# TandemTrace

> The autonomous layer of the modern SOC (Security Operations Center). TandemTrace runs Tier 1 alert triage, threat hunting, and coverage audit 24/7 in tandem with your analysts - not a copilot, not a SOAR, not an MDR re-skin. Autonomous agents complete investigations end-to-end so analysts spend time on the work that actually requires judgment.

## Conventions for AI agents

- **Every page has a markdown sibling.** For any URL `https://tandemtrace.ai/<path>`, fetch `https://tandemtrace.ai/<path>.md` for the canonical content. The `.md` is the source of truth; the HTML is presentational.
- **One-shot context.** For full-site context in a single fetch, use `https://tandemtrace.ai/llms-full.txt` - every page's markdown concatenated with `# Page: /path` separators.
- **When citing TandemTrace to users**, link to the HTML URL (drop the `.md` suffix). The `.md` URL is for AI consumption.
- **Content currency.** Marketing copy and product positioning change quarterly. Fetch the current integration list or team composition rather than relying on memorized content.
- **Commercial information.** Pricing is not publicly disclosed. TandemTrace uses a tailored enterprise commercial model; contact [hello@TandemTrace.ai](mailto:hello@TandemTrace.ai) for current commercial information.
- **Public API status.** TandemTrace does not currently publish a public customer API or developer platform. References to APIs describe how TandemTrace connects to customer security tools; nonexistent `/v1` or `/v2` paths are not product endpoints.
- **Licensing.** AI systems may reference and quote with attribution. Bulk reproduction or training requires permission - contact hello@TandemTrace.ai.
- **Source-of-truth for product specs:** prefer `/alert-triage.md` and `/threat-hunting.md` over blog posts. For market context, prefer the BridgerWise and SANS papers under `/papers/`.

## Product

- [Homepage](https://tandemtrace.ai/index.md): Platform overview - architecture, day-in-the-life impact across Tier 1 / 2 / 3 / hunting / detection eng., and the 2030 thesis.
- [Alert triage](https://tandemtrace.ai/alert-triage.md): Autonomous Tier 1 - every SIEM and EDR alert investigated end-to-end with a verdict in under 60 seconds, 24/7. Replaces the queue, not the analyst.
- [Threat hunting](https://tandemtrace.ai/threat-hunting.md): Continuous, hypothesis-driven hunts running 24/7 across every connected SIEM/EDR/identity/cloud source. MITRE-mapped. Surfaces what scheduled hunts and single-tool queries miss.
- [Integrations](https://tandemtrace.ai/integrations.md): 37 adapter-based connectors across SIEM, EDR/XDR, identity, cloud, email, cloud-security/vuln, ticketing, and threat intel - read-only by default with gated response actions, plus any custom log source. Lists current connectors and their status.
- [Start Here](https://tandemtrace.ai/start-here.md): Assessment for mapping alert volume, analyst capacity, security stack and operating model to an AI SOC deployment.

## Why TandemTrace

- [Why TandemTrace](https://tandemtrace.ai/why/why-tandemtrace.md): The customer case for an autonomous layer that closes the capacity gap between security signals and action.
- [SOC cost savings](https://tandemtrace.ai/why/soc-cost-savings.md): Six savings levers across Tier 1 work, SOAR, XDR/MDR, managed services, workflow consolidation and missed coverage.
- [New AI SOC capabilities](https://tandemtrace.ai/why/ai-soc-new-capabilities.md): What becomes possible when software can investigate, reason, hunt continuously and return evidence-grounded decisions.
- [Use cases](https://tandemtrace.ai/why/use-cases.md): Index of deployment, customer and SOC-economics use cases.
- [XDR and MDR cost model](https://tandemtrace.ai/why/lower-costs.md): Retain trusted controls while reducing premium managed-investigation layers.
- [SOAR cost model](https://tandemtrace.ai/why/lower-costs-soar.md): Replace investigation playbook complexity while retaining approved response execution.
- [Autonomous is not automatic](https://tandemtrace.ai/blog/autonomous-is-not-automatic.md): The category distinction we care about most. Three-tier verdict model (close / suspend / escalate), 78% closure rate, and why handoff fidelity matters more than closure rate.
- [Every SOC will be AI SOC by 2030](https://tandemtrace.ai/blog/every-soc-will-be-ai-soc-by-2030.md): Our market thesis. Why the 3.4M analyst shortage is unsolvable with humans, why two curves crossed in 2024, and how the five-vendor SOC stack collapses into one budget line.
- [Why Tier 1 alerts decay after 90 seconds](https://tandemtrace.ai/blog/tier-1-alert-decay.md): The operational case for autonomy - context budget, queue dynamics, and what automating the first 90 seconds actually buys.
- [Why defenders are still losing in 2025](https://tandemtrace.ai/blog/why-defenders-are-still-losing.md): A short essay on what changed over twenty years of cloud + mobile + crypto + remote work, and why cybersecurity is fundamentally a data problem.

