Strike48

Strike48 is an agentic orchestration platform for security and IT teams. It runs AI agents across a customer's existing security and IT tools to triage alerts, investigate incidents, hunt threats, and resolve incidents, with human approval gates on actions. The platform's backend, Prospector Studio, handles agent orchestration, workflows, job routing, and a GraphQL API.

Audience

Security operations center (SOC) analysts at levels 1 and 2 and SOC managers, detection engineers, managed security service providers (MSSPs), IT operations teams handling incident routing, and developers building custom connectors. The vendor also offers tools for penetration testers and red teams.

Key Capabilities

• Agents: The vendor names a SOC Level 1 Agent for initial triage, a SOC Level 2 Agent for deeper analysis and enrichment, a SOC Manager Agent that coordinates workflows and prioritizes incidents, an Alert Triage Agent, a Phishing Detection Agent, a Cyber Advisory Monitor Agent, and an Incident Response Agent for IT incidents. An Agent Creation Assistant helps users build their own. Agent names differ between pages.
• Context for agents: Knowledge bases in which documents are chunked and embedded in a pgvector database for retrieval-augmented generation, plus custom tools, personas, and integrations. Agents can query data in place, for example in Splunk with its native query language, or collect it into the platform's native log store.
• Tools and integration: Agents act through the Model Context Protocol (MCP). The documentation lists a catalog of 19 integrations: Splunk, Splunk Enterprise Security, Devo Alerts, Cribl, CrowdStrike Falcon, Freshservice, Jira, Microsoft Graph, Rapid7 InsightVM, Orca Security, Abnormal Security, Darktrace, VirusTotal, Joe Security Sandbox, CVE Lookup, ARIN Whois, DNS, Slack, and GitHub. The site's logo strip also shows AWS Bedrock, Elastic, AWS S3, Cloudflare, and ServiceNow.
• Workflows: A visual builder with container, Python, SQL, and large language model task types, conditional branching, approval gates, artifacts passed between steps, and real-time execution monitoring. Workflows start from prompts, schedules, or external events such as alerts, new vulnerabilities, and webhooks. The vendor describes deterministic agents that follow defined procedures and cognitive agents that reason over context.
• Human oversight: Approval gates in workflows and configurable oversight on the on-premises appliance. The documentation page that covers the configuration itself, the Workflows guide, was not read.
• Audit: The pages state that all operations are audit-logged. The sources describe no tamper evidence or independent verification of the log.
• Architecture: Connectors run as separate processes that talk to the backend over gRPC with mutual TLS. Users authenticate through OpenID Connect and OAuth 2.0, and role-based access control authorizes jobs. A desktop shell, StrikeHub, hosts connectors in one window, and an SDK for Rust builds custom connectors.
• Models: The vendor states that the platform supports LLM providers including Claude, with native AWS Bedrock integration. On the on-premises appliance, models are loaded on the box and run on a local GPU, and the vendor states that no external API calls are made. It states that the platform uses pre-trained models and applies only in-context learning and retrieval, and not training on customer data.
• Deployment: The vendor lists shared software as a service, isolated compute, private cloud, an on-premises appliance on dedicated hardware or a soft appliance on the customer's cluster, and air-gapped operation. It states that go-live takes minutes for the hosted options and weeks on-premises.
• Security: The trust page displays SOC 2 Type 2, SOC 3, and GDPR badges. The vendor states multi-tenant isolation with per-tenant namespaces, TLS 1.3 at the edge, and AES-256-GCM encryption inside its boundary.
• Other products: KubeStudio, a Kubernetes dashboard, and Pick, a headless penetration testing toolkit, are listed as free. StrikeKit is a red-team engagement workstation.
• Pricing: I found no pricing page. The platform page marks deployment options with relative cost markers and says to request a demo.

The vendor states that Strike48 is a product brand from Devo, that the platform builds on 15 years of Devo's log analytics, and that it is headquartered in Boston, Massachusetts.

The Taxonomic Note

Primary category: AI SOC Analyst (ai-soc-analyst, 6a7c9657141d93f8570609f3)
Secondary categories: Security Orchestration, Automation and Response (SOAR) (security-orchestration-automation-and-response-soar, 5f0604517372120038a5c8e5); Agentic Workflow Orchestration (agentic-workflow-orchestration, 6a4ffbd18bddf13ef92816b3)

Candidates held pending evidence: Threat Hunting (threat-hunting, 627973723795de003b7380b8); Incident Response (incident-response, 5a768def5f3f1f0012e20bae); Security Information and Event Management (SIEM) (security-information-event-management-siem, 559b0d3284cb8c1300e61a83)