7AI

Ingests alerts from the customer's existing stack across endpoint, identity, cloud, email, network, and threat intelligence, with named sources including CrowdStrike, SentinelOne, Microsoft Defender, Microsoft Sentinel, AWS, Splunk, and Wiz, and acts back through those tools with built in response actions to isolate hosts, revoke sessions, reset passwords, and quarantine files.

Source7ai.com/platform and platform/responseread 2026-08-30

The platform runs the security operations lifecycle as one system (detect, investigate, respond, hunt), and Response adds a visual Workflow Designer where customers compose multi-step response with If / Else, Switch and For Each branching, wait-for-approval steps, versioning, publishing and a full execution history, with workflows triggered the moment an investigation completes or a case changes. The swarming description cited in August is no longer on the platform page; the grade rests on the workflow engine and the lifecycle loop.

Source7ai.com/platform and platform/responseread 2026-09-29

Enterprise Insights builds a customer context graph applied to every case, Skills let teams encode their own environment knowledge and tradecraft as reference documents and checklists that agents follow, and Federated SIEM queries the customer's security data where it lives; agents enrich each alert from this grounding plus threat intelligence.

Source7ai.com/platform/enterprise-insights, platform/skills, platform/federated-siemread 2026-08-30

Response ships explicit approval gates: 7AI proposes the exact containment actions and the customer approves what executes, with pre approved steps, humans on the loop as the stated operating model, workflow branching that can wait for approval, and every action recorded in an audit log.

Source7ai.com/platform/response and platform/investigationsread 2026-08-30

Security page documents a completed SOC 2 Type II audit covering the AICPA security and confidentiality categories, conducted by named auditor Decrypt Compliance, with need to know access limits and regular systems testing; the report is confidential on request and no trust center, published pen test, SSO, or RBAC documentation was found.

Source7ai.com/securityread 2026-08-30

The agentic report opens every investigation step to show each agent's mission, the tools it ran, the exact request and response, and why it concluded what it did, with each finding mapped to its artifact, an entity graph for pivoting, and a full audit log on every remediation action; reconstructing the why, not only the what.

Source7ai.com/platform/investigations and platform/responseread 2026-08-30

Cases persist from open through closed with full context and the Enterprise Insights context graph is applied to every case, while the agentic flywheel feeds response and hunt outcomes back into detection; this is case and environment state rather than a documented agent memory layer.

Source7ai.com/platform and platform/enterprise-insightsread 2026-08-30

Delivered as SaaS at app.sevenai.com with AWS Marketplace procurement; Federated SIEM queries the customer's security data where it already lives rather than centralizing it, but no self host, VPC, or region selection is documented on the site or the security page.

Source7ai.com/platform/federated-siem and 7ai.com/securityread 2026-08-30

A library of more than sixty purpose built domain specialized agents across endpoint, identity, cloud, email, and network, plus a Skills library of reusable investigation and hunting strategies that can be toggled on or off and that 7AI also generates from the customer's environment, and runbooks codifying procedures for common incident types.

Source7ai.com/platform/skills and platform/responseread 2026-08-30

Alert driven autonomous invocation on every alert from every connected source across endpoint, identity, cloud, email, network, and threat intelligence, around the clock, plus workflows triggered by investigation completion or case state change and threat intel driven hunts.

Source7ai.com/platform and platform/responseread 2026-08-30

The vendor's own glossary defines a 7AI agent as consisting of a cloud based LLM, a mission, and tools, confirming LLM use but naming no provider and describing no routing; under the model axis floor an undisclosed provider is N.

Source7ai.com/glossaryread 2026-08-30

The build on 7AI motion is Skills, plain markdown investigation strategies with relevance rules, and custom response Workflows composed in a visual designer with no scripting; both are in product configuration surfaces, and no public API, SDK, webhooks, or MCP server is documented anywhere on the site.

Source7ai.com/platform/skills and platform/responseread 2026-08-30

The platform surfaces detection tuning recommendations for review, scores ATT&CK coverage, and Security Posture scores the customer's posture against frameworks, and skills can be kept as drafts before publishing; these tune the customer's detection estate rather than providing agent testing, debugging, or evaluation tooling.

Source7ai.com/platform and platform/security-postureread 2026-08-30

Agents act through API level integrations with the customer's existing endpoint, identity, email, and cloud tools rather than operating software through a browser; no browser or computer use capability is documented on any platform page.

Source7ai.com/platform/responseread 2026-08-30