# Convoy: full site text for AI agents Convoy Security, Inc. A security platform built on one source of truth that replaces the SIEM, EDR, SOAR and MDR. Slogan: Nothing moves unseen. Free 14-day trial at /start; a 30-minute briefing at /contact. Numbers: 90K+ assets protected, 2K+ detection rules mapped to MITRE ATT&CK, 100+ MCP tools, 1.2K+ investigation guides. Tenant-scoped MCP server with 100+ tools for any MCP client, connected with OAuth or an API key and built for the customer's own AI tools, plus an API and webhooks under the same permissions as the console. Sources: 150+ vendors (168 listed on /platform) across identity, email, endpoints, firewalls and network, cloud and SaaS, operating systems, data and storage, IoT and IT tools; every cloud connects API to API. Trust: SOC 2 report, ISO/IEC 27001 certification, HIPAA compliant; Convoy does not store PHI or cardholder data; 99.95% uptime in every agreement. Short summary: /llms.txt. Website tools: WebMCP via navigator.modelContext (see /.well-known/mcp.json). --- # Page: Home (https://convoy.security/) New: Airspace, ADR for AI agents 14-day free trial # Nothing moves unseen. Endpoints, identities, inboxes, firewalls, IoT and cloud, watched as one. Armada, Convoy's AI, works the leads. Our operators back it up. Your own AI tools can run it too. Start free · 14 days Try the Cockpit Your SIEM, EDR, SOAR and MDR, replaced by one platform. Convoy Agent and every connector come standard, so it runs beside your current stack from day one. + Assets protected Rules armed MCP tools Guides written Trusted by Armada, Convoy's AI ## Every lead gets worked. Only the hard calls reach you. Armada picks up each lead as it lands and investigates it with your data and what Terrain knows about your company. Then it writes down what it found and why. 01 ### It investigates Pulls the sign-ins, processes, mail and network traffic around the lead, and checks them against Terrain: who the account belongs to, what's normal for it, which systems are off limits. 02 ### It decides, in writing Every lead ends with a verdict, a confidence score and the reason. You can see why something was closed, not just that it was. 03 ### It clears the noise Benign leads close with that written reason, so your queue only holds what's left. Noise that keeps coming back gets flagged for tuning. 04 ### It escalates What it can't close goes up a tier, then to a person: a Convoy operator or your own team, depending on how you run Convoy. Containment above your auto-execute threshold waits for someone to approve it. Try it live ## Open the lead. Isolate the host. Disable the account. A pasted command on rdweb01, with an outbound session behind it. Armada has already investigated. You make the call, and every move is logged as it happens. The rest of the platform is yours free for 14 days. Cockpit Larkspur Group Needs you 1 act now · 1 decide today Handled for you 61 of 69 closed for you What Convoy sees 39 landing · 2 silent · 6 not ingested Your call · 2 open Escalated by Armada · conf 95% Isolate rdweb01: pasted command, outbound session confirmed to 203.0.113.64 rdweb01 · bob.adm · above the auto-execute threshold, so it waits on youOpen lead Approve Defer Escalated by triage · conf 61% Admin sign-in from 198.51.100.170: travel or token? MFA satisfied, device consistent with the last 30 days. Triage leans benign.Confirm Disagree 61 closed today · median 2m to verdict · 2 waiting on Larkspur Convoy LG Larkspur Group - Search ⌘K Cockpit NV N. Vega Operator CockpitOperational console Search across assets, identities, rules… ⌘K Convoy platform nominal UTC Local Tick T+0000 LG Active tenant Larkspur Group act now · decide today Risk 27 /100 · Guarded SectorHealthcare RegionNA Assets2,746 Switch tenant⌘O 1 Needs you act now · decide today · waiting 2 Handled for you 61 of 69 closed for you · ▲ +2 escalated vs last Tue 3 What Convoy sees 39 landing · 2 silent · 6 not ingested Annunciators Act now Decide today Worth knowing Clear › Your call waiting Only a person can close these. Queue below. › › Sources 2 silent of 41 Imaging archive and badge system, 24h. › Agent coverage 412 hosts Pharmacy and servers. Clinics send logs. › Untriaged 1 · lab-ws07 Not dispositioned yet. Armada is on it. › Auto response Armed Mail purges run alone. The rest waits. › Critical gaps 0 No critical blind spot in coverage. › ATT&CK coverage 71% Techniques with at least one detection. › Perimeter 0 leads 6.1M firewall events an hour, none escalated. › Mail 1 phish purged Purged before anyone opened it. › Backups On schedule DR copies finished at 02:41. › Go to the queue ✕ Your call · the only levers on this page open All Confirm Approve Your call Only you Only you Escalated by Senior Armada · 8m ago · conf 95% Isolate rdweb01: pasted command, outbound session confirmed to 203.0.113.64 explorer.exe launched powershell.exe for LARKSPUR\bob.adm with a download command pasted into the Run dialog. Outbound TCP from agent.exe to 203.0.113.64:443 at 17:43:56. Same account appears in two prior cases. Containment is above the auto-execute threshold, so it waits on you. T1204.002 rdweb01 bob.adm Isolate Lead 0023 Open lead Approve Defer Approve Escalated by Response Agent · just now · conf 95% Disable LARKSPUR\bob.adm and revoke sessions rdweb01 is isolated and the case is open. The account that pasted the command is still enabled. Recommended: disable in Entra, revoke every session, reset on the next interactive logon. Disable in Entra bob.adm Reverses in one click Case 0412 · Lead 0023 Approve Defer Confirm Escalated by Triage Agent · 41m ago · conf 61% Admin sign-in from 198.51.100.170: travel or token? Unusual login from a new network, MFA satisfied, device fingerprint consistent with the user's last 30 days. Triage leans benign. Your answer closes it or opens a case. T1078.004 admin 1 sign-in Lead 0030 Confirm Disagree That's everything waiting on you Anything an agent needs a person for lands here. Updated local · 61 closed today · median 2m to verdict · waiting on Larkspur Open full queue → Flight recorder · last 24h · bars = the same 24h on each of the last 8 days · every number is a count What Armada did · last 24h Triaged 69 leads since 18:45 UTC yesterday and closed 61 of them without a Larkspur decision: 38 false positives, 23 confirmed non-concerns. Most of the noise is whoami bursts from the EHR client's login script on clinic workstations, a detection-tuning candidate, not an intrusion. 1 / 3 · Next → Triaged 69 leads · 24h ▲ +4 last Tue 65 Auto-closed 61 of 69 leads · 88% ▼ 2 pts last Tue 90% Escalated 8 for Larkspur to confirm ▲ +2 last Tue 6 Acted ▲ last Tue 1 Median 2m lead → verdict Same · last Tue 2m When today happened · 2-hour buckets Leads Needed a human 5 3 2 4 6 9 7 4 5 8 6 10 18:45Z yesterday 06:45Z Now Show the log · what each agent decided ↓ Where the risk sits · hosts, users, IPs 7 days · Entra and Cognito risk 24h · ranked by risk score Escalated by a human: 2 hosts and 3 users. Two independent sources agree on rdweb01 and bob.adm. Convoy leads · 7d 212 leads · 64 hosts · 31 users Convoy Agent · 7d 41 detections · 6 hosts · 2 at high severity Entra ID Protection · 24h 2 sign-ins rated medium · 1 user Hosts 64 flagged · top 5 rdweb01 91 › Escalated +55 · Convoy Agent high +20 · 2 open +6 Run-dialog paste · last 11-04 18:29 ehr-etl-04 58 › Escalated +50 · 1 open +3 · 3 events +1 New Kerberos source for svc-ehr-etl · last 11-04 02:15 lab-ws07 44 › 2 sources +15 · Convoy Agent medium +10 Untriaged: unsigned binary in a temp path · last 11-04 17:58 pacs-02 39 › Escalated +30 · 2 events +1 Vendor remote session outside hours · last 11-02 02:11 fin-ws12 31 › 1 source · 4 events +1 Obfuscated script, closed benign · last 11-03 10:40 Users 31 flagged · top 5 bob.adm 88 › Escalated +55 · 2 open +6 · 3 events +1 Command pasted on rdweb01 · last 11-04 18:29 admin 61 › Escalated +50 · 1 open +3 · 1 event +1 Sign-in from a new network · last 11-04 17:42 svc-ehr-etl 46 › Escalated +40 · 1 open +3 Authenticates from a fourth host · last 11-04 02:15 imaging-vendor01 33 › 2 events +1 · shared by 6 engineers Session outside 08:00 to 18:00 ET · last 11-02 02:11 j.moss 22 › 1 event · closed non-concern Billing sign-in from Pune, expected · last 11-04 03:04 IPs · named in leads 9 flagged · top 3 203.0.113.64 90 › Escalated +55 · 1 host +10 · outbound session open Outbound session from agent.exe on rdweb01 198.51.100.170 61 › Escalated +50 · 1 user admin sign-in, MFA satisfied 198.51.100.33 38 › 2 users +10 · blocked at the edge Failed sign-ins on the VPN portal Score 0 to 100 · escalated by a human 50 (+5 each more) · +15 per extra source · strongest signal: critical 25, high 20, medium 10 · +3 per open lead · 70+ act · 40 to 69 look today Instruments · ingest · lead rate · what runs on its own Pulled UTC ≈ events since, at measured rate 3.1k Evt/s · all sources Ingest 39 feeds landing +4.2 Leads/h vs 24h avg Lead rate Now 7.0/h · avg 2.8/h Triage Auto 61 of 69 closed Response Gated Above threshold waits Automations 4 armed Autopilot Hunt 1 on September IPs Every reading is the measured value at pull. The clock and the counter run on real time. Feeds 41 connected · 39 landing · 2 silent · 6 in use with no feed Landing · 39 Rate · log bar · lag = median time until searchable, last 1h FortiGate 1.9k evt/s · lag 2m 08s Win security 1.1k evt/s · 412 hosts · lag 2m 31s Convoy Agent 640 evt/s · 412 hosts · lag 41s Sysmon 388 evt/s · lag 1m 52s PowerShell 41.2 evt/s · lag 2m 40s IIS 18.4 evt/s · lag 3m 02s Task scheduler 12.7 evt/s · lag 2m 47s Entra ID 6.4 evt/s · lag 6m 40s Proofpoint 4.9 evt/s · lag 7m 12s AWS Cognito 2.7 evt/s · lag 5m 58s + 29 more, all landing · show all ↓ Connected · nothing arriving · 2 Onboarded in Convoy, 0 events in the window shown Imaging archive 0 PACS logons are blind. Check the syslog forwarder on the archive server. 0 events · last 24h Badge system 0 Door events stopped at 18:02 yesterday. Confirm the integration still has a key. 0 events · last 24h In use · not ingested yet · 6 Seen in sign-ins, 30 days EHR audit log Who opened which chart, from whereEHR · 1,900 people Not connected HR system Hires, leavers and role changes as they happenHRIS · 2,318 accounts Not connected Clinical SSO Badge-tap sign-ins at shared clinical workstationsSSO · 1,240 workstations Not connected Backup platform Backup jobs, restores, who pulled whatBackup · 14 service accounts Not connected + 2 more tools in use with no feed · show all ↓ Convoy platform · lark · pulled UTC · lag 2 to 10 min (p50) Lead 0023 ✕ Shell Launched From the Run Dialog With Download Content Possible pasted command on rdweb01: explorer.exe started powershell.exe for bob.adm, which downloaded an unsigned program from 203.0.113.64 and ran it. High Escalated · Senior Armada (Convoy) ✦ Ask Armada Triage Evidence Context Activity ✦ Armada suggests High likelihood of being malicious due to powershell downloading and executing an external agent. Tier 3 determination: escalate, confidence 95/100. Isolate rdweb01 now, reset credentials for LARKSPUR\bob.adm, block egress to 203.0.113.64. Details Firing rule Shell Launched From the Run Dialog With Download Content Repeats 10 suppressed · last 13d 19h ago Signals 1 Detected 2026-10-15 18:29:04 UTC Host · user rdweb01 · LARKSPUR\bob.adm IP · tool 203.0.113.64 · outbound session Autopilot · Isolate endpoint · rdweb01 Queued Sent to Convoy Agent on rdweb01 Acknowledged · host holding One step reverses it. Close Investigate Run · isolate Talking to the agent on the host. Logged Sitrep From data 1h old Armada End of stream · entries Composed from the same data as the page · UTC Run it again Now do it on your own tenant What makes it Convoy ## It knows your company. It finds every way in. It governs your AI. Detecting and responding is the job. These three are how Convoy goes further. Terrain · Overview Who you are 1,900 people, 11 clinics across NY and NJ. 240,000 patient records in your EHR. What matters most The EHR and the imaging archive are patient-safety systems: containment waits for a human. Platform learned svc-ehr-etl now authenticates from a fourth host. Confirm Platform learned Offshore billing shift ends 10:00 ET, an hour later. Confirm Operator suggested Imaging-vendor sessions outside 08:00 to 18:00 ET are suspicious. Confirm Terrain ### It knows your environment. And shows its work. What the platform knows about your company, written down where you can read it, correct it, and turn any line into a rule triage must follow. Nothing is used until your team confirms it. Confirm a fact Posture · Exposure proof Open breach paths 7→0 Crown jewels in reach 3→0 Enforce phishing-resistant MFA on the legacy admin portal closes 3 Strip domain admin from SVC-11 closes 3 Restrict WinRM to jump hosts closes 2 Segment VLAN 40 from the finance subnet closes 2 Posture ### Every way in. The fewest fixes. The platform keeps a live map of every path from an entry point to a crown jewel, ranks each by likelihood, and shows the