Security as a running loop.
An annual test measures a system on one day of the year. XS1 Cyber operations are designed to run continuously, with a person holding the escalation authority.
Monitor
Persistent watch on the assets that matter.
Triage
Agents cut noise and assemble context for a person.
EscalateGate
Agreed thresholds route a finding to a named owner.
ContainGate
Pre-agreed actions; anything with wide impact waits for approval.
After-action
A durable record of what happened and what changed.
The loop runs continuously. At each gate a person must approve before a high-impact action goes ahead.
01 / How an engagement runs
Run alongside your team, with people holding the gates.
Who runs it
XS1 operators run the loop alongside the partner's team, within a scope agreed in writing before anything starts.
What you receive each cycle
Prioritized findings with context, the containment actions taken, and an after-action record a reviewer can follow.
Where a person decides
An XS1 operator approves any high-impact action, and the partner's named owner can pause or revoke at any time. Autonomous work never escalates its own privileges.
02 / Scope
How an operations engagement is scoped
Scope is written down before anything runs, and the system is built so it cannot drift outside it.
- 01Explicit asset and environment scope, encoded into the system
- 02A named owner on the partner's side who can pause or revoke at any time
- 03Escalation thresholds agreed before the first alert
- 04Full action logging retained for review
- 05Regular review of what the loop missed, not only what it caught
XS1 Cyber
Want a security loop that runs every day, not once a year?
Tell us the environment and what matters in it. We reply within 1–2 business days, and a proposed scope follows the first conversation.