Agents are not an interface.
They are part of the operating model.
In cor.xyz, specialized agents work continuously across research, enrichment, investigation, correlation, detection development, validation, health monitoring and response preparation.They operate on the client’s own security context and execute through the governed automation and orchestration foundations beneath them. Humans provide judgment, business context, authorization, accountability and governance wherever required.The result is not AI added to cyberdefense.It is an agent-human cyberdefense operating model built to work continuously across the environment.
No tier-1 queue to staff. Analysts are the escalation route, never the assembly line.
- Closed, with the reasoning recorded
- Being reviewed
- Waiting for a decision
How agents work through a detection.
Understand.
Read the detection against your assets, identities, privileges, vulnerabilities, history and surrounding activity—not as an isolated alert.
Correlate.
Connect related signals across technologies and time, separate meaningful activity from noise, and determine whether they form part of a wider security storyline.
Decide.
Assess significance, risk and available response options, then recommend, stage or escalate the appropriate action within your policy.
Act.
Execute approved actions across connected technologies—such as blocking indicators, isolating assets or revoking sessions—where policy and authority permit.
Evolve.
Feed validated outcomes back into detection logic, tuning, playbooks and coverage so the cyberdefense environment continuously improves.
This is what separates a cyberdefense operating system from an AI interface: it can move from understanding to governed action, with your policy defining where automation ends and human authority begins.
Agents perform defined work.
Each agent is designed for a specific function—research, investigation, correlation, detection, validation, monitoring or response—and operates within defined permissions, policies and human governance.
Threat research.
Identifies relevant emerging threats and maps them to your technologies, exposure and environment.
Investigation.
Collects and correlates evidence across connected technologies to develop and test incident hypotheses.
Detection engineering.
Develops, validates and refines detection logic from threat intelligence, telemetry and operational outcomes.
Detection health.
Reviews whether detections remain effective, relevant, properly tuned and supported by the required telemetry.
Response recommendations.
Determines appropriate response options and presents the supporting evidence, scope and potential impact.
Posture analysis.
Identifies recurring weaknesses, exposures and improvement opportunities across the security environment.
Specialists validate findings, authorize consequential actions and govern material outcomes.
Your response policy, in three tiers
Pre-authorized.
Actions you have approved in advance run automatically. Each one is logged and reversible.
For example: block an indicator, isolate an endpoint, revoke a session, suppress known-benign noise.
Approval-required.
Consequential actions are staged with the evidence and a recommendation, and wait for approval from you or a Coordinates specialist. Approval is one tap in cor.one, wherever you are.
For example: the actions your policy marks as consequential for your business.
Prohibited.
Actions you have ruled out are never executed by the platform, whatever an agent concludes.
For example: anything you decide must always stay a human action.
People keep the consequential decisions.
Agents carry the repeatable work so that people can concentrate on judgment. Coordinates specialists validate findings, govern material consequences and handle the complex cases. UAE-based specialists cover escalation 24×7, and you keep the right to approve what matters to your business.
Validated.
Specialists validate agent findings and govern material consequences.
Governed.
Escalation and consequential decisions belong to people, under the policy you agreed.
Recorded.
Every trigger, decision, action and approval is kept in the audit trail.
An unusual privileged login, end to end.
An illustrative workflow showing where agents act and where people decide.
Evidencecor.x A privileged account signs in somewhere unusual. Agents pull evidence from the connected tools: identity provider, endpoint, VPN and cloud audit logs.
Contextcor.x Agents read the account against the client security data model. It links the account to exposed assets, to its privileges and to its past activity, including an earlier incident with the same pattern.
Hypothesiscor.y An agent builds an incident hypothesis and a response recommendation, with the evidence attached and the reasoning recorded.
Containmentcor.y Pre-authorized actions run at once: the session is revoked and the indicator is blocked. Anything more consequential waits for your approval or a specialist's.
Storylinecor.z The incident closes as one narrative with a full audit record, and the detection logic is updated from what was learned.
Illustrative workflow. In practice, the steps follow your estate, your connected sources and your response policy.
An agent is only as good as what it can see and what it can do.
Without a way to act
An agent may identify the right action but still lack the workflows, permissions and integrations to carry it out safely across the environment. Without an execution layer, intelligence stops at recommendation.
Without context
An agent may reason well but still work from fragments. It must reconstruct asset ownership, identities, business relevance, prior incidents and surrounding activity each time. Without persistent context, intelligence starts over.
cor.xyz agents inherit both: the context to understand and the governed execution layer to act.
Read the Coordinates storyDefine where agents can act.
A briefing maps your response policy into cor.xyz: which actions are pre-authorized, which require approval, which may be delegated and which remain prohibited. We then show how those boundaries are enforced across the connected environment.