fewest fixes that close all of them, marking the ones it can apply itself. Simulate the plan Airspace · Brief · measurement 1 24/100 Exposed Becomes 71 after four decisions Accountable 27 Decided 9 Visible 82 Contained 0 Guarded 0 Decision An AI assistant is reading the CIO's mail and 50 meeting transcripts. Limit it Decision Two servers are calling an AI API and nobody owns them. Block Decision An agent answers email as a developer, every 10 minutes. Identity Airspace · powered by Convoy Agent ### Every AI agent in your company. Who uses it, what it touches, who answers for it. The question boards are starting to ask, answered from your own data: who uses AI, which agents act for them, and who answers for each one. Make a decision 01 ### If your own AI tools can't operate it, it's legacy. Every tenant is open over MCP and REST, with the console's permissions and the console's audit trail. See the tools 02 ### Detection without response is a report. Isolate the host, disable the account, pull the message from every inbox. Ready on day one, from one screen. See the actions 03 ### Pay per identity. Never per gigabyte. One price per identity you protect. There is no ingest meter, and the agent and the operators are in the price. See the model ## 14 days. Your stack versus ours. Connect your sources, push Convoy Agent, and run us next to what you have for two weeks. Keep whichever one catches more. We like our odds. Start free · 14 days Book a briefing --- # Page: Terrain (https://convoy.security/terrain) Terrain Intelligence Rebuilt every night # It knows your environment. And shows its work. Terrain is what the platform knows about your company, written down where you can read it, correct it, and turn any line of it into a rule triage must follow. Every lead gets read against it. Nothing is used until someone on your team confirms it. Start free · 14 days Confirm a fact Terrain brief · rebuilt 06:00 UTC Who you are You're a 1,900-person specialty care group across 11 clinics in NY and NJ. 240,000 patient records live in your EHR. What matters most The EHR and the imaging archive are patient-safety systems: containment there waits for a human. What's normal Night-shift clinical logins, offshore billing until 10:00 ET, nightly backups to the DR site at 02:00. What's unknown The acquired practice in Paramus is mid-integration. 10.88.0.0/16 has no owner on file. Try it live ## Three facts are waiting on you. The platform learned three things about your environment this week. Confirm one and it becomes a fact triage uses on the next lead. Terrain Larkspur Group 2,184 Facts known 78% Confirmed 3 Awaiting you 12 Stale over 90 days Awaiting your confirmation · 3 Armada learned svc-ehr-etl now authenticates from EHR-ETL-04 in addition to its 3 known hosts. 3,120 consistent Kerberos events since Oct 22 · DC security logsConfirm Edit Reject Armada learned Offshore billing shift now runs until 10:00 ET, an hour later than before. Sign-in tail moved 58 minutes across 140 accounts over 3 weeks · Entra sign-insConfirm Edit Reject Operator suggested Treat imaging-vendor remote sessions outside 08:00 to 18:00 ET as suspicious. Proposed after case 4471 · one shared credential, six engineersConfirm Edit Reject Nothing is used in triage until someone on your team confirms it. Convoy LG Larkspur Group - Search ⌘K Terrain NV N. Vega Operator Observe · Terrain Search across assets, identities, rules… ⌘K Convoy platform nominal UTC Local Tick T+0000 LG Active tenant Larkspur Group 1 act now · 1 decide today Risk 27 /100 · Guarded SectorHealthcare RegionNA Assets2,746 Switch tenant⌘O terrain · lark Learning 41 sources Rebuilt 06:00 UTC Export JSON + Suggest a fact ### Larkspur Group What Armada knows about your environment and reads on every lead it triages. Use ··· on any fact for its source, or to add it to directives. Overview Organization3 Environment4 Behavior3 Change2 Checklists5 Logbook13 Directives2 Audit Facts known Across 12 areas · View all → Confirmed % By your team · Review → Awaiting you Armada-proposed changes Stale > 90d 12 Need re-verification Open questions 4 Where Armada is guessing Terrain brief · Armada · rebuilt 06:00 UTC 41 sources Who you are A 1,900-person specialty care group across 11 clinics in NY and NJ. 240,000 patient records live in the EHR. What matters most The EHR and the imaging archive are patient-safety systems: containment there waits for a human. What's normal Night-shift clinical logins, offshore billing until 10:00 ET, nightly backups to the DR site at 02:00. What's unknown The acquired practice in Paramus is mid-integration. 10.88.0.0/16 has no owner on file. Awaiting your confirmation · Nothing is used in triage until someone on your team confirms it Armada learned svc-ehr-etl now authenticates from EHR-ETL-04 in addition to its 3 known hosts. 3,120 consistent Kerberos events since Oct 22 · DC security logs Confirm Edit Reject Armada learned svc-ehr-etl now authenticates from EHR-ETL-04 in addition to its 3 known hosts. Armada learned Offshore billing shift now runs until 10:00 ET, an hour later than before. Sign-in tail moved 58 minutes across 140 accounts over 3 weeks · Entra sign-ins Confirm Edit Reject Armada learned Offshore billing shift now runs until 10:00 ET, an hour later than before. Operator suggested Treat imaging-vendor remote sessions outside 08:00 to 18:00 ET as suspicious. Proposed after case 4471 · one shared credential, six engineers Confirm Edit Reject Operator suggested Treat imaging-vendor remote sessions outside 08:00 to 18:00 ET as suspicious. Queue clear Confirmed facts are used on the next lead. Rejected ones are forgotten and logged. Auto-confirmed by Armada · 14 High confidence and observed directly in your telemetry On Off Business context Active accounts: 2,318 Entra ID users · 7d Review Business context Clinical workstations: 1,640 Windows security Review Business context Primary region: New York, US Entra and Cognito sign-ins · 7d Review Crown jewels EHR production cluster Response-action catalog Review Locations 11 clinics and a DR site Entra sign-ins + host names Review People & org Revenue Cycle: 140 accounts Entra departments Review See all 14 → Coverage by area How well Armada knows each area · ? shows how to raise it Organization 83 Business context 92 People & org 81 Exposure groups 76 Environment 80 Crown jewels 88 Technology 90 Vendors & partners 58 Behavior Normal behavior Known benign 79 Triage notes 64 Change 47 Change calendar 47 Open questions n/a Learning now Pause Live · updates today Run it again Now do it on your own tenant Why it matters ## Same signal. Opposite call. One line of Terrain apart. Most false positives are missing context, not bad rules. Two leads from the same night, both after-hours sign-ins from outside the office, and the only difference between them is what the platform had been told. Lead 0142 03:04 ET · Entra sign-ins ### Sign-in from Pune, IN for 38 billing accounts, outside business hours Terrain read 140 billing accounts sign in from Pune until 10:00 ET. Confirmed by J. Moss, Revenue Cycle, Oct 22. Closed · non-concern Reason on the record. Nobody paged. Lead 0143 02:11 ET · remote access ### Imaging-vendor remote session on PACS-02 from a new account Terrain read Treat imaging-vendor sessions outside 08:00 to 18:00 ET as suspicious. Directive, written by an operator after case 4471, confirmed by R. Okafor. Escalated · confirmation needed Containment waits for Biomed. Case open. Your board can read it ### Four short columns, in plain language. The Terrain brief is four short columns and the plain answer to "what does our security vendor actually know about us." There is no score to decode and no acronym to look up, so it reads the same to a CFO as it does to the operator who wrote the directive above. Who you are You're a 1,900-person specialty care group across 11 clinics in NY and NJ. 240,000 patient records live in your EHR. What's unknown The acquired practice in Paramus is mid-integration. 10.88.0.0/16 has no owner on file. What it holds ## Twelve sections. Every line with a source, a confidence and a date. Terrain is rebuilt from your sources every night and refreshed through the day. Business context, people and exposure groups, crown jewels, technology, locations, vendors, normal behavior, known benign patterns, triage notes, the change calendar, open questions and a confirmation queue. Each fact carries where it came from, how sure the platform is, when the evidence was last seen and who confirmed it. Crown jewels ### A rule before every action. The systems where a wrong containment call does the most damage each carry a rule triage follows before it acts. Medication cabinets: never isolate, contain at the switch port with Biomed present. The EHR: call Clinical Apps on-call first, downtime procedures take 20 minutes to activate. BEFORE YOU ACT Never isolate. Patient safety. Contain at switch port only, with Biomed present. Pharmacy · tier 0 · 412 hosts Directives ### Any fact can become a rule. Add a fact to directives and triage must follow it on every new lead. You see the suggested wording, edit it, publish it. Edits and removals are logged with who and when, the same as every confirmation, every answer and every time someone opens a person's name. DIRECTIVE · LIVE Outbound SFTP to the clearinghouse on Fridays around 4.2 GB is normal. Any other day, ask Revenue Cycle first. Based on Known benign · 14 leads · 30d Coverage ### It admits what it doesn't know. Each area is scored 0 to 100, and the gaps come with ranked steps to close them: answer a question, connect a source, confirm a batch. Questions the platform can't resolve alone sit at the top of the page until a person answers them. ## See your own Terrain tomorrow morning. Connect your sources and the first brief is written the next morning. Confirm what it got right, correct what it didn't, and watch the lead quality change. Start free · 14 days Book a briefing --- # Page: Posture (https://convoy.security/posture) Posture Observe Exposure proof # Every way in. The fewest fixes. Posture is not a score. It's a live map of every way an attacker could get from an entry point to a crown jewel, kept current from your own data. You see the fewest fixes that close every path, how likely each path is, and which fixes the platform can apply itself. Start free · 14 days Simulate the plan Collapse plan 3 fixes close all 7 breach paths. F-1 Phishing-resistant MFA on the legacy portal · 2h · the platform can apply F-2 Strip domain admin from SVC-11 · 30m · the platform can apply F-3 Restrict WinRM to jump hosts · 1d · IT infra Crown jewels in reach 3 → 0 · about 1.5 days Try it live ## Seven breach paths. Pick the fixes. Watch them close. Every path here comes from the current map. Tick a fix and watch the paths close and the crown jewels drop out of reach. The platform can apply two of the three fixes in the plan itself. Posture Larkspur Group 7 Open breach paths 3 Crown jewels in reach 72% Controls proven 3 Fixes to zero paths Collapse plan · 3 fixes close 7 of 7 paths Enforce phishing-resistant MFA on the legacy admin portal 2h · the platform can apply closes 3 Strip domain admin from SVC-11 30m · the platform can apply closes 3 Restrict WinRM to jump hosts and enable telemetry 1d · IT infra closes 2 Crown jewels in reach: finance · IdP · payments. About 1.5 days of work, 2 fixes by the platform. Convoy LG Larkspur Group - Search ⌘K Posture NV N. Vega Operator Observe · Posture Search across assets, identities, rules… ⌘K Convoy platform nominal UTC Local Tick T+0000 LG Active tenant Larkspur Group 1 act now · 1 decide today Risk 27 /100 · Guarded SectorHealthcare RegionNA Assets2,746 Switch tenant⌘O Posture · exposure proof Kept current from your own data. Open breach paths 7→ 7 4 entries → 3 crown jewels Crown jewels in reach 3→ 3 Finance · IdP · payments Controls proven 72% 67 of 93 · 16 untested Fixes to zero paths 3 About 1.5 days · 2 by the platform Breach path map Number = open paths through node BP-0134% likely BP-0222% likely BP-0341% likely BP-0429% likely BP-0518% likely BP-0612% likely BP-079% likely Collapse plan Fewest fixes · most paths fixes close of 7 breach paths. Handed off · 2 to the platform · 1 approval requested Hand to the platform Request approvals Enforce phishing-resistant MFA on the legacy admin portal F-1 2h The platform can apply Recommended closes 3 Strip domain admin from SVC-11 F-2 30m The platform can apply Recommended closes 3 Restrict WinRM to jump hosts and enable telemetry F-3 1d IT infra Recommended closes 2 Segment VLAN 40 from the finance subnet F-4 3d Network eng closes 2 Patch the VPN-01 firmware F-5 4h IT infra closes 2 Remove payments:write from agent A0147 F-6 10m The platform can apply closes 2 Control proof 67 of 93 proven · 7d Proven Drifted Never tested Failed Identity 14/20 Endpoint 22/25 Email 9/10 Cloud 11/18 Network 6/12 Data 5/8 Path drift · 30d Why posture changed Day 9 Vendor remote lane onboarded with a shared credential+2 paths BP-05 · BP-06 Day 15 Mail server CVE patched, webmail path closed−1 path BP-00 Day 21 CI token committed to a public repository+1 path BP-07 Day 26 SVC-11 granted domain admin during a migration+2 paths BP-01 · BP-04 Run it again Now do it on your own tenant How it works ## The platform never stops thinking like an attacker. It starts at the entry points your data shows (an unpatched VPN, push-only MFA, a vendor lane on a shared credential, a token in a public repo), follows the foothold an attacker would take and the gap that lets them escalate, and stops at a crown jewel. What comes out is a list of paths, each with a likelihood and the one fix that cuts it. Breach paths ### Entry → foothold → escalation → crown jewel. Four columns, every open path drawn between them, a number on each node for how many paths run through it. Start with the node the most paths run through. Collapse plan ### The fewest fixes that close the most paths. Posture ranks fixes by paths closed per hour of effort and tells you which it can apply itself. Simulate the plan before you commit and watch the open count and the crown jewels in reach move. Likelihood ### The most likely way in gets fixed first. Every path carries a likelihood, and every crown jewel shows how many paths still reach it. Close a path and the count drops on the same screen. Control proof ### Proven, drifted, never tested, failed. Ninety-three controls across identity, endpoint, email, cloud, network and data, each one checked against evidence rather than assumed. The weakest control per domain is named: a DMARC policy still set to monitor only, tamper protection drifted on three hosts. ## Find the fewest fixes that close your breach paths. 