Enterprise

Run it where your workloads run.

Threeum Defense is designed to operate inside your environment — with tenant isolation, configurable autonomy, and an audit trail behind every decision. It adds AI-agent-aware control to your existing security stack; it does not replace it.

Availability. This is an experimental alpha; enterprise engagement is not open yet. You can evaluate the platform today by running the local runtime.

Deployment modes

From a single laptop to an air-gapped estate.

Local

Run the runtime on a workstation or server for development and evaluation.

Private cloud

Operate inside your own VPC or data center, with your keys and your data. AWS self-hosting is documented alongside the local runtime; the infrastructure-as-code is in development and not yet a one-command deploy.

On-prem node

Correlate activity across multiple systems at an edge facility or gateway.

Air-gapped

Fully offline operation where connectivity is restricted; local protection continues.

Augment, don't rip and replace

Your SIEM, EDR, XDR, SOAR, and IAM investments keep working. Threeum Defense adds a decision layer focused on AI agents and coordinated activity, where those systems have gaps.

Specific connectors are part of the platform vision and are not available today. An integration is published only once it is built and verified.

Configurable autonomy

Level 0
Observe only — no actions taken.
Level 1
Recommend actions for a person to approve.
Level 2
Automatically perform low-risk actions.
Level 3
Perform predefined defensive actions.
Level 4
Autonomous response strictly within approved policy.

No unrestricted destructive action. High-impact actions require authorization.

Controls

Built like a security product should be.

Tenant isolation

Data, threat graph, and keys are isolated per tenant.

Policy decides

Deterministic rules authorize actions; model signals inform but never override them.

Audit trail

Observable events and decisions, with reversible registry changes you can inspect.

Least privilege

Roles, key rotation and revocation, and short-lived permissions bound to a single agent identity.

Graceful degradation

If a model or cloud connection fails, the deterministic protections keep running.

Self-host & backup

Container and compose for local operation, with backup and restore documentation.

Evaluate it today.

Start with the local runtime and the operations console. When enterprise engagement opens, your evaluation carries forward.