Company: e2e-assure
Founder and CEO: Rob Demain
Website: http://www.e2e-assure.com
About e2e-assure
We are the UK’s only 100% sovereign AI Agentic SOC connecting IT and OT security. That sees us specialise in servicing organisations deemed critical to the national interest, from utility and telecom providers to data centres as well as leading manufacturers, retailers and defence organisations. For these CNI organisations, a cyber incident can prove so disruptive it can threaten the very economic stability of the UK.
Sovereignty, or the ability to retain control, ownership and governance over the estate, is now a number one priority for these businesses. That is a significant challenge given that cybersecurity is now utilising AI, potentially leading to dependency on external models owned by foreign powers. It’s for this reason that we have spent the past year developing a UK sovereign AI-native platform, Cumulo, that underpins our Security Operations Centre services.
We took a long hard look at how the traditional SOC operates – it’s human-led, alert-driven and reactive in nature – and decided to reinvent it. Even when AI is used in the SOC it’s typically after the alert has been generated for triage, summarisation, correlation and to provide recommendations to the analyst. That sees it acting after the fact and dependent upon the data collected by detection rules.
We reasoned that if we could instead make AI run upfront, in parallel with the Security Incident and Event Management (SIEM) platform, we could provide it with raw telemetry and it could act on the event data itself. Doing that then allows the AI to build context continuously as the data is generated.
To ensure sovereignty, we designed Cumulo to use a layered AI architecture that separates sensitive operational reasoning from broader intelligence and research capability. A local model layer handles environment-specific detection and analysis, a security intelligence layer aggregates and correlates threat data at scale, and a frontier model layer non-sensitive enrichment and broader analytical tasks. While to address rising alert volumes, we built in multiple AI models that cross-check every investigation from different perspectives, known as the Cumulo Analyst Helper (CAH), with an anti-hallucination layer to validate findings against threat intelligence and deterministic detection engines.
Redesigning the architecture in these ways has opened up a new world of possibilities. CNI organisations can use Cumulo to create a digital twin of their IT/OT networks, for instance, paving the way for safe attack simulation and the identification of risks before exploitation. This is particularly useful given that live testing is often impractical or carries unacceptable operational risk in IT/OT environments.
But perhaps most exciting of all is that Cumulo enables the SOC to become proactive and even predictive in nature. Placing AI upfront means live/new threat intelligence can be applied immediately as detection rules. This allows us to provide early identification of threats and vulnerabilities, preventing incidents from occurring and effectively eliminating the risk from emerging threats such as zero-day attacks. So we haven’t just re-engineered the SOC, we’ve invented a whole new beast – the Zero Day SOC which could prove a gamechanger in UK national defence.
Want to find out what TechRound can do for your business?
