# Convoy

> Convoy Security, Inc. is a security platform built on one source of truth. It replaces the SIEM and the tools around it (EDR, SOAR, MDR) with one platform that detects, investigates and responds across endpoints, identities, email, firewalls, IoT and cloud. Armada, Convoy's AI, works the leads; Convoy operators back it up, managed, co-managed or self-managed; and customers' own AI tools can operate it over MCP. Convoy protects 90K+ assets. Slogan: Nothing moves unseen.

Site: https://convoy.security
Updated: 2026-11-11

## Pages

- [Home](https://convoy.security/): overview, the customers who trust Convoy, how Armada works a lead (investigates with Terrain, writes the verdict and the reason, closes the noise, escalates the rest to a person), the Cockpit to try live, what makes Convoy different (Terrain, Posture, Airspace), your own AI tools operating it
- [Platform](https://convoy.security/platform): how it fits together (one source of truth in the middle, every product reading from it), the six product groups (Cockpit, Detect, Respond, Observe, Operate, Intelligence), everything included on day one, what you usually only learn after signing, delivery and security, the production rollout from hour 0 to renewal, and a searchable list of 168 supported vendors
- [Terrain](https://convoy.security/terrain): what the platform knows about your environment (business context, crown jewels with rules before every action, people and exposure groups, normal behavior, known benign patterns, open questions), every fact with a source, a confidence and a date, confirmed by your team, read on every lead, readable by your own AI tools over MCP
- [Posture](https://convoy.security/posture): exposure proof: a live map of breach paths from entry point to crown jewel, each ranked by likelihood, the fewest fixes that close them (some applied by the platform itself), proof that controls work, path drift tracked over time
- [Airspace](https://convoy.security/airspace): Agent Detection and Response (ADR), powered by Convoy Agent: every AI agent in the company on one picture (who uses it, what it can reach, who answers for it), decisions written as plain sentences with a proposed owner and date, a five-test score (Accountable, Decided, Visible, Contained, Guarded) anyone can recompute, evidence per agent from sign-in, Microsoft 365 or Google Workspace, firewall and host telemetry, guardrails set to Watch, Ask first or Stop, and a printable monthly board brief answering the six questions a board asks
- [Hunt](https://convoy.security/hunt): hypothesis-driven hunting with Armada: say what you suspect in plain words or paste a CVE to see what runs the vulnerable build and whether anyone tried it; every query and hit shown, one-click pivots, evidence that travels to the case, a library of repeatable hunts, outcomes on the record
- [Convoy Agent](https://convoy.security/agent): Convoy's own endpoint agent: why it matters, capabilities, an optional EDR, and a side-by-side with a standalone EDR (keep yours, run both and compare, or switch)
- [MCP](https://convoy.security/mcp): the tenant MCP server (100+ tools), getting started in three steps, the tool reference, permissions, REST API and webhooks, and the WebMCP tools on this site
- [Solutions](https://convoy.security/solutions): healthcare, behavioral health and senior care; financial services, payments and insurance; manufacturing, retail and distribution; real estate; MSP partners
- [Partners](https://convoy.security/partners): the MSP partner program: one agreement for platform, Convoy Agent and operators, priced for margin, rollout through your RMM, engineers on call, managed, co-managed or self-managed per customer, partner application form
- [Why Convoy](https://convoy.security/why-convoy): four vendors vs. one, a side-by-side comparison, compare by stack, the pricing model, trust, FAQ
- [Resources](https://convoy.security/resources): From the record (five anonymized real investigations with timelines and decisions) and the latest posts from the blog
- [Blog](https://convoy.security/blog): Signal in the Noise, writing from the people who build Convoy; RSS at /blog/feed.xml
- [Start free](https://convoy.security/start): a free 14-day trial with your own tenant, the full platform, Convoy Agent, an MCP endpoint and operators on hand; the 14 days start when your first source connects
- [Company](https://convoy.security/company): the name, how Convoy works, milestones, leadership, careers (apply on the page)
- [Contact](https://convoy.security/contact): book a 30-minute briefing; support, security reports, MSP partnerships and careers
- [Trust](https://convoy.security/trust): SOC 2 report, ISO/IEC 27001 certification, HIPAA compliant; the data Convoy never holds (no PHI, no cardholder data); contract commitments
- [Security](https://convoy.security/security): security disclosure program: scope, rules, safe harbor, what to expect

