What is CloudPeek?

CloudPeek is an agentic AI platform for security operations. It sits on top of the security tools you already use, your SIEM, cloud security services, endpoint tools and threat-intelligence feeds, and adds a reasoning layer that can read across all of them, triage incoming alerts automatically, and help your analysts investigate at machine speed.

Think of it as an extra member of your security team: one that never sleeps, reads every alert the moment it arrives, gathers the supporting evidence from every connected tool, and hands your analysts a written summary with the facts already laid out, while always keeping a human in control of any decision that matters.

CloudPeek is built to run anywhere your environment demands: as managed cloud software, inside your own data centre, or fully air-gapped with no internet connection at all.

Who is CloudPeek for?

CloudPeek is designed for security teams in organisations where the stakes are high and the environment is complex:

• Security analysts who spend hours correlating alerts across multiple tools and want a faster, more structured way to investigate, with AI doing the data-gathering.
• Incident responders and commanders who need to track an incident through its whole lifecycle, from first alert to resolution.
• SecOps engineers who want to capture the team's know-how as reusable runbooks and let AI follow them predictably.
• Security managers who need visibility into team activity, audit trails for compliance, and metrics on how quickly alerts are being handled.
• Defence and critical-national-infrastructure (CNI) operators who need autonomous capability in air-gapped or classified networks where cloud tools simply cannot run.

The problems CloudPeek solves

Too many alerts, too many tools

Security teams routinely run ten or more tools and receive far more alerts than they can investigate. CloudPeek connects to all of those tools and uses AI to reason across the whole picture, automatically gathering context and surfacing the small number of alerts that actually matter, so analysts focus on decisions instead of data retrieval.

Inconsistent investigations

Without structure, two analysts handle the same alert in two different ways, steps get missed, and knowledge stays trapped in people's heads. CloudPeek lets teams encode their best practice as runbooks, captures what's learned in a shared Wiki, and runs AI agents within guardrails you define.

Cloud dependency

Almost every AI security product assumes a constant internet connection. That rules them out for defence, CNI and classified networks. CloudPeek is purpose-built to run disconnected, full capability with zero external connectivity required.

Proving what happened

Compliance and governance teams need to know what was done during an incident and why. CloudPeek records every action, query and decision with a timestamp and the user (or agent) responsible, a complete, exportable audit trail.

How CloudPeek fits into your workflow

CloudPeek does not replace your SIEM, endpoint tools or ticketing system. It connects to them and acts as a unified reasoning layer on top:

1. Alerts arrive from your existing detection systems, or are pulled in automatically from connected tools (see Tools & Integrations).
2. CloudPeek triages them automatically: an AI pipeline reads each alert, gathers related evidence, scores it, and writes a summary before a human ever looks (see Automatic Triage).
3. Analysts investigate using a chat-based workspace where the AI does the legwork and the analyst directs and decides (see Investigations).
4. Humans stay in control. Anything that could change a system passes through an approval gate you configure (see Human-in-the-Loop).
5. Knowledge is captured in the Wiki and reused on the next, similar alert (see The Wiki).

What makes CloudPeek different

Where to go next

• Quickstart: get hands-on in 15 minutes.
• Key Concepts: the vocabulary: incidents, investigations, runbooks, artifacts, the Wiki and HITL.
• Platform Architecture: how the pieces fit together.
• Deployment Options: cloud, on-prem, air-gapped or hybrid.
• Prerequisites: stand up your own instance on a host.