14 days on your own sources. Your breach paths and the fewest fixes that close them, always current. Start free · 14 days Book a briefing --- # Page: Airspace (https://convoy.security/airspace) Airspace Observe Agent Detection and Response # Every AI agent in your company. Who uses it, what it touches, who answers for it. Airspace is Convoy's Agent Detection and Response. It finds the AI agents working inside your company, from the assistant someone wired into Microsoft 365 or Google Workspace to the server nobody remembers, and puts them all on one screen. Decisions are written as sentences you can answer with one button. The score is five tests, and anyone can recompute it from the register. Start free · 14 days Make a decision Governance score · measurement 1 24/100 Exposed Becomes 71 (Governed) once four decisions are made and the proposed guardrails are switched on. Accountable 27 Decided 9 Visible 82 Contained 0 Guarded 0 after the open decisions Try it live ## Four decisions take it from Exposed to Governed. Eleven agents on three orbits around the company. The closer to the center, the sooner someone has to act. Four are waiting on a decision written in plain words. Make one and watch the score climb. Nothing is enforced until you also switch on a guardrail. Airspace · the brief Larkspur Group 24 /100 · Exposed Becomes 71 (Governed) once the 4 open decisions are made and the proposed guardrails are on. Accountable 27 Decided 9 Visible 82 Contained 0 Guarded 0 Decisions that need you · 4 CIO · Nov 6 An AI assistant is reading the CIO's mail and 50 meeting transcripts. This week it read 470 emails across 20 mailboxes.Limit what it reads Allow it IT lead · Nov 3 Two servers are calling an AI API and nobody owns them. 360 calls in the last 6 hours.Block until claimed Find the owner 413 people use AI tools · 11 agents act for them · 8 without a named owner Convoy LG Larkspur Group - Search ⌘K Airspace ADR NV N. Vega Operator Observe · AirspaceAgent detection & response Search across assets, identities, rules… ⌘K Convoy platform nominal UTC Local Tick T+0000 LG Active tenant Larkspur Group 1 act now · 1 decide today Risk 27 /100 · Guarded SectorHealthcare RegionNA Assets2,746 Switch tenant⌘O ### AI agents at Larkspur Group Who uses them, what they can reach, who is accountable, and what has been decided. Measured monthly. Copy summary Print brief Brief Register Decisions Guardrails /100 Accountable Decided Visible 82 Contained Guarded after the open decisions · the rule for each score is printed in the brief Agents around Larkspur Closer to the center, sooner to act An AI assistant is reading the CIO's mail and 50 meeting transcripts. 25 people connected it to Gmail over MCP. This week it read 470 emails across 20 mailboxes. Limit what it reads Allow it CIO · Nov 6 An AI assistant is reading the CIO's mail and 50 meeting transcripts. CIO · Nov 6 An AI assistant is reading the CIO's mail and 50 meeting transcripts. You, · Undo Two servers are calling an AI API and nobody owns them. One is an automation server with mail access. The other is unidentified. 360 calls in the last 6 hours. Block until claimed Find the owner IT lead · Nov 3 Two servers are calling an AI API and nobody owns them. IT lead · Nov 3 Two servers are calling an AI API and nobody owns them. You, · Undo An agent answers email as a developer, every 10 minutes. 4,348 runs this month under his account. If it is disabled or phished, the agent goes with it. Give it its own identity Leave it CIO · Nov 13 An agent answers email as a developer, every 10 minutes. CIO · Nov 13 An agent answers email as a developer, every 10 minutes. You, · Undo 5 people connected an AI tool to the production ERP. A buyer, a shipping rep, a talent manager, an IT PM and the SVP of Operations. No app owner on record. Review access Allow it SVP Ops · Nov 13 5 people connected an AI tool to the production ERP. SVP Ops · Nov 13 5 people connected an AI tool to the production ERP. You, · Undo 413 people use AI tools across 40+ departments, last 30 days 11 AI agents act for them without a named owner Actions taken this period Nothing yet. Decisions and guardrail changes land here with who made them and when. What identity logs miss Sign-in logs show 32 people on the AI code editor. Convoy sees 81 computers, on the network and on the machine. Run it again Now do it on your own tenant For the board ## The six questions the board will ask, answered from your own data. Straight from the register. The answers update as decisions are made, and the numbers are the same ones in the register. ### Who is using AI agents? 413 people across 40+ departments , from IT to the production floor. 68 of them build agents or automations. 16 admin accounts use AI tools. ### What can the agents reach? 5 of 11 agents touch sensitive systems : company mail (470 emails read this week across 20 mailboxes), meeting transcripts (50), files, the production ERP and source code. ### Is company data leaving? Yes, to three AI vendors , mostly through sanctioned use: 94 computers calling one, 10 computers plus two unowned servers calling another, 81 computers on the third. ### Who is accountable? 3 of 11 agents have a named person or team. 8 have no owner you could call. Two of those are servers calling an AI API on their own. ### What have we done about it? 0 of 4 decisions made. 0 of 6 guardrails switched on. Nothing has been blocked. Every decision and guardrail change will be listed here with who made it and when. ### Can we see all of it? Identity logs alone show 7 of the 11 agents. Convoy sees all 11 by adding network and computer telemetry. The remaining gap is laptops without Convoy Agent. AI code editor 32 81 Sign-in logs Convoy Coding agents, API keys 0 94 Sign-in logs Convoy Cloud coding agent 0 39 Sign-in logs Convoy Direct API use 0 10 Sign-in logs Convoy API keys skip the sign-in, so none of this appears in identity logs. Convoy sees it on the network, and on every computer running Convoy Agent. How it works ## One picture: who uses AI, through what, touching what. Airspace reads four things you already have: who signed into which AI app, what the Microsoft 365 or Google Workspace audit log says agents did, every AI service call the firewall saw, and what the programs on each machine actually ran. Convoy Agent on the host closes the last gap. Put together, every agent gets a name, a reach, an owner or a blank where one should be, and a decision with a date on it. The map ### People, agents, and what they touch. Click anything and it moves to the center with everything it touches arranged around it: who is on the left, what it runs on and where data goes on the right. The overview puts agents on three orbits around the company. Closer to the center, sooner someone has to act. Decisions ### Written as sentences, answered with buttons. "An agent answers email as a developer every 10 minutes." Give it its own identity, or leave it. Each decision comes with a proposed owner and a due date, updates the register and the score the moment it's made, and lands in a log with who and when. DECISION 5 people connected AI to the ERP OWNER SVP Ops · due Nov 13 [ Review access ] [ Allow it ] The score ### Five tests, no model. Accountable, Decided, Visible, Contained, Guarded. Each is scored 0 to 100 by a rule printed beside it, then averaged equally. The brief shows what the score becomes once the open decisions are made, so the board sees the gap and the path at the same time. ACCOUNTABLE named person or team DECIDED a call has been made VISIBLE seen on network or host CONTAINED sensitive agents decided GUARDED Ask first or Stop is on Guardrails ### Rules for agents, off until you say so. Each guardrail comes from something Airspace found, like a connector reading meeting transcripts or a server with no owner calling AI APIs, and shows how often it would have fired. Pick one of three settings: Watch only logs it, Ask first holds the action until someone approves, Stop blocks it. Nothing is enforced until you switch it on. ## Count your agents before the board asks. Connect Microsoft 365 or Google Workspace, your firewall and your identity provider, push Convoy Agent, and the first measurement is on the screen within a day. 14 days is enough for the first brief and your first decisions. Start free · 14 days Book a briefing --- # Page: Hunt (https://convoy.security/hunt) Hunt Detect Powered by Armada # Start with a hunch. End with a case. Hunt is where you go after what the rules haven't caught yet. Say the hypothesis in plain words. Armada, Convoy's AI, turns it into queries against all of your data, shows every query and every hit, suggests the next pivot, and keeps the evidence until you escalate or close with a reason. Paste a CVE and find out whether it touches you, and whether anyone has already tried it. Start free · 14 days Run a hunt Suggested hypotheses · from current fleet state Are we exposed to CVE-2026-XXXXX, and has anyone tried it? Start Are any of the source IPs from September's failed sign-in case reappearing? Start Is anything on the file servers active at 4 a.m., outside the backup window? Start Ask Armada, paste a hypothesis or a CVE ↵ Send Try it live ## Paste a CVE. Know if it's yours. This morning's advisory, checked against everything you run. Armada finds what's on the vulnerable build, looks for anyone who already tried it, and hands you the next question. ## One hunch. Three queries. One case. Are the sources behind September's failed sign-ins back? The exact match found nothing, which is where most people stop. Pivot, and watch Armada write the next query. 