SQUDO AI® by ITNB AG
Every alert, investigated to verdict.
SQUDO AI® autonomously reasons through your alerts the way a senior analyst would: pulling evidence, weighing hypotheses, and showing its work. Swiss by design. Sovereign by default.
The problem
More alerts arrive than any team can read. The real threats wait in the queue. A modern SOC sees thousands of alerts a day. Most are noise, a few are not, and telling them apart is slow, manual, and relentless. Analysts burn hours on triage. Genuine incidents sit unreviewed while the clock runs.
How it works: an investigation, run end to end
SQUDO AI® works the alert the way a senior analyst does, then hands a human the decision. No state-changing action runs without your authorisation, granted case by case, or under a standing mandate whose limits you set in advance. Off by default.
- Triage: Picks up every alert from your EDR and SIEM the moment it fires.
- Investigate: Runs multi-step queries across your cybersecurity stack and your context memory.
- Verdict: Reaches a classification with the evidence and reasoning behind it.
- Recommend: Drafts actionable recommendations to respond to the attack.
- Approve: A human weighs the recommendation and grants the authority to act: case by case, or as a standing mandate that can be withdrawn at any time without touching the investigation.
- Act: The approved measure is carried back into your connected tools, within the limits you set. Off by default.
Explainable by design: every verdict shows its work
SQUDO AI® does not hand you a black box. It gives you the full chain: every source queried, every hypothesis weighed with an explicit outcome, and every step it took to reach a conclusion. You can read it, challenge it, and trust it.
- Hypotheses tested with explicit outcomes
- Sources cited, with the exact signal that mattered
- Mapped to MITRE ATT&CK techniques
Swiss-sovereign: your data never leaves your control
SQUDO AI® runs where your data already lives. Deploy it inside your own environment, on-premise, or let us run it on Sovereign infrastructure. Your alerts, your investigations, and your context stay within your jurisdiction, governed by your policies.
- Sovereign-hosted: Runs on Sovereign Infrastructure inside your country. No data crosses a border you did not choose.
- Governed by design: Built against ISO 27001, with a full audit trail of every action the agent takes and human oversight of every state-changing step.
- Human in the loop: The agent investigates and recommends. The authority to act stays with you: granted case by case or as a standing mandate, and withdrawable at any time without touching the investigation.
Proof: time your analysts get back
- 64% less time to verdict per alert, against a conservative 25-minute manual baseline
- 254 analyst hours released, estimated over a 38-day production pilot
Connects to your stack
- Microsoft Defender for Endpoint
- Microsoft Sentinel
- IBM QRadar SIEM
- IBM QRadar EDR (ReaQta)
- SentinelOne
- Sophos XDR
- CrowdStrike
- Darktrace
- Palo Alto Networks
- Splunk
- Wazuh
- Google SecOps
- Microsoft Entra ID
- Active Directory
- Microsoft Defender for Identity
- Microsoft Defender for Office 365
- VirusTotal
- MITRE ATT&CK
Further platforms connect through the same connector model. Tell us what you run.
See SQUDO AI® in action
Book a live walkthrough and watch a real investigation run, start to verdict.
Contact sales →