Questions, answered plainly.

LuceraAI is AI that investigates your security alerts. Specialist AI agents investigate every alert your security tools raise, show the evidence and confidence behind each verdict, and act only within limits you set. Anything uncertain or high-risk goes to a person. LuceraAI is a UK company, and customer data is hosted in AWS London. Read more

Gartner uses "AI SOC agents" for AI that carries out security operations work, such as alert triage, enrichment and investigation, alongside human analysts. LuceraAI is built on AI SOC agents: they do the investigation work and hand judgement calls to your team.

No. LuceraAI investigates on its own, but response is supervised by people. You choose the operating mode for each site, and any action must pass confidence thresholds you set, with a stricter bar for disruptive actions such as isolating an endpoint. Read more

No. It does the evidence gathering and routine triage, so your analysts spend their time on decisions that need judgement. Every verdict can be reviewed and overridden, and overrides improve future decisions.

Yes. LuceraAI is a UK-registered company with a UK team. Customer data is hosted in AWS London, and we work under UK law and UK GDPR. Read more

It picks up the alert from your security tools, gathers and enriches the evidence, and sends it to specialist agents for identity, email, endpoint, cloud apps and data loss. A verdict agent weighs their findings, a second independent AI model checks the result, and your policy decides what happens next. Read more

When confidence is below your threshold, when its two AI models disagree, when the second check is missing, or when the evidence is incomplete. It also hands over any action you have not switched on.Read more

Only in Orchestrate mode, and only for the actions you enable: killing a process, quarantining a file, blocking a hash or isolating an endpoint. Each action must pass a confidence threshold, and every action is logged. In Observe and Insights modes it takes no action.Read more

It is designed to fail towards a person. Analysts can override any verdict, an override pauses any pattern that produced the verdict, and every decision and action is recorded so you can see what happened and why.

LuceraAI investigates alerts from SentinelOne and Microsoft Defender XDR, and raises tickets and notifications in Freshservice, Freshdesk and Microsoft Teams. It adds investigation on top of the tools you already own.

No. Your EDR stays the source of detection and your source alerts are never overwritten. LuceraAI investigates what your tools raise; it cannot see a threat your EDR never detected.

Alerts are picked up within seconds of your EDR raising them. A full investigation takes minutes, and longer when LuceraAI waits for complete evidence rather than guess. We publish measured times with our method.

Observatory brings your endpoints from your security and device-management tools into one inventory. You see every endpoint against every source, and find devices one tool knows about and another has missed, such as laptops in Intune with no EDR agent.Read more

In Observatory, choose two sources, for example Microsoft Intune and SentinelOne, and ask which endpoints appear in one but not the other. You get the list of uncovered devices and can export it.

Only on exact identifiers. Hostname, IP address or user alone never merge two devices. Anything ambiguous goes to your team to decide, with a recorded reason, and every decision can be reversed.

SentinelOne, Microsoft Defender, Microsoft Intune, CrowdStrike Falcon and Cloudflare WARP today.

Customer data is hosted in AWS London and encrypted at rest and in transit. Our security pack explains how data is handled during AI analysis and who can access it.Read more

LuceraAI uses several independent AI models, each chosen for its task, and a second model challenges each investigation. We review and update the models to keep quality high, so the product is not tied to any one provider. Details are available for security reviews on request.

No. Your data is used to investigate your alerts and is not used to train AI models.

No. Your alerts, evidence and approved patterns stay within your organisation.

Connect SentinelOne or Microsoft Defender XDR with read-only access and LuceraAI runs in Observe mode for two weeks. Nothing acts on your estate. You compare its verdicts with your analysts' decisions and receive an evidence pack with our method notes.Read more

Pricing depends on the size of your estate and the operating mode you choose. Talk to us for a quote.Read more