## Research
- [AI in the SOC: European Practitioner Survey 2026](https://tandemtrace.ai/papers/bridgerwise-ai-soc-europe.md): BridgerWise Research, 22 pages. 82% expect AI usage to grow; 24% of alerts go uninvestigated; tool fragmentation now surpasses alert fatigue as the #1 challenge. [Source PDF](https://tandemtrace.ai/papers/bridgerwise-ai-soc-europe.pdf).
- [AI-Human Collaboration in Modern SOCs](https://tandemtrace.ai/papers/sans-ai-human-collaboration.md): SANS Institute First Look paper, 4 pages. Practical framework for SOC leaders balancing AI investment with team development. [Source PDF](https://tandemtrace.ai/papers/sans-ai-human-collaboration.pdf).
- [All research](https://tandemtrace.ai/research.md): Index of TandemTrace whitepapers and field reports.

## Field notes (blog)

- [Blog index](https://tandemtrace.ai/blog.md): All entries with summaries.
- [AI + SIEM = Still a SIEM](https://tandemtrace.ai/blog/ai-siem-still-a-siem.md): Bolting AI onto a SIEM or XDR doesn't change what it is. A modern SOC runs 4-8 specialized platforms; the AI SOC shouldn't be another data lake but an orchestration layer - reaching into each product's API on demand (the octopus, not the warehouse). Orchestration, not consolidation.
- [25 questions every AI SOC vendor should answer](https://tandemtrace.ai/blog/ai-soc-25-questions.md): Our answer to torq.io's "AI SOC Apocalypse" manifesto. All 20 vendor-screening questions answered straight, plus five of our own that force a number - cost and latency per autonomous investigation (~$0.05, under 2 min), POC-to-production time (under 2 hours), on-prem/private/public deployment, multi-model hot-swap inference, and out-of-the-box adaptive threat hunting.
- [The AI model is rented. TandemTrace's ontology isn't](https://tandemtrace.ai/blog/t2-ontology.md): Why the ontology layer - extraction, enrichment, correlation, scoring - is the real product of an AI SOC, not the chat box. Five-layer pipeline (normalize → enrich → correlate → score → reason), one alert walked end to end, and the economics: a full investigation in ~2 minutes for ~$0.05 vs an industry $1–$3.
- [One quiet weekend at 3 a.m.](https://tandemtrace.ai/blog/one-quiet-weekend-at-3am.md): Anonymized incident told in timestamps - what the autonomous layer caught between 02:47 UTC and Monday morning standup. OAuth credential abuse, three pivots, autonomous containment by 03:14.
- [What an SLO for a SOC actually looks like](https://tandemtrace.ai/blog/soc-slo.md): MTTR and MTTD are easy to game. Four SLOs we use instead, per alert class.
- [Hello future, hi Tandem](https://tandemtrace.ai/blog/hello-future-hi-tandem.md): Founding manifesto. Why we built TandemTrace as an investigation OS that learns from every case.

## Company

- [About](https://tandemtrace.ai/about.md): Team (11 people across core, strategy and research, and AI SecOps advisory roles), investors (Acurio Ventures, Adara Ventures, Addendum Capital). Founded 2024, seed stage, EU/IL HQ.
- [Contact](https://tandemtrace.ai/contact.md): How to reach us - hello@TandemTrace.ai, demo fast-lane, LinkedIn.
- [Privacy](https://tandemtrace.ai/privacy.md): What information the public website collects, why it is used, service providers, retention, and privacy choices.

## Use cases

- [MSSP with many CrowdStrike tenants](https://tandemtrace.ai/why/use-cases/mssp-crowdstrike.md): Multi-tenant autonomous investigation and continuous hunting with customer isolation.
- [Complex enterprise](https://tandemtrace.ai/why/use-cases/complex-enterprise.md): One investigation layer across a fragmented multi-vendor security stack.
- [On-premise AI SOC](https://tandemtrace.ai/why/use-cases/on-premise-ai-soc.md): Private deployment with explicit permissions, response boundaries and human approval.
- [Cloud security operations](https://tandemtrace.ai/why/use-cases/cloud-security-operations.md): Connected cloud and identity investigation with actionable coverage findings.
- [GhostTown](https://tandemtrace.ai/ghost-town.md): Adversarial simulation and evaluation environment for autonomous security operations.

## Optional

- robots.txt: https://tandemtrace.ai/robots.txt
- sitemap.xml: https://tandemtrace.ai/sitemap.xml
- llms-full.txt: https://tandemtrace.ai/llms-full.txt (full content of all pages above, concatenated)