Nothing
moves unseen.
Endpoints, identities, inboxes, firewalls, IoT and cloud, watched as one. Armada, Convoy's AI, works the leads. Our operators back it up. Your own AI tools can run it too.
Your SIEM, EDR, SOAR and MDR, replaced by one platform. Convoy Agent and every connector come standard, so it runs beside your current stack from day one.
Try it live
Open the lead. Isolate the host. Disable the account.
A pasted command on rdweb01, with an outbound session behind it. Armada has already investigated. You make the call, and every move is logged as it happens. The rest of the platform is yours free for 14 days.
Your call · 2 open
Isolate rdweb01: pasted command, outbound session confirmed to 203.0.113.64
rdweb01 · bob.adm · above the auto-execute threshold, so it waits on youAdmin sign-in from 198.51.100.170: travel or token?
MFA satisfied, device consistent with the last 30 days. Triage leans benign.61 closed today · median 2m to verdict · 2 waiting on Larkspur
{{ a1d }}
›Only a person can close these. Queue below.
›{{ a3d }}
›Imaging archive and badge system, 24h.
›Pharmacy and servers. Clinics send logs.
›Not dispositioned yet. Armada is on it.
›Mail purges run alone. The rest waits.
›No critical blind spot in coverage.
›Techniques with at least one detection.
›6.1M firewall events an hour, none escalated.
›Purged before anyone opened it.
›DR copies finished at 02:41.
›Anything an agent needs a person for lands here.
Triaged 69 leads since 18:45 UTC yesterday and closed 61 of them without a Larkspur decision: 38 false positives, 23 confirmed non-concerns. Most of the noise is whoami bursts from the EHR client's login script on clinic workstations, a detection-tuning candidate, not an intrusion.
1 / 3 · Next →Escalated by a human: 2 hosts and 3 users. Two independent sources agree on rdweb01 and bob.adm.
Score 0 to 100 · escalated by a human 50 (+5 each more) · +15 per extra source · strongest signal: critical 25, high 20, medium 10 · +3 per open lead · 70+ act · 40 to 69 look today
Every reading is the measured value at pull. The clock and the counter run on real time.
Shell Launched From the Run Dialog With Download Content
High likelihood of being malicious due to powershell downloading and executing an external agent. Tier 3 determination: escalate, confidence 95/100. Isolate rdweb01 now, reset credentials for LARKSPUR\bob.adm, block egress to 203.0.113.64.
What makes it Convoy
It knows your company. It finds every way in. It governs your AI.
Detecting and responding is the job. These three are how Convoy goes further.
1,900 people, 11 clinics across NY and NJ. 240,000 patient records in your EHR.
The EHR and the imaging archive are patient-safety systems: containment waits for a human.
It knows your environment. And shows its work.
What the platform knows about your company, written down where you can read it, correct it, and turn any line into a rule triage must follow. Nothing is used until your team confirms it.
Confirm a factEvery way in. The fewest fixes.
The platform keeps a live map of every path from an entry point to a crown jewel, ranks each by likelihood, and shows the fewest fixes that close all of them, marking the ones it can apply itself.
Simulate the planEvery AI agent in your company. Who uses it, what it touches, who answers for it.
The question boards are starting to ask, answered from your own data: who uses AI, which agents act for them, and who answers for each one.
Make a decisionIf your own AI tools can't operate it, it's legacy.
Every tenant is open over MCP and REST, with the console's permissions and the console's audit trail. See the tools
Detection without response is a report.
Isolate the host, disable the account, pull the message from every inbox. Ready on day one, from one screen. See the actions
Pay per identity. Never per gigabyte.
One price per identity you protect. There is no ingest meter, and the agent and the operators are in the price. See the model