01 From a CVE 02 From a past case Hunt · active Larkspur Group Are we exposed to CVE-2026-XXXXX? It's the VPN gateway one from this morning's advisory. Armada That's the VPN gateway portal bug, fixed in firmware 7.4.3. I checked every source that reports a version: Convoy Agent inventory, the firewall and VPN logs and your cloud. Asset Firmware Exposed Patched VPN-01 7.4.1 Yes No VPN-02 7.4.1 Yes No VPN-LAB 7.4.3 No Yes Armada Two internet-facing gateways are on 7.4.1, which is affected. The lab unit is already on the fixed build. Exploit attempts Asset owners Patch plan Convoy LG Larkspur Group - Search ⌘K Hunt NV N. Vega Operator Hunt Search across assets, identities, rules… ⌘K Convoy platform nominal UTC Local Tick T+0000 LG Active tenant Larkspur Group 1 act now · 1 decide today Risk 27 /100 · Guarded SectorHealthcare RegionNA Assets2,746 Switch tenant⌘O Active hunt Recent hunts File servers active at 4 a.m.Oct 21 Promoted → case Obfuscated script · engineering OUOct 14 Promoted → case Slow-drip exfil baseline surveyOct 9 Closed · benign Library CVE exposure checkInventory · exposure · footprint Built-in admin toolsUnusual use · 30d Suspicious PowerShellEncoded · non-script parents Off-hours service-account useOutside maintenance window OAuth grant fan-outNew app · 5+ grants in 10m + New hunt ### Exposed to CVE-2026-XXXXX?Promoted → case 4473 Is the VPN gateway bug from this morning's advisory anywhere in the estate, and has anyone tried it yet? Elapsed Escalate Q1 Inventory · 2 of 3 gateways on the vulnerable build 3 hits · 0.22s Q2 Footprint · malformed requests, then restarts on VPN-01 16 hits · 0.61s N. Vega Are we exposed to CVE-2026-XXXXX? It's the VPN gateway one from this morning's advisory. Armada That's the VPN gateway portal bug: unauthenticated remote code execution, CVSS 9.8, fixed in firmware 7.4.3. First question is whether it touches you at all, so I'm checking every source that reports a version: Convoy Agent inventory, the firewall and VPN logs and your cloud accounts. Query 1 Hits3   Runtime0.22s Inventory · all sources · now Assets running the VPN gateway firmware, any version Show firmware, internet exposure, patch status and last seen Asset Firmware Exposed Patched Last seen VPN-01 7.4.1 Yes No 2 min ago VPN-02 7.4.1 Yes No 2 min ago VPN-LAB 7.4.3 No Yes 1 h ago Two internet-facing gateways are on 7.4.1, which is affected. The lab unit is already on the fixed build. Try pivoting on Exploit attempts Asset owners Patch plan N. Vega Pivot · exploit attempts Armada Vulnerable isn't the same as hit. Looking for the bug's footprint on VPN-01 and VPN-02 since it went public: odd requests to the portal, crashes or restarts, and config changes. Query 2 Hits16   Runtime0.61s Exploit footprint · since disclosure Outside requests to the portal on VPN-01 and VPN-02 Flag malformed requests, portal restarts and config changes IP 203.0.113.77 16 malformed requests to VPN-01 · 03:06 Asset VPN-01 Portal restarted twice · 03:14 Asset VPN-02 Nothing unusual IP 198.51.100.23 Scanned both · no follow-up VPN-01 took 16 malformed requests from one source, then the portal restarted twice. That fits a real attempt. No config change shows up afterwards. Try pivoting on Sign-ins after 03:14 Other targets of that IP Endpoint telemetry N. Vega Pivot · sign-ins after 03:14 Armada Pulling VPN sessions on VPN-01 since the restarts and comparing each account with its usual pattern. I'm also checking your rule library for this CVE. Query 3 Hits4   Runtime0.38s After the restarts · VPN-01 VPN sessions that started after 03:14, by user, against each user's usual pattern Plus any rules in the library tagged with this CVE User svc-backup First VPN sign-in ever · 03:22 User l.osei 03:41 · usual device and place Rule Portal exploit attempt Armed · tagged with this CVE Fix Firmware 7.4.3 Needed on VPN-01 and VPN-02 One session stands out: a service account that has never used the VPN signed in 8 minutes after the restarts. The rule for this CVE is armed, so the next attempt turns into a lead on its own. Try pivoting on Open a case Disable account Patch plan Ask Armada, paste a hypothesis or a CVE ↵ Send Escalate · open a case CVE-2026-XXXXX · attempt on VPN-01 Severity Critical Assignee N. Vega · Senior operator Attached 3 queries · 23 hits · evidence items Comms Incident thread opens with the case Cancel Open case 4473 Case 4473 opened · 3 queries, 23 hits and evidence items attached · N. Vega assigned ### September IPs reappearing?Promoted → case 4472 Are any of the source IPs from September's failed sign-in case reappearing in the last 7 days? Elapsed Escalate Q1 Exact match against the September corpus 0 hits · 0.31s Q2 Pivot · /24 neighbors · 2 of 4 inside September's block 4 hits · 0.84s N. Vega Are any of the source IPs from September's failed sign-in case reappearing in the last 7 days? Armada Reasonable framing. The September case (3104) had 47 distinct source IPs across 3 ASNs. I'll re-check those IPs against the last 7 days of authentication telemetry, then widen to the neighbors of those /24 blocks. Query 1 Hits0   Runtime0.31s Exact match · last 7 days Failed sign-ins from any of the 47 source IPs in case 3104 Grouped by source IP and network No exact-IP recurrence in the last 7 days. The actor has either rotated source or paused. Try pivoting on /24 neighbors ASN pattern User fan-out N. Vega Pivot · /24 neighbors Armada Widening to /24 neighbors of the 47 original source IPs. A softer match, but the September actor's ASN concentration was real. Query 2 Hits4   Runtime0.84s Widen · last 7 days Failed sign-ins from the same /24 blocks as the case 3104 sources Keep sources that hit 2 or more users · show when each was first seen Source IP Network Users Fails First seen 203.0.113.42 AS64721 7 211 Oct 27 14:18 203.0.113.118 AS64721 3 64 Oct 27 13:51 198.51.100.12 AS64721 2 18 Oct 26 22:09 192.0.2.41 AS64477 2 12 Oct 24 06:42 Two of the four sit inside the same /24 block as September's primary source (AS64721, 203.0.113.0/24). That block has been quiet in your data for six months. Try pivoting on Users affected Target assets Timing pattern N. Vega Pivot · users affected Armada Pulling the user set for the AS64721 hits and checking it against the accounts targeted in September. Query 3 Hits9   Runtime0.42s Who they're hitting · last 7 days Failed sign-ins from AS64721, grouped by user Count fails and source IPs · flag anyone also targeted in case 3104 User m.alvarez 9 fails · 2 IPs · also in the September case User k.tanaka 7 fails · 2 IPs · also in the September case User j.morais 5 fails · 1 IP · new User f.ying 4 fails · 1 IP · new Two of the four are repeats from September. The actor still has at least part of the prior target list. Try pivoting on Open a case Widen window · 30d Endpoint telemetry Ask Armada, or paste a hypothesis ↵ Send Escalate · open a case September IPs reappearing · AS64721 cluster Severity High Assignee N. Vega · Senior operator Attached 3 queries · 13 hits · evidence items Comms Incident thread opens with the case Cancel Open case 4472 Case 4472 opened · 3 queries, 13 hits and evidence items attached · N. Vega assigned Evidence Empty Mark any Armada result as evidence with + Evidence. It travels with the case. ★ From query Run it again Now do it on your own tenant How it works ## You bring the hunch. Armada does the querying. You make the call. A hunt is a conversation with your own data. Every turn is a query you can read, a result you can see and a set of pivots worth taking next, and whatever you find goes straight into the case. Hypotheses ### It suggests what to hunt. Suggested hypotheses come from the current state of your fleet and your data: a block that went quiet, a service account that changed its hours, a new OAuth app fanning out grants. Or type your own, or paste a CVE straight from an advisory. Queries ### Every query, in the open. Armada writes the query, runs it against all of your data and shows it, with the hit count and the runtime, on every step. Read it, copy it, run it yourself in Query. If you'd have written it differently, say so and it reruns. QUERY 2 hits 4 · runtime 0.84s Failed sign-ins · last 7 days Same /24 as the case 3104 sources 2 or more users per source Evidence ### Evidence travels with the case. Mark any result as evidence. When you escalate, the case opens with the hypothesis, every query, every hit and the evidence in the order you collected it. The comms thread opens with it. Nothing gets retyped. Where it sits ## Three ways to ask your data a question. Guard, Query and Hunt all run against the same data. The difference is how much you already know. Guard ### You know what bad looks like. Write the rule, backtest it against your own history, arm it. It fires on its own from then on and every hit becomes a lead. Query ### You know the question. So ask it. Read-only, every table described, every run saved, results straight into the case. Hunt ### You have a hunch and no rule yet. Say it the way you'd say it to a colleague. Armada does the querying and the pivoting, you do the judging, and the evidence is kept for you. Then What a hunt finds becomes a Guard rule, with the hunt's own queries as its backtest. Next time, it fires without anyone hunting for it. ## Your first hunt, within an hour of your first source. Connect a source, pick a suggested hypothesis, and see what your own data says. Start free · 14 days Book a briefing --- # Page: Platform (https://convoy.security/platform) Platform The map # Every product. One source of truth. Zero handoffs. Convoy is a security platform built on one source of truth. Every product reads from it and writes back to it, so a lead, its case and its containment never get split across tools. Start free · 14 days See how it fits together One lead, every product Lead 4821 · FIN-WS-07 02:14 Guard Attempt to read stored passwords matched rule 0412, mapped to T1003 02:14 Query Same account seen on VPN from a new country 9 minutes earlier 02:15 Autopilot Host isolated. 02:15 Cases Case opened, lead and evidence attached 02:16 Comms Draft to the on-call owner, sent at 02:17 07:30 Insights Posture updated. Two similar hosts flagged for review Every product, one lead. How it fits together ## One source of truth in the middle. Everything else reads from it. Sources feed it, products work from it, and Cockpit reads all of it. No product keeps its own copy of the data. In Convoy Agent Every host: process, file, registry, network, logon. Plus every AI agent it finds, for Airspace. Your sources Identity, email, cloud, firewalls, IoT, your current EDR. 150+ vendors. Terrain What your team has confirmed about the environment. Read on every lead before a call is made. One source of truth EVERY EVENT · EVERY FACT · EVERY ACTION · QUERY ALL OF IT Out Detect Guard · Leads · Query · Hunt Respond Autopilot · Cases · Comms Observe Posture · Insights · Assist · Airspace Operate Fleet · Convoy Agent Intelligence Terrain · Predictions · Threat Actors · Threat Intelligence Read and write, both ways Cockpit The one screen that reads all of it. Posture, decisions required, what changed overnight. Your own AI tools over MCP The same data and the same actions, from the tools your team already uses, scoped to your tenant. The products ## Everything is included. There's no "platinum tier" with the good parts in it. Six groups, one source of truth, one agreement. Here is what each one is for. 00 ### Cockpit The one screen What needs a person, what changed overnight, and a risk score next to your sector's median. Run it live on the home page. Needs you · Handled for you · What Convoy sees → 01 ### Detect Find it Rules, leads, queries and hypothesis-driven hunting across every source. Guard · Leads · Query · Hunt → 02 ### Respond Stop it Playbooks that start from a rule, a schedule, a webhook or a click, then cases and incident threads to the close. Autopilot · Cases · Comms → 03 ### Observe See your exposure Breach paths, trends, answers in plain language and every AI agent in the company. Posture · Insights · Assist · Airspace → 04 ### Operate Run the estate Every asset in one inventory, and the agent on every host. Fleet · Convoy Agent → 05 ### Intelligence Know the context What the platform knows about you, and what is happening outside. Terrain · Predictions · Threat Actors · Threat Intelligence → Day one ### All of it, on your data. Every tenant gets the whole console from the first login. No add-ons, no modules to unlock later, nothing saved for a higher tier. 2K+ rules 1.2K+ investigation guides 100+ MCP tools Start free · 14 days Book a briefing Detect Guard 2K+ rules, allow lists shared across them, and tuning suggestions from your own data. Respond Autopilot Playbooks that run while you sleep. Ask Assist Ask your environment anything, in plain words. Report Insights The board report, already written. Monthly and quarterly reviews, posture and risk, compliance and coverage, written from your own data. Intelligence Predictions Where your exposure is heading next. Intelligence Threat Actors Who is working your sector right now. Respond Comms Incident threads with the right people, outside counsel or your insurer included, attachments and all. Under the hood ## The parts that never fit on a comparison table. The details you'd usually only find out about after you've signed. Leads ### Every lead closes with a written reason. A write-up, every time: the entities involved, the evidence in order, a confidence score, and what should happen next. The 99 leads that turn out to be nothing get the same treatment as the one that isn't, so you can read why. Determination: Non-concern (confidence 70/100) Entities: 1 user · 1 host · 1 process Evidence: 5 process creations, 68 min window No remote targets. No credential tooling. Next: confirm with the customer whether sanctioned. Query ### Query everything you send us. Raw events from every source, every table described, read-only so nobody can break anything. Save a query, share it with the team, export the results straight into the case. Process launches · Sysmon · last 30 days Command line runs a remote admin tool as SYSTEM Show the host, the user and the full command line Guard ### Test a rule against your own history before it goes live. Write it, dry-run it against your real events, and see exactly what it would have fired on. Every edit is versioned and every promotion goes through a review ladder, so a rule never surprises you in production. Investigation guides ### 1.2K+ investigation guides, written by us. The rule library comes with investigation guides for working the leads it produces. The guides live in your tenant, and your own AI tools