Qevlar AI builds an autonomous SOC platform that investigates security alerts the way an experienced analyst would, without playbooks and without adding headcount. It is built for enterprise security operations centres and for the MSSPs and MDR providers that run SOCs on behalf of many clients, and it targets the problems those teams know well: alert overload, analyst burnout and threats that slip through a backlog.
Each investigation ends with a clear malicious or benign verdict, a written report and recommended remediation, so analysts spend their time on decisions rather than on collecting evidence.
At A Glance
| Vendor | Qevlar AI |
|---|---|
| Category | Security operations, autonomous SOC platform |
| Deployment | SaaS hosted in the EU (Belgium) on GCP, or private cloud |
| Agentic AI | Autonomous alert investigation using generative and graph AI |
| Customers | Sodexo, Atos, Orange Cyberdefense, Deloitte, MediaMarkt |
| Certifications | SOC 2 Type 2 |
| Founded | 2023, Paris |
| Market classification | Security Operations |
What Qevlar AI Does
Most SOCs cannot investigate every alert, so real threats wait in the same queue as noise. Qevlar AI takes the first pass itself: it gathers evidence from internal and external sources, reaches a verdict and joins related alerts into a single incident story, while containment stays with the analyst. The daily activity of the SOC feeds back into the system so that it improves with use, and the same intelligence is shared with vulnerability management teams so both focus on the risks that are real. The company reports investigations completed in under 3 minutes and up to 80% of tickets closed automatically.
Products
Autonomous SOC Platform
The platform is a single product that replaces the manual first pass on every alert. Triage, enrichment and investigation happen automatically and around the clock, so the queue does not build up overnight. Every report lists the observables and indicators of compromise found, a step-by-step summary of the reasoning and the remediation actions to take. Analysts review alerts marked malicious, validate the outcome and act on the suggested next steps.
Identity Investigations
Compromised accounts are one of the hardest alert types to work through by hand. For identity alerts, Qevlar AI draws on user authentication logs, access control logs, IAM events, privileged user activity logs and user behaviour analytics. Typical steps include analysing failed logins, reviewing unusual login patterns and checking whether credentials have been compromised.
Network, Cloud And Phishing Investigations
The same engine is tuned for network security, cloud security and phishing alerts. A suspected phishing email, for example, triggers an automatic investigation that ends in a verdict and a remediation plan, rather than waiting for an analyst to open each attachment and link.
MSSP And MDR Operations
Service providers can scale investigations across many client tenants. This lets a provider take on more customers without a matching rise in analysts, and moves staff from repetitive level 2 work towards proactive defence.
How It Works
| Component | What it does |
|---|---|
| Trigger | An investigation begins when a connected SIEM or EDR raises an alert, such as a potential phishing attack. |
| Deployment | Customers choose SaaS or private cloud and keep control of where their data is hosted. The SaaS service runs in the EU, in Belgium, on GCP. |
| Connection | Security tools connect to Qevlar AI through its API, so the platform reads alerts and context from the SIEM, EDR, email, cloud and threat intelligence tools a SOC already runs, without new collectors on endpoints. |
| Orchestration | A proprietary graph-based orchestrator, rather than an LLM agent, directs each investigation so that the reasoning stays “deterministic, evidence-based”. Generative AI and graph AI each have a defined role inside that process, which keeps the path from alert to verdict repeatable. |
| Models | Qevlar AI’s models are explainable, so teams can trace each decision and action for compliance. They are also privacy-preserving, pre-trained on non-customer data. |
Identities And Systems Covered
| Human users | Authentication events, failed and unusual logins, and possible credential compromise |
|---|---|
| Privileged users | Privileged user activity logs and IAM events |
| Endpoints and network | Alerts raised by endpoint and network security tools |
| Cloud environments | Azure, AWS and Google Cloud, plus Entra ID for identity events |
| Phishing and email security alerts |
Integrations
Connectors cover SIEM, EDR, XDR, cloud, email, identity, threat intelligence, sandboxing, network, productivity, SOAR and ticketing tools.
| Area | Integrations |
|---|---|
| SIEM | Microsoft Sentinel, Splunk, QRadar, Google SecOps, Sekoia.io |
| EDR and XDR | CrowdStrike, SentinelOne, Microsoft Defender, Cortex XDR and XSIAM |
| Network and cloud security | Palo Alto Prisma, Netskope, Zscaler |
| Email security | Exchange, Mimecast, Proofpoint |
| Threat intelligence and sandboxing | VirusTotal, AbuseIPDB, Urlscan, Hybrid Analysis, Any.run, Joe Sandbox, Shodan, Nmap |
| Ticketing and SOAR | ServiceNow, TheHive |
Company Background
| Founded | 2023, by Ahmed Achchak and Hamza Sayah |
|---|---|
| Headquarters | Paris, France |
| Leadership | Ahmed Achchak (Co-founder and CEO), Hamza Sayah (Co-founder and CTO), Hakim Jakhjoukh (Chief Revenue Officer) |
| Markets | Customers across EMEA and the US, with a reported 1,500 organisations in production |
| Funding | A reported $14M raised with EQT Ventures & Growth and Forgepoint Capital, followed in 2026 by a new round co-led by Partech and Forgepoint Capital with EQT Ventures and Growth participating |
| Recognition | Orange Cyberdefense Innovation Award, MSP Today Product of the Year 2025 and the Forum InCyber Growth Award |
Note: This overview is compiled from Qevlar AI’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.