(00)Detection & response · for teams without a SOC
Signal reads every one anyway. An AI analyst triages your cloud, identity and endpoint alerts around the clock — and when one is real, hands a human a one-tap fix. The night shift you were never going to hire.
Events read today
2,481,093
31/s · 99.7% closed without waking anyone
(01)On night shift for
A 400-person company throws off about eleven thousand security alerts a month. Roughly eleven of them matter. Signal reads all eleven thousand, argues with itself about the eleven, and wakes a human only when there’s an actual decision to make.
(03)Product
Three verbs, one screen, forty-one seconds. Signal does the reading and the reasoning. You keep the say-so.
signal/halyard-prod/detections
31 ev/s99.7% auto-closed0 escalated
INC-2291 · opened 03:12:15 UTC · 36 related events
Evidence · 5 of 36 events, weighted
Login from Lisbon, PT on her usual MacBook
Login from Singapore, SG on a new device, residential proxy ASN
MFA push approved 2.1 s after six denials — push-fatigue pattern
New OAuth grant to “Drive Sync Pro” asking for mail.read
No travel on her calendar; chat active from Lisbon at 03:05
Verdict
Likely account takeover via MFA fatigue. Recommend containing before 03:15.
Ruled out
Playbook ato-contain · v12 · all actions reversible for 24 h
Contained 41 seconds after the first event. Every action is logged, attributed to you, and reversible for 24 hours.
(04)Incident replay · INC-2291
A real night at a customer, replayed straight from Signal’s audit log. Names changed, timings untouched, zero adjectives added.
$ signal replay INC-2291 --from 03:12:00Z
events read 36human time spent 24 sactions run 3 / 3customer impact none
(05)Capabilities
Six jobs that usually need a room full of people and a lot of coffee. Each tile below is running live, like the product.
Identity
Signal learns where and how each person signs in, then notices when physics gets involved.
Triage
0 alertswaiting on you
alerts read11,204
closed, with reasons11,193
escalated11
Endpoint
98.6%
1,187 of 1,204 reporting
17 asleep. It’s 3 a.m.
Cloud
Not sampled. Every call, every region.
4,812 / min3 regions
Secrets
A leaked key expires before anyone finishes pasting it.
tok_ci_deploy••••••••7f3a
rotated 4 s ago
next rotation in 6 h
Control
Revoke 4 sessions for j.okafor?
confidence 0.94 · reversible for 24 h
(06)Before / after
Medians across 212 customer orgs: the 90 days before onboarding against the 90 days after.
Mean time to detectfirst event → someone knows
Before: 9h 42m
With Signal: 38 seconds
919× faster
Mean time to containfirst event → threat can’t act
Before: 2.6 days
With Signal: 4 minutes 12 seconds
891× faster
Alerts a human readsper week, per org
Before: 1,340
With Signal: 6
−99.6%
Night-time pagesper month, 22:00–07:00 local
Before: 23
With Signal: 2
−91%
Methodology: customer-reported baselines, verified against their own ticketing history where it existed. Jan–Jun 2026, n = 212. We’ll show you the SQL if you ask nicely, and also if you ask rudely.
(07)Integrations
Read-only by default. Signal asks for write access one action at a time, and only for playbooks you switch on. Most teams are fully connected before their first meeting ends.
46integrations
11mmedian setup
0agents to install
“In our first quarter, Signal woke me up twice. Both times it was right, and both times the fix was one tap from done. I’ve started charging my phone in the kitchen.”
Ines AlbuquerqueCISO · Halyard · 840 engineers
312,044alerts read
2pages at night
0incidents past containment
(09)Pricing
Every employee, contractor and service account Signal protects counts once. Laptops, buckets and clusters are free — attackers don’t bill by the server either.
25–250 identities
$7/ identity
/ month
Team tops out at 250 identities
For teams who want someone reading the logs, starting tonight.
100–2,000 identities · most teams
$12/ identity
/ month
≈ $4,800 / mo, billed annually
For orgs where “we’ll look at it Monday” stopped being an answer.
1,000+ identities or regulated
$15/ identity
/ month, from
Usually starts around 1,000 identities
For when the auditor, the board and the insurer all want the same PDF.
Read-only by defaultSOC 2 Type IIYour data stays in your regionMonthly plans cancel any timeNo per-alert surprises, ever
(10)Free threat review
Give us read-only access for 14 days. You get a written report of what’s already happening in your cloud and identity stack — the boring, the weird, and the “wait, how long has that been public?” No agents to install. No sales theatre.