration on seg-eu-12
deceiver-02
Honeyfile touched · toolchain fingerprint sealed
profiler-01
Actor cluster typed FIN-117 (conf 0.81)
watchdog-09
OAuth refresh-token replay from exfil IP range
deceiver-05
Decoy decoy-svc hit 11 paths · 2 tooling fingerprints
▸ final channel · talk to a human
Tell us your sector, your attackers, and your regulator. We'll send back a tenant topology, the active policy packs, and a one-line mailto for your auditor.
provisioning within 48h · SOC 2 audit pack bundled