Attack and defend,
reined in by humans.
R·O·D·E·O — Real-Time Observation, Detection, Exploitation & Optimization
RODEO combines offensive and defensive security operations on one platform, powered by a suite of proprietary AI models, with human-in-the-loop governance gating every action.
Offense and defense in one loop
Most tools do one side. R-O-D-E-O runs red and blue on the same platform and the same data, so what the offense finds, the defense learns from immediately.
Find what is exploitable
Offensive tooling scans and validates real-world risk, with proprietary models ranking what matters first.
Turn findings into detections
A finding on the offensive side becomes a Sigma / Suricata / YARA detection on the defensive side without leaving the platform.
Respond, human-gated
Alert triage and approval-gated playbooks act on the new detections. A person signs off before high-impact actions run.
Evidence for every action
Each step is logged and mapped at the control level, so the purple-team loop also produces compliance evidence.
Offense and defense together ship in the full platform. Need defense only? The Blue / SOC edition ships with the offensive tooling absent from the build. Meet the models →
From telemetry to mission outcomes
From telemetry ingestion to mission outcomes — every layer of R-O-D-E-O is purpose-built, modular, and deployable in sovereign environments.
A1 Mission outcomes
Local model weights and a local CVE cache. Telemetry is forced off in production; network egress is enforced at the socket layer.
A pentest finding becomes a Sigma / Suricata / YARA detection inside the same platform — purple team as a loop, not an engagement.
Ten cross-mapped frameworks, 602 resolving cross-references, and an SPRS score kept provisional until a human verifies it.
Low severity auto-approves; medium and above require an analyst. Autonomy is a dial that ships turned down.
A2 Capability stack
Telemetry flows up · control flows down
A3 Deployment
On-premises
Full reasoning with the cable unplugged — local model weights, telemetry forced off in production, and egress enforced at the socket layer.
Capability-gated editions
The Blue/SOC edition ships with the offensive routers absent from the build — not disabled, never registered.
SCADA / OT
The SCADA profile pins critical-severity auto-approval and patch deployment off, with autonomous concurrency capped at three.
Nine profiles
Defense, purple, IR, headless, SCADA, cloud, offense, forensics, RE — each with its own autonomy and auto-approval defaults.
Four things nobody else can say together
Air-gapped operation alone isn't a moat — Palantir, Elastic, and others are there too. The column that's empty for everyone else is control-level compliance, and the row that's full is ours.
Offense and defense, one platform
Everyone else is offense-only or defense-only. A finding on the offensive side becomes a Sigma / Suricata / YARA detection on the defensive side without leaving the platform — purple team as a loop, not an engagement you buy.
Compliance, not a dashboard
Ten frameworks, 138 cross-mapped controls, 800-53B baselines, CMMC practice lineage, and an SPRS scorer that produces the number a contractor actually files.
Reasons without internet
Local model weights and a local CVE cache. The difference between a product that installs without internet and one that reasons without it.
Safety-pinned
ICS watchers and safety handlers, and a SCADA profile that pins critical auto-approval and patch deployment off — in a plant, an automated containment can stop a physical process.
A suite of proprietary, purpose-trained models — severity classifiers, a 285M-parameter exploit generator, and code-reasoning, IR, ICS, forensics, and defense models — runs on local weights inside the perimeter. Autonomy ships turned down: low severity auto-approves, medium and above require an analyst, and eight of nine deployment profiles are semi-autonomous or tighter.
Go deeper
Each part of the platform has its own page: what it does, how it is governed, and how it ships.
Platform
Core capabilities, the two intelligence modes, the radial platform architecture, and the stack underneath.
See the platform →Governance
Human-in-the-loop approval gates and control-level mapping across ten compliance frameworks.
See the controls →Editions
One core, shipped as a defensive-only Blue/SOC edition or the full platform, and who each is built for.
Compare editions →Whitepaper
The autonomous cyber operations blueprint: architecture, compliance, and the engineering roadmap.
Request the whitepaper →Get RODEO updates
Occasional notes on new detections, model releases, and platform updates — written for the people actually running security operations.
We'll reply by email. No spam, unsubscribe any time. Privacy Policy.