Zeron

1,300+ integrations span EDR, SIEM, cloud, identity, ITSM and vendor APIs, with ZAK agents acting on the stack, for example patching an endpoint through the CrowdStrike API and updating a Jira ticket after a Slack approval. The live agents act on EDR, XDR, SIEM, CSPM, CNAPP, IAM, PAM, SOAR, GRC, vulnerability management and CMDB tools. The platform normalizes about 7.3 million events a day into the OCSF schema and removes 68% of duplicates across tools.

SourceZeron, zeron.one and /platformread 2026-10-05

Agent Builder is a visual workflow editor where teams drag triggers, compose actions and ship governed AI agents in minutes, and engineers can build agents in code with the open source ZAK kit. Either way, the customer designs the flow. Each agent runs a five step loop, observe, reason, decide, act and verify, with policy gates at every stage. In code, an engineer writes the agent's logic and tools, and the platform layer handles policy, audit and saving results to the graph.

SourceZeron, zeron.one, /zak and securezeron.github.io ZAK docsread 2026-10-05

The Security Intelligence Fabric is a graph database of assets, vulnerabilities, risks and vendors, kept separate for each tenant, that ZAK agents read and write to. Normalized findings are stitched to the asset graph, so the graph keeps up with the customer's estate. The fabric runs on Memgraph, and the platform covers more than 250 compliance frameworks. Cyber Navigator's QBER model blends industry, market cap, business line, locations and regulations with technical findings to estimate annual loss.

SourceZeron, securezeron.github.io ZAK docs and zeron.one/platformread 2026-10-05

Policies written in Zeron's DSL can require approval before an action, for example "approve: slack('#sec-ops')", alongside hard guardrails and blast radius limits. The agent waits for that approval before it acts. A policy can set conditions on severity, internet exposure or the change in value at risk, and it can forbid an agent from touching assets with a given tag, such as production databases. Policies can be rolled back instantly, and the Action Ledger records the approvals people give.

SourceZeron, zeron.one/zakread 2026-10-05

Zeron holds ISO/IEC 27001:2022, ISO/IEC 42001, SOC 2 Type II and CSA STAR Level 1, and the platform provides per tenant isolation, SSO/SAML and RBAC. It also holds ISO 9001:2015. Data is encrypted in transit and at rest, customer data is never used to train models, and the platform is aligned to DPDPA, GDPR and DORA.

SourceZeron, zeron.one/platformread 2026-10-05

The Action Ledger is a tamper evident audit trail mapped to SCF, with every step written to it, so every agent decision can be proven after the fact. It is append only, maps each entry to the customer's control frameworks and includes the approvals people give. Every action on the platform also goes to a tamper evident audit log, and agentctl is built to discover, secure and audit agents across the organization, including agents built on other frameworks.

SourceZeron, zeron.one, /zak and /platformread 2026-10-05

The graph persistence ZAK handles is the Security Intelligence Fabric, the knowledge graph the agents retrieve from. Zeron describes no memory that agents keep for themselves from one run to the next. Each run names its tenant, and the graph keeps each tenant's nodes in their own namespace.

SourceZeron, securezeron.github.io ZAK docsread 2026-10-05

Zeron deploys on premises, in the cloud or as a hybrid. The SaaS option runs on Zeron's cloud on AWS or Azure with in region hosting; Zeron handles setup, and customers work through a browser or the API. The on premises option installs on the customer's own servers, and the customer's IT team handles hardware, software and integration. SaaS can be running within hours or days, and on premises within weeks or months. Zeron does not list its regions, but says data is hosted, processed and stored inside the jurisdiction regulators require.

SourceZeron, zeron.one/deployment and /platformread 2026-10-05

Zeron ships named prebuilt ZAK agents with stated jobs, including Conformity (control evidence for SOC 2, ISO 27001, RBI and SEBI CSCRF; audit companion), Interno (CVE triage that opens tickets; threat hunting), Vendor Pulse (third party reassessment) and Cyber Navigator (CVaR and loss curves). In all, six agents run on the platform.

Threat Hunting works on EDR and SIEM data, Vulnerability Triage on vulnerability management and Jira, Vendor Risk Watcher on GRC, Compliance Evidence on GRC and CMDB, Audit Companion on the Action Ledger and its evidence, and CRQ Refresh on SIEM data. Interno scores and ranks new CVEs before it opens tickets, and the Audit Companion answers auditors' questions in plain language.

SourceZeron, zeron.one and /zakread 2026-10-05

Agents subscribe to normalized OCSF events, such as a critical CVE detected or a vendor risk spike, and to schedules, such as a compliance drift check, and they start when one of those arrives. A policy can also fire on a newly created finding, and Agent Builder lets teams drag triggers onto a workflow. Cyber Navigator refreshes value at risk and loss curves whenever telemetry changes.

SourceZeron, zeron.one and /zakread 2026-10-05

Zeron names no model behind the ZAK agents and offers no choice of provider. The agent definition has a reasoning mode field, which sets how the agent reasons, not which model it uses. Customer data is never used to train models.

SourceZeron, securezeron.github.io ZAK docs and zeron.one/platformread 2026-10-05

ZAK is an open source agent development kit (github.com/securezeron/zeron-agent-development-kit) installable as zin-adk from pip and npm and as a Go module, with a CLI (zak init, validate, run) and developer docs, and the platform takes REST, GraphQL and webhook connectors. Engineers mark tool functions with a decorator, and the kit's platform layer supplies a policy engine, an audit logger and an agent executor. SaaS customers can also reach the platform through its API.

SourceZeron, securezeron.github.io ZAK docs and zeron.one/deploymentread 2026-10-05

Policy Studio offers dry runs and version control before anything ships, and zak validate checks agent definitions. Both check policies and configuration. There is no way to test an agent's behavior against scored cases. The last step of each agent loop is a verify step, where the agent checks what its action did, and policies can be rolled back instantly.

SourceZeron, zeron.one/zak and securezeron.github.io ZAK docsread 2026-10-05

Agents act through API integrations, and none operates a browser or desktop. They work on EDR, SIEM, GRC, vulnerability management and ticketing tools through those tools' APIs, such as patching an endpoint through the CrowdStrike API.

SourceZeron, zeron.one and /platformread 2026-10-05