The triage agent records the detections, enrichment sources, and asset context it consulted, together with the detection logic version in force.
Solutions · Cybersecurity
Replaces · Single-vendor SIEM · Siloed threat databases
Verifiable AI for cybersecurity.
Threat intelligence that compounds across agents.
Security teams run a growing fleet of detection and response agents, yet threat reasoning stays trapped in single-vendor SIEMs and siloed threat databases. nOS records detection rationale, escalation paths, and cross-team response decisions as shared, replayable traces, so intelligence compounds across agents instead of being re-derived. Every decision is independently verifiable, giving auditors and downstream teams a trustworthy record without vendor lock-in.
Decision traces enshrinedDetection rationale and escalation paths Cross-team remediation decisions Threat-actor intelligence with full lineage Vendor-independent incident timelines
What gets captured
Most relevant memory layers
Shared & Verifiable
Working memory captures private agent reasoning. Shared memory is where multi-party context coordinates. Verifiable memory is where decisions are enshrined.
Multi-vendor
No platform lock-in
Portable
Threat context travels with you
Deployment & partners
Security teams across regulated industries
Real enterprise data, processed in production, with decision traces enshrined as Knowledge Assets in the OriginTrail DKG.
Powering Umanitek’s Guardian internet safety agents.
The problem
The case for verifiable decisions in cybersecurity.
Security operations already run on machine speed. Agents triage alerts, enrich indicators, and increasingly take containment actions. What they do not produce is a defensible record of judgement: which signals were weighed, which were dismissed, and on whose authority a host was isolated at 03:00.
That gap becomes expensive under NIS2 and DORA, where incident reporting runs to fixed deadlines and supervisors ask how a classification was reached. It is also why threat intelligence rarely compounds: each vendor platform holds its own context, so the fiftieth investigation starts almost where the first one did.
How it works
How a decision becomes verifiable.
Threat context that peers or a sector CERT are entitled to see moves into shared memory, so intelligence accumulates across teams instead of per vendor.
Containment and escalation decisions record the reasoning: severity rationale, the exception that permitted an out-of-hours action, and the precedent from similar incidents.
The trace is enshrined in the DKG, giving auditors and regulators an independently verifiable account of how the incident was handled.
What changes
What this changes in practice.
The operational change is that judgement becomes an asset rather than a byproduct. Today an analyst decision lives in a ticket comment and evaporates when the ticket closes. Captured as a trace, it becomes precedent the next investigation inherits, which is what makes a security program improve rather than merely repeat.
For leadership the change is evidentiary. When a supervisor or board asks why an incident was classified as it was, the answer is retrieved rather than reconstructed, and it holds up because it was recorded at the moment of the decision by the system that made it.
FAQ
Questions about cybersecurity.
Does nOS replace our SIEM or EDR?
No. nOS sits above detection tooling. Your SIEM and EDR keep producing signal; nOS records the decisions agents and analysts make on that signal, so the reasoning survives even if you change vendors.
How does this help with NIS2 or DORA reporting?
Both regimes ask how an incident was classified and what was done in response, on a deadline. Because the rationale is captured at execution time rather than reconstructed afterwards, the reporting narrative is assembled from traces rather than from memory and chat logs.
Can we share threat intelligence without exposing our environment?
Yes. You control what is published. Indicators and judgements can be shared while asset names, internal topology, and private context remain in your own working memory.
What stops an agent from acting outside policy?
Policy is applied at decision time and recorded with the action, so an out-of-policy action is visible as such rather than indistinguishable from a routine one. The trace shows which rule permitted the step and which precedent it relied on.
Does this slow down response?
No. The rationale is captured as part of the action rather than as a separate documentation step, which is precisely why it survives; documentation written afterwards is the part that gets skipped under pressure.
How does this help a new analyst?
They inherit precedent. Previous decisions on similar alerts are queryable with their reasoning intact, so the judgement of experienced responders becomes available rather than tacit.
Start free
Power up your business with the OriginTrail DKG.
Create Knowledge Assets, build shared context graphs, enshrine decision traces. Open-source infrastructure. Community support. Zero cost.
Go Pro
The full Network Operating System.
Custom agent frameworks (Hermes, OpenClaw, LangChain, Claude). Custom data pipelines. Custom integrations with your enterprise systems. Dedicated infrastructure and support.