Ten modules.
One AI Autonomy Engine.
ARRAC combines AI detection, autonomous containment, phishing defence, DLP monitoring, Windows endpoint protection, and recovery orchestration into a single platform — connected to Microsoft 365, Defender, Azure, and every Windows device in your environment.
Autonomy that is earned.
Not assumed.
Every enterprise security team has the same fear: what if the AI gets it wrong?
ARRAC was designed around that fear. The platform never assumes the right to act autonomously. It earns it — in your environment, against your threats, verified by your team.
ARRAC shows you exactly what it would do and waits for your approval. You see the AI's reasoning before any action is taken. This is where every deployment begins.
ARRAC executes low-risk containment actions automatically while escalating high-impact decisions to your team. You define the boundary.
Full autonomous response within your defined scope. ARRAC acts immediately on threats — and reports every action to your oversight suite in real time.
Maximum autonomy across the entire environment. Only available after a verified 30-day Tier 3 track record. Cannot be skipped. Enforced at the platform level.
You cannot skip tiers. Tier 4 requires a verified 30-day Tier 3 performance record — enforced at the infrastructure level, not configurable by the user.
This is not a setting. It is an architectural guarantee.
Two layers. One platform.
ARRAC separates what the machine does from what your team does — so neither slows the other down.
The machine acts. In seconds. Without waiting.
These modules feed the AI engine in real time and execute containment automatically — with no human in the loop unless you choose one.
- Detects compromised accounts, impossible travel, and anomalous sign-in patterns
- Quarantines malicious emails and revokes access to affected mailboxes automatically
- Blocks OAuth applications and third-party integrations abusing delegated permissions
- Enforces conditional access and disables accounts at the moment of confirmed compromise
- Correlates identity, email, and cloud access signals into a single incident timeline
- Detects misconfigurations in virtual machines, storage accounts, and network security groups
- Identifies lateral movement attempts across Azure compute resources
- Responds to anomalous API calls and privilege escalation in the Azure control plane
- Quarantines compromised VMs by modifying NSG rules automatically
- Correlates infrastructure events with identity signals to surface blast radius
- Detects access to unapproved AI services across M365 and browser activity
- Blocks data submissions to AI applications that violate your data handling policy
- Flags users uploading sensitive files or pasting confidential content into AI tools
- Enforces your approved AI tool list and generates audit evidence for compliance
- Correlates Shadow AI usage with data classification to quantify exposure risk
- Stops ransomware before it spreads — identifies the encrypting process, terminates it, and isolates the device from the network
- Detects suspicious behaviour on the device without signatures or manual rule updates
- Detects and blocks unapproved AI tools running on endpoints
- Prevents sensitive files and clipboard content from being shared with AI applications
- Inventories all installed software and flags risky applications every 24 hours
- Protects itself — tampering attempts are detected and reported immediately
While the AI engine contains the threat in seconds, it simultaneously writes an immutable record into the Strategic Oversight Suite — so your team can review, report, and improve without ever slowing down the line of defence.
Your team commands. At their pace. With full context.
These modules receive the machine's output. They exist for post-incident review, architectural improvement, compliance reporting, and board communication — powered by the AI's findings, not slowed by the response.
ARRAC — AI Rapid Response & Autonomous Containment — is a security platform built for a world where attacks move faster than people can react. The average ransomware attack begins encrypting files within minutes of gaining access; most security teams take far longer than that just to notice. ARRAC closes that gap by detecting, investigating, and containing threats across Microsoft 365 automatically, before a human could open a ticket.
It is not a black box making unsupervised decisions. Every autonomous action stays within boundaries you define, every action is reversible, a human can halt anything in flight, and every decision is logged to an audit trail. ARRAC is built to make a lean security team or MSP feel like a much larger one — not to replace them.
ARRAC ingests security events from Microsoft 365 sign-in logs, Defender for Endpoint, Defender for Office 365, and Microsoft Purview DLP — alongside behavioural signals from the ARRAC agent on every Windows endpoint — correlating signals individual tools miss in isolation.
An AI investigation agent reasons through evidence, maps attack timelines, and identifies blast radius — producing a recommendation before an analyst could finish reading the alert.
ARRAC executes real containment actions through Microsoft Graph and Defender for Endpoint, and through its own agent on the device — killing a ransomware process and isolating the machine from the network — not simulations. Every action is reversible within an action-appropriate window — 30 minutes for session actions, 4 hours for network blocks — and logged to an immutable audit trail.
After containment, ARRAC assesses backups, builds a prioritised restoration plan with RTO and RPO estimates, and walks your team through each recovery step.
Every device. Automatically protected.
The ARRAC agent runs on every Windows device in your environment. It acts on threats immediately — without waiting for a human to notice, investigate, or approve.
Included in all plans. Every ARRAC subscription covers both your Microsoft 365 environment and your Windows endpoints. M365 identity protection and device protection — together, in the same platform price. No add-ons, no separate licence.
Know what is coming before it arrives.
ARRAC surfaces the global threat landscape in real time — active campaigns, known exploited vulnerabilities, and threat actor activity — mapped to your industry and your clients.
Beyond rules and playbooks.
SOAR platforms gave security teams automation. ARRAC gives them intelligence. The difference is not speed — it is reasoning.
| Capability | SIEM | SOAR | MDR | ARRAC |
|---|---|---|---|---|
| Threat detection | Passive alerting | Rule-triggered | Human-monitored | AI-investigated |
| Containment | None | Static playbooks | Human execution | Dynamic AI reasoning |
| Response logic | N/A | Boolean if/then rules — brittle, miss novel threats | Human judgement — 15-30 min SLA | Probabilistic reasoning — adapts to novel threats |
| Rule maintenance | High — manual tuning | Very high — playbook fatigue | N/A | None — no rules to write |
| M365 native | Partial | Via connector | Varies | Native |
| Autonomy model | None | Rules-based | Human-approved | Earned tier model |
| Audit trail | Logs only | Playbook logs | Analyst notes | Immutable AI decision log |
| Deployment | Weeks–months | Weeks–months | Ongoing contract | Under 5 minutes |
Why probabilistic reasoning beats playbooks
A SOAR playbook uses boolean logic: if this IP appears in a threat list and login fails five times in sixty seconds, suspend the account.
Change the IP. Fail four times. Wait seventy seconds. The rule breaks. The threat passes. Your team writes another rule. The cycle continues.
ARRAC does not use rules. It calculates a confidence score across the full behavioural pattern — not individual triggers. It identifies threats it has never seen before, because it reasons about behaviour, not signatures.
No playbook to write. No rules to maintain. No edge cases to patch after the next breach.
Works with the tools
your team already uses.
SIEM event forwarding
PSA / ticketing
Endpoint & firewall
Remote monitoring
Backup & recovery status
Read-only KQL query access
14-day free trial. Connect your Microsoft 365 tenant in under 5 minutes. No credit card required.
Ready to deploy ARRAC?
Connected to Microsoft 365 in under 5 minutes. Works with your existing licences — no additional infrastructure required.