## Key facts

- Numbers: 90K+ assets protected, 2K+ detection rules, 100+ MCP tools, 1.2K+ investigation guides written by Convoy.
- Products: Detect (Guard, Leads, Query, Hunt), Respond (Autopilot, Cases, Comms), Observe (Posture, Insights, Assist, Airspace), Operate (Fleet, Convoy Agent), Intelligence (Terrain, Predictions, Threat Actors, Threat Intelligence), with Cockpit reading all of it. Every customer gets everything; there is no premium tier.
- Cockpit: what needs a person, what was handled, what Convoy sees, a risk score from 0 to 100 next to the sector median, telemetry health, MITRE ATT&CK coverage and a queue of decisions waiting on you.
- Insights: the board report, already written. Monthly and quarterly reviews, posture and risk, compliance and coverage reports, written from the customer's own data.
- Detection: 2K+ rules mapped to MITRE ATT&CK, a review ladder, versioning, backtesting, exceptions and allow lists shared across rules, tuning suggestions and custom rules. Every lead closes with a written reason.
- Response actions on day one: disable an Entra ID user, isolate an endpoint, purge a message from every mailbox, stop a process and quarantine a file (where Convoy Agent's EDR is on), open an incident comm. Autopilot playbooks start from a rule, a schedule, a webhook or a click. Comms threads can include outside counsel or an insurer.
- Sources: 150+ vendors, with 168 listed on the Platform page across identity (22), email and collaboration (18), endpoint (22), firewalls and network (42), cloud and SaaS (28), operating systems (14), data and storage (15), IoT (5) and IT tools (2). Examples: Microsoft Entra ID, Okta, Google Workspace, Cisco Duo, Microsoft 365, Proofpoint, Barracuda, Fortinet, SonicWall, Cisco Meraki, HPE Aruba, Juniper, Zscaler, Check Point, AWS CloudTrail, Azure, Google Cloud, Windows, Linux, macOS, Oracle, SAP, Pure Storage, NetApp, Varonis, Digital Watchdog, Zebra, NinjaOne, ScreenConnect, OpenTelemetry, and the major third-party EDRs. Every cloud connects API to API, with nothing to install.
- Convoy Agent: endpoint agent built by Convoy. Collects event logs and inventory; its EDR (prevent, detect, respond on the host) is optional, so customers can keep their current EDR (Convoy can isolate hosts through it), run both and compare, or switch. Included in the agreement.
- Delivery: managed (Convoy operators run it), co-managed (the customer's team works alongside Convoy's with the same data) or self-managed (the customer's team runs it, Convoy operators a request away).
- Pricing model: per identity protected, per month. Convoy Agent included; endpoints and servers included up to a baseline; no ingest meter. Prices are quoted after a briefing.
- Trust and commitments: SOC 2 report and ISO/IEC 27001 certification; HIPAA compliant; Convoy does not store PHI or cardholder data; 99.95% uptime in every agreement; isolated tenants; SSO and role-based access checked on every request; a full audit log of every action by a person, a playbook or an AI tool; vulnerability reports acknowledged within 2 business days.
- Named customers: Omnicare, MedWiz, Recover-Care, Refuah Health, Suffolk Primary Health, Polaris Healthcare, Marquis Home Care, Empire Care Center, CCH Healthcare, Encore Support Services, Sola Payments, Fairmont Insurance Brokers, Fabuwood, The Capital Realty, Global Tech Solutions.

## Blog posts

- [Why we stopped calling it a SIEM](https://convoy.security/blog/why-we-stopped-calling-it-a-siem): What the category was built for, what it still can't do, and why we picked a different word. (Platform, October 2026)
- [Built for your AI tools to operate. Not to summarize](https://convoy.security/blog/built-for-your-ai-tools-to-operate): Your AI client gets the same 100+ tools our operators use. Here's how roles and the audit trail keep that safe. (MCP, October 2026)
- ["Confirmation needed": why we ask before we act, and when we don't](https://convoy.security/blog/why-we-ask-before-we-act): When Autopilot acts on its own, when we ask you first, and why a wrong containment counts as an incident too. (Operations, September 2026)

## For AI agents and engineers

- Tenant MCP server: scoped to each customer's tenant and connected with OAuth or a role-scoped API key from the console. It works with any MCP client. 100+ tools across leads, cases, signals, comms, query, posture, detection rules, automations and response, fleet and users, under the same permissions and audit trail as the console.
- API: the same surfaces over plain HTTP, with OAuth or an API key and the same permissions as the console. The reference is in the console.
- Webhooks: secret-authenticated triggers for Autopilot automations.
- This website exposes WebMCP tools (navigator.modelContext) on every page: convoy_getCompanyOverview, convoy_listProducts, convoy_getProduct, convoy_getAgent, convoy_listIntegrations, convoy_listResponseActions, convoy_listCustomers, convoy_getIndustrySolution, convoy_getPricingModel, convoy_getSecurityCommitments, convoy_getDeveloperAccess, convoy_getFaq, convoy_getBriefingInfo, convoy_readCurrentPage, convoy_navigate, and convoy_requestBriefing (Contact page only; prefills the briefing form, never submits).
- Machine-readable manifest: [mcp.json](https://convoy.security/.well-known/mcp.json) (served at /.well-known/mcp.json)
- Full text for agents: [llms-full.txt](llms-full.txt)

## Contact

- Book a briefing: the Contact page form. A 30-minute live walkthrough mapped to what you run today, with a straight answer on fit and cost.
- Start free: the Start free page. 14 days with the full platform.
- Apply to partner (MSPs): the Partners page form.
- Company: Convoy Security, Inc., a Delaware corporation. Phone 866-826-6869.
- Master Services Agreement: https://convoy.security/legal/msa
- Security disclosure program: https://convoy.security/security (security@convoy.security; /.well-known/security.txt)