PlatformCapabilities

Different capabilities.
One cyberdefense operating system.

cor.xyz brings multiple cyberdefense capabilities together on the same foundation. Each works from the same connected technologies, the same Client Security Data Model, the same governance and the same response controls.Context does not stop at the edge of a capability. What one discovers becomes available to the wider operating system.

One foundation beneath every capability.

  • Connected technologies

    Security technologies from the Coordinates integration catalog connect into the same operating environment.

  • Client Security Data Model

    Assets, identities, vulnerabilities, detections, incidents, history and response activity become persistent client-specific context.

  • Governed execution

    Recommendations and actions operate within defined permissions, policies and human authority.

  • Decision history

    Evidence, findings, approvals, actions and outcomes remain connected and auditable.

corIQAsk your cyberdefense.

corIQ gives authorized users conversational access to their own security environment.

Ask about an asset, identity, vulnerability, incident, detection or risk and corIQ works from the context already held across cor.xyz—not from a generic knowledge source.

It can bring together evidence from multiple connected technologies, explain how activity relates, surface relevant history and connect the answer to permitted workflows and actions.

Example questions

  • Why was this raised as an incident?
  • What happened before and after it?
  • Has this activity appeared elsewhere?
  • Which assets or users require attention?
  • What response is permitted?

Ask. Know. Act.

corIQ in the cor.xyz portal: a question about open incidents, answered from the client's own environment.

Analytics & InsightsSee what your environment is telling you.

cor.xyz continuously analyzes the cyberdefense environment to identify findings, weaknesses, anomalies, coverage gaps and improvement opportunities.

Analysis is grounded in the client's own context rather than viewed as isolated product findings.

Findings become part of the wider operating model, where they can inform investigation, prioritization, hardening, detection engineering and response.

Current insight areas

  • Security initiatives
  • Detections & canaries
  • Response actions
  • Assets
  • Log collection
  • Endpoints & EDR
  • Vulnerabilities
  • Entra applications
  • Entra users
  • Installed software
cor. Insights in the cor.xyz portal: open findings by area and severity, then by insight type. Below, how one finding moves from insight to action.

Threat AdvisoriesKnow which threats apply to you.

cor.xyz follows security advisories, vulnerability disclosures and threat reporting, and matches each one against the technologies, software and assets in your environment.

Every advisory explains why it matters to you: which assets are affected, whether exploitation has been reported, the exposure level and the recommended actions.

Advisories become part of the wider operating model, where they can inform prioritization, threat hunting, detection engineering and response.

Each advisory shows

  • Priority
  • Matched assets
  • Referenced vulnerabilities
  • Exposure level
  • Why it matters to your environment
  • Recommended actions
  • The source

Not every threat is your threat. cor.xyz shows which ones are.

A threat advisory in the cor.xyz portal, matched to the software installed in the client's environment. The client's name is blurred.

Asset & Identity DiscoveryDiscover what is already there.

cor.xyz uses telemetry already available across the connected environment to identify assets and identities that may be unknown, unmanaged, forgotten or incorrectly classified.

The capability can surface endpoints, servers, applications, cloud workloads, connected devices, users, administrators and service accounts without requiring an additional discovery agent on every asset.

Discoveries are presented for verification and classification so they can become part of the client's wider security context.

See more of the environment without introducing another isolated inventory.

Illustrative Discovery screen: invented known assets, newly discovered ones and the identities linked to them.

corEQMeasure maturity against evidence.

corEQ provides an evidence-backed view of cybersecurity maturity.

It combines the CIS Controls, NIST Cybersecurity Framework mapping, client questionnaire responses, telemetry evidence, security initiatives and remediation status to create a maturity assessment grounded in what can actually be observed.

Where questionnaire responses and objective evidence differ, the evidence informs the assessment and the discrepancy can be explained.

Each completed assessment provides a maturity snapshot that can be compared with previous assessments and translated into prioritized improvement actions.

corEQ · Assessment

Audit log managementCIS Controls · NIST CSF Detect, continuous monitoring

  1. DeclaredControl implementedQuestionnaire response
  2. ObservedRequired telemetry absentNo audit logs from in-scope finance servers
  3. AssessmentEvidence incompleteThe evidence informs the maturity position, and the gap is explained

Prioritized action: onboard the missing log sources View in Insights

Illustrative corEQ assessment: a declared control, the evidence observed for it and the resulting assessment.

Dashboard & ControlSee the environment.
Govern the operation.

The cor.xyz dashboard provides structured visibility and control across the client's cyberdefense environment.

It brings together assets and identities, analytics and findings, detection content, telemetry and integration health, incidents and storylines, security initiatives, recommendations, reporting, response permissions, approvals, actions and outcomes, and audit history.

The dashboard provides the structured operating view. corIQ provides the conversational view. Both work from the same client context.

Dashboard: structured interaction. corIQ: conversational interaction.

The cor.xyz dashboard, then one incident's signal timeline. People, IP addresses and performance figures are blurred.

Mobile AccessCyberdefense authority,
wherever you are.

cor.xyz extends key visibility and governance capabilities to mobile devices for authorized security leaders, through the cor.one app.

Review incidents, follow security storylines, inspect supporting evidence and respond to approval requests when an action requires human authorization.

Pre-authorized actions can proceed according to policy. Approval-required actions remain staged until the appropriate authority acts.

Every approval and action remains part of the same audit history.

Illustrative cor.one screen. The incident "Unusual privileged sign-in": revoking the session and blocking the indicator are pre-authorized and have run. Isolating the affected host is staged and waits for approval with Face ID.

Not seven separate products.

Capabilities share context instead of handing work between separate products.

  1. Discovery. Unknown server identified.

  2. Threat Advisories. A newly exploited vulnerability matched to it.

  3. Analytics & Insights. Exposure identified.

  4. Client Security Data Model. Asset linked to a privileged identity and a prior incident.

  5. corIQ. Security leader asks for context.

  6. Dashboard & Control. Response action staged.

  7. Mobile Access. Authorized action approved.

  8. Audit history. Outcome recorded.

The capabilities are different. The environment, context, governance and operating system underneath them are the same.

Need us to operate it with you?

cor.xyz is the cyberdefense operating system. Coordinates Managed Cyberdefense provides the 24×7 monitoring, investigation, threat hunting, DFIR, response, advisory and continuous improvement around it.

Explore Managed Cyberdefense

See the capabilities
in your environment.

A briefing starts with your existing technologies, security environment and operating requirements. We’ll show how the relevant cor.xyz capabilities would work across them.

Request a briefingBack to cor.xyz