Eleven tools. One portal. AI in every one.
From anti-social-engineering to cloud posture to SOAR — eleven security tools that share one data model, one bill, and one runbook. The Mendicant AI analyst is built into every one.
Truthsayer
Stops the five social-engineering surfaces — email, OAuth consent, lookalike domains, MFA-bombing, and help-desk impersonation — before the click.
- Email & URL detection
- OAuth consent-abuse
- Lookalike domains (CT logs)
- MFA push-bombing circuit breaker
- Help-desk impersonation
- M365 / Google / Slack / Teams
CloudGuard
Cloud-native application protection across AWS, Azure, and GCP — posture, entitlements, containers, IaC, and live attack-path analysis.
- CSPM posture
- CIEM entitlements
- Container & KSPM
- IaC scanning
- Attack-path & blast-radius
- Cloud cost
Sandworm SIEM
SIEM with real-time correlation, UEBA anomaly detection, C2/beaconing detection, ATT&CK coverage, and threat hunting.
- Log correlation
- UEBA baselines
- C2 / beaconing detection
- ATT&CK coverage
- Threat hunting
- Saved searches
Stillsuit
One inline engine: stateful firewall, WAF, IPS, DDoS protection, TLS inspection, and App-ID.
- Stateful firewall
- WAF + managed rulesets
- IPS signatures
- DDoS protection
- TLS inspection
- App-ID & protocol decoders
Sandworm EDR
Cross-platform endpoint detection and response — Rust + eBPF agent, live response, file-integrity monitoring, YARA, and Sigma.
- Rust + eBPF agent
- Live response
- File-integrity monitoring
- YARA & Sigma
- Kernel events
- Windows / macOS / Linux
Sandworm SASE
Secure access service edge in one fabric — ZTNA, SWG, CASB, DLP, FWaaS, RBI, DNS security, and device posture.
- ZTNA
- Secure Web Gateway
- CASB & DLP
- FWaaS
- Remote Browser Isolation
- Device posture & JIT
Sandworm BAS
Continuously attacks your own stack to prove your defenses work — campaigns, purple teaming, detection-gap mapping, and an evasion atlas.
- Attack campaigns
- Purple teaming
- Detection-gap mapping
- Coverage map
- Evasion atlas
- Executive reports
Sandworm SCA
Secures everything you ship — SBOMs, dependency and license risk, CVE watchlists, exploit feeds, blast-radius, and build provenance.
- SBOM & dependency graph
- License policy
- CVE watchlist
- Exploit feed
- Blast-radius
- Build provenance
Sandworm AI Security
Defends the AI you build and run — prompt & output scanning, jailbreak detection, an agent firewall, guardrails, AI-BOM, and red-teaming.
- Prompt & output scanning
- Jailbreak lab
- Agent firewall
- Guardrail tuning
- AI-BOM
- Red-team suite
Sight
Curated, enriched, operationalized intel that feeds every tool — actor and campaign tracking, IoC management, dark-web and brand monitoring, and a sandbox.
- Threat-actor & campaign tracking
- IoC management
- Dark-web monitoring
- Brand monitoring
- Malware sandbox
- Threat hunting
Elm
Closes the loop — case management, a live war room, an evidence vault, playbooks, and an AI runbook generator.
- Case management
- War room
- Evidence vault (chain-of-custody)
- Playbooks & runs
- Runbook generator
- MITRE coverage & SLA
Meet Mendicant
An AI security analyst inside every Sandworm tool — it explains alerts, drafts queries, and recommends response, grounded in your real data. Running on frontier models today, with a from-scratch, sovereign precision-AI engine coming soon.
One portal to run them all
Every tool reports into the Sandworm Portal — unified dashboards, cross-product search, and one-click response across all eleven.