DomeSOC

DomeSOC is an autonomous security operations centre that investigates detections with a team of AI agents and then audits its own conclusions before any of them reach a human. The site leads with the line "The AI SOC that proves it isn't hallucinating", which tells you what the product is really arguing about. The claim isn't that AI can triage alerts, since plenty of vendors say that already. It's that an AI SOC is worth nothing unless every statement it makes traces back to actual evidence, so DomeSOC builds the verification step into the pipeline instead of trusting the model to behave.

The problem is familiar to anyone who has staffed a security team. Detections arrive faster than analysts can work them, so most alerts get a glance and a guess, and the real incident hides in the pile. The first wave of AI triage tools promised to absorb that volume, and some of them do, but a language model that confidently asserts an IP was beaconing when nothing in the logs says so is worse than no answer at all. A wrong answer delivered with confidence gets acted on. In security, acting on a fabricated conclusion means either containing a healthy production box or waving through a real intrusion.

The investigation itself runs as a small team working a detection in parallel rather than one model doing everything. A Threat Hunter maps observed behaviour to TTPs and a kill-chain stage. An Intel Analyst handles attribution and IOC reputation, but only where MISP, OTX, or VirusTotal actually confirm it. A Forensics specialist works out blast radius and what evidence needs preserving first. Then there's a Skeptic, a devil's advocate whose entire job is to argue the strongest benign or alternative explanation, which is a deliberate structural counterweight to models that agree with themselves. An Advisor weighs all of them, folds in what the system knows about your environment, and produces one recommendation.

Sitting after that is the grounding gate, and it's the piece the whole product rests on. Every claim any agent makes gets graded against the underlying evidence by an independent verifier, and comes back either grounded or unsupported. Unsupported claims are flagged and stripped before you ever read them. The gate is built to recognise honest rebuttals too, so an agent saying "no evidence of beaconing" isn't penalised for reporting an absence. Every flagged claim is recorded per component and stays queryable, which means the hallucination rate becomes a number you can look up rather than a promise in a sales deck.

Two other mechanisms compound with use. Per-tenant calibration learns what normal looks like in your environment specifically, tracking what your analysts dismissed as false positives and down-weighting the reputation of entities that keep turning out benign, with the false-positive profile measured only on reviewed alerts from your own tenant. Separately, every decision and its evidence chain is hash-chained and sealed to S3 Object-Lock in compliance mode, producing write-once evidence that an auditor can verify independently of DomeSOC. If you work anywhere that has to prove why a containment action happened six months after the fact, that's the feature that matters.

It connects through tooling you already own. The site lists 25 live connectors and is pointed about what live means, noting that it's "wired to a real path, not a logo on a grid". The set spans endpoint and detection with CrowdStrike, SentinelOne, and Microsoft Defender, identity with Okta and Entra ID, network with Palo Alto and Fortinet, cloud with AWS and GCP, SIEM with Splunk, Microsoft Sentinel, Elastic, and QRadar, email with Proofpoint and Mimecast, messaging and ticketing with Slack, Teams, Jira, ServiceNow, and PagerDuty, and threat intel with OTX, VirusTotal, AbuseIPDB, and MISP. The target buyer is a security team that already has the stack and is losing to the queue, not one starting from nothing.

Pricing is paid from the first tier and reflects three levels of autonomy. Supervised runs $1,000 a month for up to 500 detections, where the AI recommends and humans approve. Autonomous is $2,500 a month and contains threats above a confidence threshold you set, with per-action granularity over what it's allowed to touch. Full Autonomous is $15,000 a month for autonomous containment across every action under your policy, and the site describes that tier as still in validation with design partners. The team is recruiting design partners with 60-day trials for the first few, there's a signup at app.domesoc.com, the approach is patent pending on a filed US provisional, and the published contact is founder@domesoc.com.