can read them over MCP. How it's delivered ## Managed, co-managed or self-managed. Same platform, same source of truth. Pick how much of the work you want to do. Change your mind later without changing tools. ### Managed Our operators watch, triage and contain. You see every case and every thread, and your board gets a report it can read. Our operators run it ### Co-managed Your operators work next to ours with shared cases, shared threads and the same rule library. Write your own detections. Hand us the shifts you don't want. Your team and ours ### Self-managed Your team runs it. Our operators are a request away. Same platform, same data, and your own AI tools can work in it over MCP from day one. Your team runs it SSO, a role check on every request, isolated tenants, a full audit log, 99.95% uptime and a BAA signed first. See every commitment → Production rollout ## Live in days. Switched over by renewal. Production rollout takes days, and it starts the day of your briefing. The free trial moves faster. Hour 0 ### Sources Identity and email first, because that's where most intrusions start: Entra ID, Google Workspace or AWS Cognito, then Microsoft 365 or Gmail, and Proofpoint if you run it. Then firewalls, IoT and your clouds, which connect API to API with nothing to install, and your current EDR. Each connector is native, so there's no parsing work. Hour 1 ### Convoy Agent One installer, pushed through Intune, NinjaOne, any other RMM or a script. Hosts report in as they come online and Fleet shows coverage climbing. Day 1 ### Tuning Rules run in monitor mode against your real traffic. Exceptions get scoped to the host, account or script that needs them. Nothing is silenced globally. Week 1 ### Armed Reviewed rules go live. Autopilot playbooks are armed one at a time. Your first "Confirmation needed" case has already come and gone. Convoy ingests the tools it replaces, so you compare lead by lead in one console and the old contract ends at renewal with no gap in between. From you we need an admin for each source, a way to push software to hosts, a signed BAA if you're in healthcare, and one person who can answer "was that you?" in a sentence. Sources ## If it writes a log, we take it. No parsers to write. 150+ vendors across identity, email, endpoints, firewalls, cloud and IoT. Every cloud connects API to API, so there is nothing to install or host. Connect a source and the rules start running against it. All 168 Identity 22 Email 18 Endpoint 22 Network 42 Cloud and SaaS 28 OS 14 Data and storage 15 IoT 5 IT tools 2 Showing 168 Identity and access 22 Microsoft Entra ID Okta Google Workspace AWS Cognito Duo JumpCloud BeyondTrust Delinea HashiCorp Vault 1Password Keeper KeePass SecurID Symantec VIP OpenLDAP NetIQ eDirectory FreeRADIUS Silverfort ManageEngine ADAudit Plus Netwrix Ekran System Thales SafeNet Email and collaboration 18 Microsoft 365 Exchange Server SharePoint Proofpoint Barracuda Forcepoint Trellix Email Security Perception Point IRONSCALES Secure Email Symantec Brightmail Sophos PureMessage Zimbra Postfix Dropbox Jira Cloud monday.com GitHub Endpoint protection 22 Convoy Agent CrowdStrike SentinelOne Microsoft Defender Sophos Trend Micro Bitdefender ESET Trellix Symantec Endpoint Carbon Black BlackBerry Cylance Kaspersky Check Point Harmony FortiEDR Secure Endpoint Palo Alto Cortex WatchGuard Panda Intune BigFix DriveLock Digital Guardian Firewalls and network 42 Fortinet Palo Alto Networks Check Point Cisco Meraki Juniper Networks SonicWall Sophos Firewall WatchGuard Zyxel Ubiquiti UniFi pfSense HPE Aruba Networking Aruba ClearPass Huawei Extreme Networks Dell Networking Ruckus Citrix NetScaler F5 BIG-IP Cato Networks Zscaler Perimeter 81 Ivanti Connect Secure OpenVPN Infoblox ISC BIND HAProxy Radware NETSCOUT Arbor Imperva Akamai Sucuri Suricata Forescout Trellix Network Security TippingPoint Stormshield genua Venustech Windows Firewall Microsoft DNS and DHCP Cloud and SaaS · API to API 28 AWS CloudTrail Amazon GuardDuty AWS Security Hub VPC Flow Logs Amazon Route 53 AWS Network Firewall Elastic Load Balancing Azure Event Hubs Azure Firewall Azure Network Watcher Azure WAF Azure API Management Azure Files Google Cloud Armor Google Cloud DNS Google Cloud Firewall Security Command Center vSphere Workspace ONE Cloud Cloud OpenStack MongoDB Atlas Trend Micro Cloud One Cloudlock Skyhigh Security Adobe Commerce OpenTelemetry OS and servers 14 Windows Server Sysmon PowerShell macOS Linux AIX i HP-UX HPE NonStop Solaris OpenBSD Hyper-V Apache HTTP Server SCOM Data, apps and storage 15 Pure Storage NetApp ONTAP Synology Microsoft SQL Server Database Guardium SAP Varonis Thales Vormetric OPSWAT MetaDefender Orion Riverbed Pentera CrushFTP ProFTPD IoT and devices 5 Digital Watchdog Zebra Cameras and NVRs Badge and door access Imaging and PACS IT tools 2 NinjaOne ConnectWise ScreenConnect Nothing by that name yet. If it writes a log, we can usually take it. Clear filters Ask about a source ## Retire the SIEM. Keep the evidence. We'll show you how Convoy takes over from your current stack, source by source, without a gap in coverage. Start free · 14 days Book a briefing --- # Page: Convoy Agent (https://convoy.security/agent) New Convoy Agent Full telemetry EDR # Full EDR. Built in, not bolted on. Convoy Agent prevents, detects and responds on every host, collects your logs and inventory while it's there, and puts all of it in the same source of truth as your identities, inboxes, firewalls and cloud. One process does what used to take three agents and two vendors. Already happy with your EDR? Keep it. The EDR in Convoy Agent is optional. Start free · 14 days Already have an EDR? Host · online $ convoy-agent status prevent enforcing detect process · file · registry · net · logon respond isolate · kill · quarantine collect event logs · inventory uplink streaming · events/s footprint light · predictable Why it matters ## A standalone EDR sees the laptop. We see the attack. The laptop, the account signed in to it, the email that started it and the firewall it talked through. Convoy Agent is what puts the endpoint in that same picture. ### One lead, not two alerts The host event and the identity event that goes with it land on the same lead, so triage starts with the whole story. ### Response across every surface One playbook isolates the host, disables the account and purges the message, without handing anything to another tool. ### Fewer agents on the box Protection, log collection and inventory from one process instead of three. ### No extra contract Convoy Agent is part of your Convoy agreement. There's no separate EDR license to renew. What it does ## Full EDR, plus the log collection that used to need its own agent. Six verbs, one process, on every host. The same process finds the AI agents on each machine for Airspace . 01 Prevent 02 Detect 03 Respond 04 Collect 05 Inventory 06 Investigate convoy-agent · rdweb01 · readout prevent blocked · unsigned binary launch · agent4.exe · 18:30:22 Blocks malicious execution on the host and tells Convoy what it stopped and why. The block itself becomes a lead, with the process tree attached. detect process · file · registry · net · logon → 2K+ Guard rules Watches process, file, registry, network and logon activity, matched on the host and in the platform against 2K+ Guard rules. Same rules, same data as your identities and inboxes. respond isolate · kill · quarantine · by hand or from Autopilot Isolates the host, stops the process and quarantines the file, by hand, from your own AI tools over MCP, or from an Autopilot playbook. Every action is recorded with who or what triggered it. collect windows event logs · sysmon · host telemetry → one source of truth Ships Windows event logs and host telemetry into Convoy from the same process. Delete the forwarder your SIEM needed. inventory host · logons · installed software · patch level → Fleet Reports every host it runs on, who logs on and what runs, straight into Fleet, where each asset gets a risk score and a compliance state. investigate Every process rdweb01 ran, with the user and the command line Every event it sends is queryable next to your identity, email and network data. Nothing is sampled, tiered or archived early. Your EDR, or ours ## Keep your EDR, run both, or switch. It isn't all or nothing. We already ingest the major third-party EDRs, so your current agent reports into the same leads either way. Convoy can isolate a host through it, too. The EDR in Convoy Agent is a choice, not a requirement. Pick the setup that fits today and change it whenever you like. 1 ### Keep your EDR Leave it in place. Convoy ingests it, and Convoy Agent runs with its EDR switched off, covering log collection and inventory. 2 ### Run both and compare Turn Convoy's EDR on next to yours. See what each caught, what each missed and what each cost the host, lead by lead. 3 ### Switch when it suits you Retire the old agent at renewal, or never. Rules, history and cases stay in Convoy either way, so nothing restarts from zero. Convoy Agent A standalone EDR Log collection Built in A second agent or forwarder Where alerts land A Convoy lead with identity, email and network context Its own console Response reach Endpoint, identity and email in one playbook Endpoint only Who watches it Convoy operators, as much or as little as you want Your team, or an MDR add-on Licensing Included A separate contract ## Put Convoy Agent on every host. Push it through the tools you already use. Keep your current EDR, or run both and keep the one that caught more. Start free · 14 days Book a briefing --- # Page: MCP (https://convoy.security/mcp) MCP API Webhooks 100+ tools # Security your own AI tools can operate. Convoy's MCP server is scoped to your tenant and works with any MCP client. The assistants your team already uses can list leads, run queries, write rules and contain hosts, under the same permissions and the same audit trail as the console. Start free · 14 days Connect your AI tool Your tenant Any MCP client Access OAuth sign-in or an API key Scope your tenant, nothing else Record every call in your audit trail Live session Getting started ## Three steps. The second one takes a minute. 1 ### Sign in or make a key Connect with OAuth as yourself, or make an API key in the console. Either way it carries your role and nothing more. 2 ### Add the server to your client Add your tenant's address to any MCP client, then sign in or paste the key. No SDK, no plugin. 3 ### Ask your own assistant for what you need Triage the overnight leads, explain a noisy rule, draft a case summary, pull every sign-in for one account across every source. Tool reference ## Pick a task. See which tools fire. 100+ tools is a list. This is what they're for. Every call runs under the connected user's role. Your AI tool sees the full set the moment it connects. Triage the overnight leads Leads Contain a host Respond Write and test a rule Guard Sweep for an indicator Query Pull a phishing email Email Brief the board Insights Leads · 4 calls ### Triage the overnight leads What came in since 18:00, what matters, and why the rest can close. 01 List leads Everything new since 18:00, newest first, with severity and state. read 02 Open a lead Open the one that matters: narrative, entities, confidence score. read 03 Lead timeline Who did what to it and when, including the triage determinations. read 04 Update a lead Close the rest as non-concern, each with a written reason. write Respond · 4 calls ### Contain a host Isolate rdweb01, open the case, tell the owner. 01 List response actions What containment this tenant can perform, and the fields each one needs. read 02 Run a response action Isolate rdweb01 through Convoy Agent. One step reverses it. contain 03 Open a case Open a case from the lead with the evidence attached. write 04 Incident thread Find the incident thread so the right people hear it first. read Guard · 4 calls ### Write and test a rule A new detection for scheduled tasks created by service accounts. 01 Describe a source What fields the Sysmon and Windows security logs actually carry. read 02 Create a rule Draft the rule, mapped to T1053.005, scoped to svc-* accounts. write 03 Test a rule Dry-run it against 30 days of your own events before it goes anywhere. read 04 Send for review Send it up the review ladder. Nothing goes live on its own. write Query · 4 calls ### Sweep for an indicator Has anything talked to the IP from this morning's advisory? 01 Run a query Queries firewall, proxy and Convoy Agent telemetry for the last 30 days. read 02 Read the results The rows, paginated, ready to drop into a case. read 03 Save a query Keep it as a shared query the whole team can re-run. write 04 Create a rule Turn the sweep into a standing rule so the next match is a lead. write Email · 4 calls ### Pull a phishing email Fourteen mailboxes got it. Two clicked. 