NEXUSThe Agentic SOC Request a demo
The Agentic SOC

Welcome to the Nexus.

An AI SOC analyst for every client. Nexus validates each alert with the client's own rules and evidence, decides, and notifies the right person on the right channel until someone confirms. Around the clock, with the same method on every case.

Request a demo Become a partner
Built and run in production by Devel Security's regional SOC in Latin America
55AI SOC agents deployed, one per client
15phases on every single case
4SIEM platforms in operation
50×less noise after AI aggregation
Figures from Devel Security's production SOC, October 2026.

Today, one attack can multiply into a thousand.
So can we.

Attackers already use AI to scale. Nexus answers with a team of AI analysts that never get tired, never skip a step, and always hand the hard calls to a person.

The traditional SOC

Your analysts can't scale the way alerts do.

+350

cases waiting to be escalated in a single 24-hour window at our own SOC (October 10, 2026).

24/7

Alerts don't keep office hours, weekends or holidays. People do.

15

steps a good analyst should follow on every case. Under pressure, steps get skipped.

Alert fatigueCases waiting hoursDifferent criteria every shiftNotifications that arrive late
How it works

From alert to action, automatically.

Four systems, one flow. Your SIEMs keep doing their job. Nexus adds the analyst layer on top, read-only, and keeps people where judgment matters.

BIFROSTFull observability over every worker and pipeline. Finds the failure and proposes the fix; a person approves it.
LIASovereign AI that runs inside Devel's infrastructure. Client data is not sent to public AI services.

HEIMDALL + ODIN → NEXUS = full observability in BIFROST

The platform

Real screens from a working SOC.

Your SOC team

One agent per client, with a name and a memory.

Portrait of Valeria, Nexus SOC Operator
SOC Operator

Meet Valeria.

She takes every case that needs to escalate, checks it against your rules and history, decides, and makes sure the right person hears about it.

55 agents in operation, each dedicated to a single client

Knows her client

Policies, assets, networks, identities and the contact matrix.

Remembers

Daily and long-term memory of past cases and approved false-positive patterns.

Uses tools

Queries SIEM events, threat intelligence and MCP servers when she doubts a verdict.

Never tires

Works 24/7 with the same method on every case, every shift.

Understand

  1. 01Take the case
  2. 02Review the client's rules
  3. 03Review the client's context
  4. 04Search memory
  5. 05Load best practices and SOC criteria

Decide

  1. 06Analyze the incident and its verdict
  2. 07Validate with tools
  3. 08Record any verdict change, with the reason

Notify & close

  1. 09Check who must be notified
  2. 10Write the message for each channel
  3. 11Send the notifications
  4. 12Hold the case for confirmation
  5. 13Start the escalation SLA
  6. 14Wait for confirmation
  7. 15Close the confirmed case
Escalation

Notifies until someone confirms.

EmailWhatsAppSMSVoice callTeams
LEVEL 1Analyst on shift
LEVEL 2Supervisor
LEVEL 3General supervisor, then the client's own contact matrix

Confirming stops the escalation. Every message is logged with time, channel and status.

Human-on-the-loop

People decide when there's doubt.

When the evidence isn't enough, the agent stops and hands the case to a person with her reasoning. Deciding takes one click.

A quality analyst grades each decision. Every correction becomes a best practice for that agent, and SOC-wide criteria apply to all of them.

Managers get end-to-end SLA times, shift summaries and a daily report without asking.

Powered by LIA

Sovereign AI, running in-house.

Triage, threat hunting, case validation, message drafting and fault analysis all use language models hosted by Devel. No client event is sent to a public AI cloud, and model versions and prompts are controlled from the console, so a provider change never alters your verdicts overnight.

LIA, Devel's sovereign AI
Security by design

Limits the AI can't skip.

Read-only on your SIEM

Connectors query. They never run response actions or change client configuration.

Local AI by default

Every case is analyzed by LIA inside Devel's infrastructure.

One agent, one client

An agent can't request another client's data.

Test mode by default

New agents work real cases, but their notifications reach only a designated analyst until enabled.

Roles and audit

Admin, operator, technician and quality roles. Every change is logged.

A person approves fixes

BIFROST proposes corrections; nothing runs without approval, and failed fixes roll back.

Who it's for

Run it, buy it, or resell it.

MSSPs & SOC providers

Add an AI analyst layer to your SOC.

  • One Nexus agent per customer, on top of the SIEMs you already run
  • Your brand on the agents and the client portal
  • Escalation matrix and SLAs per customer
Talk to us
Enterprises & banks

Get the Agentic SOC as a managed service.

  • Operated 24/7 by Devel Security's regional SOC
  • Your own agent, your rules, your contacts
  • Built for regulated industries
Request a demo
Partners & resellers

Resell Nexus in your market.

  • Margin on every contract you bring
  • Sales and technical enablement
  • Demo environment and co-branded material
See the program
Partner program

Three ways to partner.

Start by referring opportunities, grow into reselling, or run Nexus under your own brand.

ReferralBring the opportunityResellerSell and own the accountMSSP / White-labelOperate it as your service
Referral fee or resale margin✓✓✓
Deal registration✓✓✓
Sales engineering support from Devel✓✓✓
Demo environment–✓✓
Technical enablement and certification–✓✓
Co-branded marketing kit–✓✓
Your brand on agents and client portal––✓
Admin console for your own customers––✓
Dedicated tenant––✓
Deployment

Managed

Runs on Devel's sovereign infrastructure and is operated by our SOC.

Deployment

Dedicated

A single-tenant instance for an MSSP or a large enterprise.

Deployment

Private

Inside your own infrastructure, evaluated project by project.

Live todayFortiSIEMCortex XSIAM / XDRIBM QRadarWazuhMicrosoft SentinelNextElasticOpenSearch
Platform tour

See the whole flow in two minutes.

Questions

Before you ask.

Does Nexus change anything in my SIEM?

No. Nexus reads from HEIMDALL and ODIN, and their connectors to your SIEM are read-only. Nothing writes to the SIEM or runs response actions on its own.

Where does the AI run?

On LIA, Devel's sovereign AI, hosted in Devel's own infrastructure. Client events are not sent to public AI services.

What happens when an agent isn't sure?

She stops and passes the case to a person with her reasoning. Deciding takes one click, and the case continues its flow. An optional second model can review with the SOC's criteria; when in doubt, it escalates.

Which SIEMs are supported?

FortiSIEM, Cortex XSIAM / XDR, IBM QRadar, Wazuh and Microsoft Sentinel are in operation. Elastic and OpenSearch are in preparation. One agent can read several SIEMs for the same client.

How fast can a new client be onboarded?

A new agent is configured from a single form in minutes: client, name, data sources, notifications and work mode. Integration time depends on the SIEM and the client's contact matrix.

Can I offer Nexus under my own brand?

Yes, through the MSSP / white-label tier: your brand on the agents and the client portal, with your own admin console and a dedicated tenant.

Get started

Step into the Nexus.

Tell us whether you run a SOC, need one, or want to resell one. Requests go through Red Halo, and we'll set up a demo with real cases.

Sales contact: [email protected]

Request a demo Become a partner