01 List signals Which mailboxes received the message and who opened the link. read 02 Run a response action Delete it from every inbox in one action. contain 03 Update a lead Close the lead as contained, with the mailbox list in the reason. write 04 Add a case note Note the two users who clicked and the reset that went out. write Insights · 4 calls ### Brief the board Numbers a board can read, straight from your data. 01 Read posture Score, tier, ATT&CK coverage and the trend. read 02 Fleet overview Assets protected, agent coverage, the ten riskiest. read 03 List cases Cases closed this quarter, by severity and time to contain. read 04 Audit trail Every action taken in the quarter, by person or by playbook. read read write contain A read-only role stops at the first ring. Containment needs a role that can contain in the console, too. Permissions ## A tool can never do more than the person who connected it. ### Checked on every call Permissions are re-checked on every tool call. Reads need read, writes need write. ### Same roles as the console Connections follow the role ladder your team already has. Nothing new to govern. ### Errors it can explain When a role doesn't clear a tool, you get a machine-readable reason, not a silent failure. ### Threads stay private Incident threads keep their parties-only rule. Your AI tool only reads or posts where the connected user is a party. API ## Prefer plain HTTP? There's an API for that. Everything your AI tool can reach is there too, with OAuth or an API key and the same permissions. The reference lives in your console. Webhooks ## Let any system fire an Autopilot playbook. Webhook-triggered automations carry their own secret, so a ticketing system, a form or a script can start a playbook without holding an API key. Every firing is a recorded run. Its own secret, so no API key changes hands Only armed webhook automations fire Each run audited like any other ## Your SOC, inside whatever your engineers already have open. Connect your own assistant to your tenant and ask it something you'd normally ask us. Start free · 14 days Book a briefing --- # Page: Solutions (https://convoy.security/solutions) Solutions Regulated Multi-site # For companies that can't stop. A hospital can't stop admitting. A payments company can't stop settling. A plant can't pause the line while someone works out which laptop is talking to a server overseas.We built Convoy for places where the downtime is the incident. Healthcare Financial services Manufacturing and retail Real estate MSP partners Healthcare · Behavioral health · Senior care ## The BAA gets signed first. Everything else follows from it. Clinical systems that never switch off and dozens of facilities on one network. Convoy covers every site from one console and puts the sign-in, the mailbox and the workstation in the same investigation, so a phished account doesn't become a facility-wide outage. ### What Convoy covers Entra ID and Google Workspace sign-ins and MFA changes Microsoft 365 and Gmail mail flow and mailbox rules Every workstation, through Convoy Agent Firewalls and switches at every site Imaging, badge and other IoT devices, seen through the network Reporting built for HIPAA audits and cyber insurance questionnaires ### Contract terms BAA signed first, and it governs data ownership 99.95% uptime commitment Convoy doesn't store PHI Financial services · Payments · Insurance ## When the examiner asks who did what, you hand over the log. Constant fraud pressure and regulators who want proof. Convoy watches identity and cloud activity across AWS, Azure, Entra ID and Google Workspace together, and every action anyone takes, a person or a playbook, is written to an audit trail you can export. ### What Convoy covers AWS CloudTrail and Cognito AWS Cognito, Entra ID and privileged sign-ins Email security and message trace Every response action written to an audit log you can export Evidence export for PCI DSS, NYDFS Part 500 and SOC 2 reviews Convoy doesn't store cardholder data Manufacturing · Retail · Distribution ## Isolate one machine. Keep the line running. Plants, warehouses, showrooms and e-commerce, often on flat networks with machines nobody wants to touch. Convoy reads your firewalls and switches natively, and takes one compromised host off the network while the rest of the floor keeps working. ### What Convoy covers FortiGate, SonicWall, Meraki and Aruba Cameras, controllers and other IoT on the floor, seen through the network Remote access tools like ScreenConnect Shop-floor and warehouse workstations through Convoy Agent Host isolation that leaves everything else online Storage and infrastructure telemetry Real estate · Property ## The fake wire instruction and the hijacked inbox, caught as one. Business email compromise goes where the closings are. Convoy reads mail flow and sign-ins side by side, so a spoofed invoice and the account takeover behind it show up as a single lead. One action pulls the message out of every mailbox. ### What Convoy covers Microsoft 365 and Google Workspace message logs Proofpoint TAP Mailbox rules, forwarding and sign-ins Purge from every mailbox in one action Account disable with one-click re-enable Managed service providers ## Put a real security operation behind every customer you serve. Make money doing it. One partner agreement for the platform, Convoy Agent and operators, priced to leave room for your margin. Start with one customer, then roll out across your book. See the partner program ### What partners get One agreement for the platform, Convoy Agent and operators Pricing that leaves room for your margin Managed, co-managed or self-managed, chosen per customer Engineers on call ## Tell us what you can't afford to lose. We'll show you how Convoy protects it, using the systems and sources you actually run. Start free · 14 days Book a briefing --- # Page: Partners (https://convoy.security/partners) For MSPs Partner program # Put a real security operation behind every customer you serve. Make money doing it. Platform, Convoy Agent and operators under one partner agreement, with pricing built to leave room for your margin. Every partner works directly with our engineers, not a ticket queue. Apply to partner Book a partner briefing ### One agreement Platform, Convoy Agent and operators under a single partner contract. ### Priced for margin Volume tiers that improve as you grow, so Convoy is a revenue line on your P&L instead of a cost you pass through. ### Rolls out your way Convoy Agent deploys through the RMM you already run. ### Engineers on call Direct access to Convoy engineering from onboarding onward. How it works ## Start with one customer. Roll out across your book. 01 ### Apply Tell us about the customers you look after and what you offer them today. 02 ### Start with one customer Run Convoy on one customer, next to what they have, and see what it catches. 03 ### Roll out across your book Push Convoy Agent through your RMM, customer by customer, on the same agreement. Run it your way ## One login for every customer. Choose how much you run for each. Your team works every customer's tenant from one login, and each tenant stays isolated from the rest. ### Managed Our operators watch, triage and contain. You see every case and every thread. ### Co-managed Your team works next to ours, with shared cases and the same rule library. ### Self-managed Your team runs it. Our operators are a request away. Apply ## Apply to partner. Tell us about your customers and what you offer them today. We'll come back with how the program would work for you. Full name Work email Company Customers you manage 1 to 10 11 to 50 51 to 200 200+ Endpoints across them Under 1K 1K to 5K 5K to 25K 25K+ What do you offer customers today? Verify you are human Turnstile Apply to partner --- # Page: Why Convoy (https://convoy.security/why-convoy) Why Convoy Four vendors vs. one Priced per identity # Stop paying four vendors to miss the same attack. A SIEM, an EDR, a SOAR tool and an MDR contract, plus a person whose job is making them talk. Every handoff between them is a place an attacker can wait. We replaced all of it with one platform, and we price it by the people you protect, not the logs you keep. Start free · 14 days See the comparison SIEM replaced EDR replaced SOAR replaced MDR replaced 0 ingest meter 1 case per incident 1 price per identity SIEM replaced EDR replaced SOAR replaced MDR replaced 0 ingest meter 1 case per incident 1 price per identity Side by side ## The stack you have. The platform that replaces it. SIEM + EDR + SOAR + MDR Convoy Consoles Four or more One Pricing Per gigabyte ingested, per module, per seat Per identity protected. No ingest meter. Detection content Yours to write, tune and keep alive 2K+ rules mapped to MITRE ATT&CK, tuned with you Endpoint agent A separate EDR contract Convoy Agent, included Response Playbooks someone has to build and maintain Endpoint, identity and email actions on day one Investigation Alerts copied between tools by hand Lead, case, evidence and comms in one place Who watches it Whoever is on call, or an add-on contract Convoy operators in your console, as much or as little as you want Investigation write-ups An alert ID and a status Every lead closed with a written reason and a confidence score Raw data Often sampled or tiered to control cost All of it, queryable Your own AI tools Usually a portal and a PDF MCP and REST API on every tenant Compare ## Whatever shape your stack is in, here's what changes. Three stack shapes we meet in briefings, and what changes for each. Shape 1 ### SIEM plus an MDR contract What you have: a log platform billed by volume and a service that watches a subset of it, usually the endpoint and identity alerts, and emails you. What breaks: the MDR can't see what the SIEM didn't ingest because it cost too much, and neither can act in the other's console. What Convoy changes: one source of truth with everything in it, operators in the same console you use, no meter. The SIEM contract ends at renewal. Shape 2 ### EDR with the vendor's managed service What you have: a good endpoint agent and a team that watches endpoints. Identity, email, firewalls, IoT and cloud are someone else's problem or nobody's. What breaks: the attack starts in a mailbox and the first thing the EDR sees is the third step. What Convoy changes: keep the agent if you like it, we ingest it. Add identity, email, firewalls, IoT and cloud to the same source of truth. Or bake off Convoy Agent and decide later. Shape 3 ### In-house SOC with a SOAR What you have: capable people, a playbook engine someone built two years ago, and a backlog of playbooks nobody maintains. What breaks: every new tool means new glue, and the 3 a.m. response still depends on who's awake. What Convoy changes: co-managed. Your team writes rules and playbooks on a platform that already has the actions, the audit trail and the MCP server. Our operators cover the hours you don't. Pricing model ## Pay for coverage. Never for volume. One number per protected identity, per month. Convoy Agent is in it. Operators are in it, on every plan. The ingest meter doesn't exist. Sending us more telemetry makes you safer and never makes the bill bigger. Get a quote No meter CONVOY Invoice · monthly Identities protected × 1 line per identity Ingest (GB) × 0 0.00 EDR agent, per endpoint × 0 0.00 Operators, per shift × 0 0.00 SOAR module × 0 0.00 MCP and API access × 0 0.00 Lines that move the bill One 01 ### Price per identity One line on the invoice, with endpoints and servers included up to a baseline. Easy to forecast as you grow. 02 ### Ingest meter: none Connect every source you have. Volume never moves the price. 03 ### Agent and operators: in it Convoy Agent is part of the platform, and the people are part of the service, whether you go managed, co-managed or self-managed. Trust ## We hold ourselves to the standard we sell. A security vendor with weak controls is just another way in. These commitments are written into our contracts. 99.95% ### Uptime Written into the agreement as a platform commitment. BAA ### Signed first For healthcare customers, the business associate agreement comes before anything else and governs the rest. 1:1 ### Tenant isolation Every customer's data sits in its own tenant, and every request is scoped to it. RBAC ### Permissions on every call Role-based access, checked on each request in the console, the API and the MCP server. 100% ### Audited Every response action and rule change is recorded, whether a person, a playbook or one of your own AI tools made it. 2 days ### To acknowledge a report Found a weakness in something we run? Our disclosure program acknowledges reports within 2 business days and credits the researcher. SOC 2, ISO 27001 and HIPAA → Read the disclosure policy → Before you switch ## Questions buyers ask. Do we have to turn off our SIEM on day one? + No. Convoy runs next to it while your sources move over. You switch the old one off when Convoy's coverage matches it, usually at renewal. Can we keep our current EDR? + Yes. Convoy ingests the major third-party EDRs today and can isolate a host through yours. You can also run Convoy Agent beside your current agent and compare the two before you decide. Who's actually watching our environment? + Convoy's own operators, working in the same console you see. Every action they take shows up in your audit trail. What does onboarding involve? + We connect your sources, deploy Convoy Agent, tune the rules against your real traffic and run alongside your current tools until the coverage matches. Can our own engineers work in it? + Yes. Co-managed and self-managed customers write their own rules and playbooks, and every tenant is open over MCP and a REST API under the same permissions as the console. Our offers ## Three offers to hold us to. 01 ### Run us beside your SIEM until you turn it off. We connect your sources and run in parallel. You switch the old one off when our coverage matches it, usually at renewal. No hard cutover, no migration weekend. 02 ### Bake Convoy Agent off against whatever you run. Same hosts, same attacks, same window. Keep the one that caught more. Your hosts decide. 03 ### We'll price it against your last invoice. We'll map what Convoy replaces, what it keeps, and what you'd pay instead, line by line. If we're not the better deal we'll say so. ## Bring us your stack and your last invoice. 30 minutes. We map what Convoy replaces, what it keeps, and what you'd pay instead. Start free · 14 days Book a briefing --- # Page: Resources (https://convoy.security/resources) Resources From the record Signal in the Noise # What actually happened. Written down. Most security vendors publish fear. We publish the record: real investigations, names removed, reasoning kept, including the one where our first call was wrong. Start free · 14 days Read the record 01 ### From the record Five investigations, timelines intact, names removed. 5 cases 02 ### Signal in the Noise Writing from the people who build it. 3 posts From the record5 Signal in the Noise3 Updated Oct 2026 From the record · 01 ## Five investigations, as they happened. Each one was worked on Convoy. Four are customer cases with the customer, hosts, accounts and addresses changed. One ran on our demo tenant and was worked exactly as a customer case would be. Times, rules and decisions are not changed. One of them is the case where our first call was wrong, because that's part of the record too. Business email compromise Identity Email Mid-size company · Microsoft 365 · 2 accounts · resolved ### The inbox rule named "." An attacker working from a commercial VPN exit spent two days turning one weak password into tenant-wide persistence. The rule that gave them away had a single-character name and no conditions. It deleted every incoming message to the admin mailbox, silently. 36 min Escalation to contained 2 Accounts, 1 rule, 1 app secret Restored Every deleted message Read the timeline Day 1 · 18:11 A password attack against a staff mailbox succeeds. Guard logs the pattern, the lead stays open. Day 2 · 22:43 The same address sends mail from that mailbox and reads existing threads. Foothold confirmed on the lead. Day 3 · 15:07 The address fails, then succeeds, against the tenant admin mailbox. The lead escalates. Day 3 · 15:08 An inbox rule named "." is created: delete every message, stop processing further rules, no filter. Guard fires on rule creation. A case opens. Day 3 · 15:22 The same session rotates secrets on a service principal. Query ties the session, both mailboxes and the VPN address together in one place. Day 3 · 15:43 Both accounts disabled, sessions revoked, the rule deleted, the address blocked, app secrets rotated, deleted mail restored. Comms to the customer with the full chain. What changed after. The customer's conditional access now blocks commercial VPN ranges outright, and inbox-rule creation on privileged mailboxes is a confirmation event, not a log line. Account takeover Identity Healthcare provider · Microsoft 365 · 1 account · resolved ### MFA passed. The token was stolen anyway. A sign-in that looked legitimate on every checkbox: right user, MFA satisfied, familiar app. What didn't fit was everything around it. The session token had been lifted from the user's browser by a look-alike sign-in page, so the attacker never needed the password or the second factor. 24 min First flag to disabled MFA passed Token stolen anyway Re-enabled Next morning, fresh credential Read the timeline 00:09 Guard flags a Microsoft 365 sign-in: new device fingerprint, new network, hours outside the user's pattern, on an account with access to patient scheduling. 00:13 A case opens as "Confirmation needed." The record already holds the sign-in, the user's 30-day baseline and the token issue time. 00:21 The token's issue time predates the sign-in by hours and matches a visit to a lookalike login page in the proxy logs. Determination: stolen session token. 00:24 Account disabled, sessions revoked, device unregistered. Comms sent to the customer's IT lead with what to tell the user. Next morning The customer confirms the user never authorized the device. Account re-enabled with a fresh credential and a new phone enrollment. Case resolved. What changed after. Token-theft indicators now carry extra weight on this tenant's identity rules, and the BAA-covered accounts get a tighter sign-in baseline. Social engineering Endpoint Convoy Agent Mid-size company · Windows · 1 host · resolved in 35 minutes ### A fake prompt and a pasted command. A fake "verify you are human" page told a user to press Windows+R and paste a command. They did. The command pulled down a second program through a built-in Windows tool. The whole thing is designed to look like the user's own action, because it is. 35 min Paste to resolved 1 host 0 second stage 2 rules Fired on the same paste Read the timeline 18:36 Convoy Agent records a shell launched from the Run dialog with download and pipe content in the command line. Two rules fire: one on the Run dialog history, one on the download through a built-in tool. 18:37 Two leads, one case. The host is isolated. The user's account stays enabled pending a human read of the record. 18:44 Query finds the referring page in the proxy logs and no other host with the same Run dialog history entry. Nothing else ran after the download. 19:12 Download removed, isolation lifted, case resolved. Comms to the customer with the page URL to block and a two-line note for the user. What changed after. Nothing on the platform side. The rules were already there. The customer added the lookalike page's domain pattern to their web filter the same afternoon. The one we got wrong first Endpoint Judgment Demo environment · Windows RD Web server · 1 admin account · closed, no action ### A remote admin tool, as SYSTEM, on a production server. Twice. By the right person. An admin-companion account ran a remote admin tool as SYSTEM from a Downloads folder on a remote-access server. Two earlier leads had escalated the same pattern on the strength of one claim: that the account did not exist in the directory. The third investigation checked the claim instead of inheriting it. No action The right call, the third time 2 Prior escalations overturned 68 min Of telemetry read before deciding Read the timeline 19:08:21 Guard fires on a remote admin tool starting cmd.exe as SYSTEM from a user profile on an RD Web Access server. The lead inherits two prior escalations on the same host and account. 19:17 Case opens. The prior determination says the account is not in Active Directory, therefore forged. 19:40 The claim is re-tested. The base user exists. The ".adm" suffix is the customer's standard admin-companion convention. Thirty days of baseline show the same profile installing ordinary software and running a daily scheduled cleanup. 20:15 68 minutes of post-detection telemetry on the host: five process creations, no remote targets, no credential tooling, no persistence. Self-elevation, not lateral movement. Outcome Do not isolate. Comms to the customer asking whether running admin utilities from a Downloads folder on that server is sanctioned. Two prior escalations annotated as a self-reinforcing chain built on one unverified claim. What changed after. "Account not found" from a single enrichment lookup is no longer treated as proof of a forged account anywhere on the platform. It is now a prompt to look again. EDR tamper Endpoint Third-party EDR Payments company · third-party EDR · 1 admin · closed, authorized ### Someone pulled the EDR uninstall token. Convoy watches the other EDRs too. Revealing an uninstall token is the step before removing an agent from a host, which is the step before the host goes dark. It is also what an admin does before a planned migration. The record has to tell the two apart quickly. 4 min To the question Authorized Closed next morning Covered Convoy Agent on the host either way Read the timeline 00:02 Guard flags a protection-tamper event from the third-party EDR: an uninstall token revealed through the console, overnight, for a host in the payments segment. 00:04 Case opens as "Confirmation needed." The record pairs the console action with the admin's own sign-in, device and a change ticket referenced in the customer's knowledge base. 00:06 Comms to the customer's on-call: who did this, from where, and the question. No action taken, because the host is covered by Convoy Agent either way. Morning Customer confirms a scheduled agent migration. Case closed as authorized, with the confirmation on the record for the next audit. What changed after. The customer's migration runbook now opens a Convoy case first, so the question is already answered when the token is revealed. Timelines are taken from case records and condensed. Organizations, people, hosts and addresses are altered. Durations are real. Signal in the Noise · 02 ## Writing from the people who build it. October 2026 · Platform · 1 min read ### Why we stopped calling it a SIEM. What the category was built for, what it still can't do, and why we picked a different word. Read the post → October 2026 · MCP · 1 min read ### Built for your AI tools to operate. Not to summarize. Your AI client gets the same 100+ tools our operators use. Here's how roles and the audit trail keep that safe. Read the post → September 2026 · Operations · 1 min read ### "Confirmation needed": why we ask before we act, and when we don't. When Autopilot acts on its own, when we ask you first, and why a wrong containment counts as an incident too. Read the post → All posts ## Want your own cases to read like this? 30 minutes, live platform, your sources. We'll show you a case from first signal to closed. Start free · 14 days Book a briefing --- # Page: Blog (https://convoy.security/blog) Blog Writing from the team # Signal in the Noise. Writing from the people who build Convoy: how the platform works, why we built it this way, and what we learn running it. Follow with RSS All posts October 2026 · Platform · 1 min read ### Why we stopped calling it a SIEM. What the category was built for, what it still can't do, and why we picked a different word. Read the post → October 2026 · MCP · 1 min read ### Built for your AI tools to operate. Not to summarize. Your AI client gets the same 100+ tools our operators use. Here's how roles and the audit trail keep that safe. Read the post → September 2026 · Operations · 1 min read ### "Confirmation needed": why we ask before we act, and when we don't. When Autopilot acts on its own, when we ask you first, and why a wrong containment counts as an incident too. Read the post → ## See it on your own data. Your own tenant, the full platform, Convoy Agent and operators on hand. Start free · 14 days Book a briefing --- # Page: Start free (https://convoy.security/start) Free trial 14 days Self-deploy Full platform # Start free. Live within hours. Your own tenant, the full platform, Convoy Agent and every connector. You deploy it yourself with our docs beside you. Your data and detections start showing up almost immediately. 14 days, then decide. Day 0 ### Tenant within hours Your tenant, API access and an MCP connection. Connect Microsoft 365 or Google Workspace first. Clouds connect API to API, nothing to install. Same day ### Your first lead Something real from your environment, investigated and closed with a reason you can read. Day 1 ### Convoy Agent out One installer through Intune, NinjaOne, any other RMM or a script. Fleet shows coverage climbing. Day 14 ### Compare and decide Lead by lead against your current stack. Keep what catches more. Tenant · new Create your tenant Full name Work email Company Identities to protect Under 1K 1K to 5K 5K to 25K 25K+ First source you'll connect Microsoft 365 and Entra ID Google Workspace AWS CloudTrail or Cognito Our current EDR Firewall or network Convoy Agent on hosts Verify you are human Turnstile Create my free tenant The 14 days start when your first source connects. Before you start ## Fair questions. Is this really self-serve? + Yes. You connect sources and deploy Convoy Agent yourself with the docs. Will Convoy touch my environment during the trial? + Not without you. Response actions start in monitor mode. You promote the ones you want armed. Our operators open "Confirmation needed" cases and ask before anything that isn't reversible. Healthcare. Do we need a BAA for a trial? + Yes, and we sign it before your first source connects. Pick healthcare in the signup and the BAA comes with your tenant link. What happens on day 15? + You tell us. Day 14 is a decision point: continue on a per-identity agreement, or uninstall Convoy Agent with one command. Nothing converts on its own and there is no invoice unless you say so. We're an MSP. Can we trial it for a customer? + Yes. Sign up with the customer's identity count and say so in the company field. Partner terms and multi-tenant access come up in the briefing. --- # Page: Company (https://convoy.security/company) Company Founder-led # We didn't come to add a tool. We came to end the stack. Convoy is one security platform, built and run by the people who wrote it. Our own detection engine, our own agent, our own operators, and one source of truth under all of it. Start free · 14 days Book a briefing Ship's log $ convoy status --company entity Convoy Security, Inc. protected + assets customers healthcare · payments · insurance · manufacturing · real estate agent shipped · full telemetry · EDR mcp every tenant · 100+ tools intel shipped · predictions · scout · actors leadership founder-led · engineer-run heading 000 · nothing moves unseen 90K+ assets protected 2K+ detection rules 100+ MCP tools 99.95% uptime 90K+ assets protected 2K+ detection rules 100+ MCP tools 99.95% uptime The name ## Every vessel covers the ones beside it. The whole formation is watched at once. That's how a convoy moves, and it's how we treat your endpoints, identities, inboxes, firewalls, devices and cloud accounts. Each one covers the others. One team watches all of it. Nothing moves unseen. + Assets protected 1.2K+ Investigation guides, written by us 2K+ Detection rules, mapped to MITRE ATT&CK 1 Platform. One agent. One source of truth. One number on the invoice. What we believe ## Five rules we'd rather lose a deal than break. 01 ### We own the code. The platform, the detection engine and Convoy Agent are ours end to end. When something needs to change, we change it. Nobody's roadmap sits between you and a fix. 02 ### Operators you can see. The people watching your environment work in the same console you do, with the same data. You see their actions in your audit trail the moment they take them. 03 ### Plain answers. If your posture is fine, Cockpit says so. If it isn't, you hear it from us before you think to ask. We don't dress up a score to make a renewal easier. 04 ### Coverage is never a cost decision. You pay per identity protected. Sending us more telemetry makes you safer, so it never costs more. We'd rather you log everything. 05 ### Open to the machines you trust. Every tenant is open over MCP and REST under the same permissions as the console, so the AI tools your team already trusts can operate the platform instead of reading about it. The log ## Where we've been. Where it started ### CyberConvoy A prediction and response platform for companies that can't stop: hospitals, payments, manufacturing, real estate. 2026 ### CyberConvoy becomes Convoy Same team, same customers. One name for one platform. Oct 2026 ### Convoy Agent Our own agent: full telemetry, including EDR, for every customer. Oct 2026 ### MCP on every tenant 100+ tools, so your own AI tools can operate the platform under the console's permissions. Oct 2026 ### Intelligence Predictions, Threat Actors and Threat Intelligence, working from the same source of truth. Nov 2026 ### Hunt Say what you suspect in plain words. Armada writes and runs the queries. Now ### Airspace Agent Detection and Response: every AI agent in the company, who uses it, what it touches and who answers for it. ## Leadership. ### Zisha Twersky Founder and Chief Executive Officer Runs strategy. Finds where security is broken and designs what replaces it. ### Yitz Einhorn Founder and Chief Technology Officer Runs engineering. Turns the ideas others call impossible into systems that ship. Careers ## Build it with us. Real attackers, real customers and a codebase we own top to bottom. Your code ships the week you write it. Engineering Detection Operations Software development Sales Account executives Full name Email Team Engineering Detection Operations Software development Sales Account executives Not sure yet LinkedIn, GitHub or portfolio Tell us about yourself Verify you are human Turnstile Apply ## Bet on the platform, not the patchwork. See it on your own stack in a 30-minute briefing, or come build it with us. Start free · 14 days Book a briefing --- # Page: Contact (https://convoy.security/contact) Contact 30 minutes # Book a briefing. 30 minutes with our team. We walk through Convoy live, map it to what you run today and give you a straight answer on fit and cost. Full name Work email Company Identities to protect Under 1K 1K to 5K 5K to 25K 25K+ What brings you here A briefing on the platform Deploying Convoy Agent Intelligence walkthrough An Airspace briefing for AI agents Becoming an MSP partner What do you run today? Verify you are human Turnstile Request my briefing Other ways in ## Already a customer, or here for something else? ### Support Existing customers reach support from inside the platform, any time. Sign in to the platform 866-826-6869 ### Security reports Found a vulnerability in something we run? We'll fix it and credit you. Read the disclosure policy ### MSP partners Platform, Convoy Agent and operators under one partner agreement. See the partner program ### Careers Apply on the careers form and tell us about yourself. Apply --- # Page: Trust (https://convoy.security/trust) Trust Compliance # Ready for your vendor review. Convoy holds a SOC 2 report and an ISO/IEC 27001 certification, and we're HIPAA compliant. The promises that matter to you are written into the contract. Where we stand SOC 2 Independent audit over a full period ISO/IEC 27001 Certified security management system HIPAA Compliant Questions for your review? Book a briefing → Compliance ### SOC 2 An independent auditor tested how our controls actually worked over a full audit period, not on a single day. Audited ### ISO/IEC 27001 Our information security management system is certified to ISO/IEC 27001. That covers how we find risk, choose controls and keep them working. Certified ### HIPAA Convoy is HIPAA compliant, and we don't store PHI. Compliant Your data ## Some data we never hold. The less we keep, the less there is to lose. A few things never land in Convoy at all. 0 ### PHI stored Convoy doesn't store protected health information. 0 ### Cardholder data stored Convoy doesn't store PCI cardholder data. 1:1 ### Tenant isolation Every customer's data sits in its own tenant, and every request is scoped to it. In the contract ## Commitments you can hold us to. A security vendor with weak controls is just another way in. These are written into our agreements. 99.95% ### Uptime A platform commitment in every agreement. RBAC ### Permissions on every call Role-based access, checked on each request in the console, the API and the MCP server. 100% ### Audited Every response action and rule change is recorded, whether a person, a playbook or one of your own AI tools made it. 2 days ### To acknowledge a report Found a weakness in something we run? Our disclosure program answers within 2 business days. ## Running a vendor review? Book a briefing and we'll answer your team's security questions. Book a briefing Start free · 14 days --- # Page: Security (https://convoy.security/security) Security Disclosure program # Found something? Tell us. We'll fix it and credit you. We're a security company, so we expect to be tested. If you've found a vulnerability in anything Convoy runs, we want to hear about it, and we won't pursue researchers who follow the rules on this page. Report to security@convoy.security Machine-readable: /.well-known/security.txt The policy ## Scope, rules and what to expect. ### In scope *.convoy.security *.convoysecurity.com *.convoysecurity.net The Convoy platform, its REST API and MCP server, served from those domains Convoy Agent ### Out of scope Customer environments and customer data, even when monitored by Convoy Denial of service, spam and social engineering of staff or customers Physical infrastructure Findings from automated scanners with no demonstrated impact ### How to report Email security@convoy.security with steps to reproduce and the impact you observed Stop as soon as you've shown the issue exists. Don't read, change or delete data that isn't yours Give us a reasonable window to fix it before you publish ### What to expect Acknowledgment within 2 business days A named contact and status updates until it's resolved Credit here, with your permission, once it's fixed Compensation based on the severity and impact of the finding Safe harbor: good-faith research under these rules won't be met with legal action from Convoy ## We hold ourselves to the standard we sell. Uptime, tenant isolation, permissions and audit commitments are written into our contracts. See every commitment → See our commitments --- # Post: Why we stopped calling it a SIEM (https://convoy.security/blog/why-we-stopped-calling-it-a-siem) October 2026, Platform. What the category was built for, what it still can't do, and why we picked a different word. A SIEM is a database with a search box and a billing meter. That is not an insult. It is a description of what the category was designed to do in 2005: collect logs, keep them for the auditor, let someone search them later. Everything the industry bolted on afterwards, the correlation rules, the SOAR, the managed service, exists because the thing in the middle was never built to act. We kept the part that matters. Convoy ingests everything you have, keeps it, and lets you search all of it with no per-gigabyte penalty. Then it does the thing a SIEM can't: it treats every alert as the start of a lead, every lead as something a person or a playbook will finish, and every finished lead as a line in one history you can read top to bottom. That last part is why we dropped the word. "SIEM" tells a buyer to expect a console they will stare at. "Platform" tells them to expect an outcome: the attack stopped, the record written, the question answered before they asked it. If your current tool can't close a case, it isn't competing with us. It's feeding us. --- # Post: Built for your AI tools to operate. Not to summarize (https://convoy.security/blog/built-for-your-ai-tools-to-operate) October 2026, MCP. Your AI client gets the same 100+ tools our operators use. Here's how roles and the audit trail keep that safe. Every vendor now has an AI story. Most of them amount to a chat box bolted onto a portal that summarizes what the portal already shows. Useful, occasionally. Not what we mean. Every Convoy tenant is reachable over MCP with 100+ tools: list leads, read a case, run a query, write a rule, isolate a host, lift the isolation. The same tools our operators use, exposed to whatever AI client your engineers already live in. It's the platform itself, not a read-only mirror of it. The objection is obvious and correct: that sounds dangerous. Here is how we made it not dangerous. Every MCP call carries a key that maps to a role, and the role is checked on every call, exactly as it is in the console. And every action lands in the same audit trail whether a person, a playbook or an agent took it, with the actor named. If your assistant does something you didn't want, you see it in the audit trail and tighten the role in a minute. --- # Post: "Confirmation needed": why we ask before we act, and when we don't (https://convoy.security/blog/why-we-ask-before-we-act) September 2026, Operations. When Autopilot acts on its own, when we ask you first, and why a wrong containment counts as an incident too. Look at any Convoy tenant's case list and you'll see the phrase "Confirmation needed" over and over. They are the two most important words on the platform, because they admit something: a lot of what looks like an attack is an admin doing their job at 2 a.m. The rule is simple. When the evidence proves harm is underway, we act. A host talking to a known command server gets isolated by Autopilot in seconds; nobody waits for a reply. When the evidence proves something unusual but can't prove intent, we ask the one person who knows, and we ask with everything attached: who, from where, what they ran, what it touched. The customer answers in a sentence. The case closes with that sentence on it. Why not just act every time? Because disabling the CFO's account during close, or isolating the server that runs payroll, is also an incident. One we would have caused. Precision isn't only about catching the attacker. It's about not becoming one.