SIRP builds OmniSense, an autonomous security operations (SOC) platform for security teams that are overwhelmed by alerts. The platform investigates alerts, closes cases and passes every proposed action through a governance policy the customer writes, so analysts spend less time on triage and routine decisions.
The problem SIRP addresses is the gap between the alerts a team receives and the cases it can actually finish. Its answer is to let software do the routine investigation and response, while the customer keeps control over which actions may run without a person.
At A Glance
| Vendor | SIRP (SIRP Labs Inc.) |
|---|---|
| Category | Security operations, autonomous SOC platform |
| Deployment | Cloud, on-premises or air-gapped |
| Agentic AI | Specialist AI agents, Sara AI Co-Analyst, policy-gated autonomy |
| Customers | Al Ghurair Group, Purdue Federal Credit Union, OQ, Qatar Red Crescent, Raqami |
| Certifications | SOC 2 Type II; ISO 27001 in progress |
| Market classification | Security Operations |
What SIRP Does
Most SOC teams already have more detections than they can work through. The bottleneck is the work after the alert: the triage, enrichment and basic decisions that tie up analysts until a case can be closed.
OmniSense takes on that work. It gathers telemetry from the tools a customer already runs, builds a graph of context around each event, scores the risk and then either acts or hands the case to a named person, depending on the customer’s policy. A language model does the reasoning, while the rules that decide what may run are enforced in code, separate from the model.
Products
OmniSense
OmniSense is the core platform. It is built around five parts that work together:
| Adaptive Orchestrator | Plans responses and decides which steps need a human |
|---|---|
| OmniSec LLM | The reasoning engine behind each judgement on an event |
| OmniMap + RAG | A knowledge graph of assets, history and the customer environment |
| OmniFlex | Learns from the outcomes the customer’s team confirms |
| OmniCollective | Privacy-preserving learning across OmniSense tenants |
Sara
Analysts who need to understand why the platform reached a conclusion work with Sara, the Co-Analyst inside OmniSense. It explains what OmniSense found, why it recommends a next step and where each piece of evidence came from. Sara has four modes: Global Knowledge, Tenant Assist, Case Co-Analyst, and Threat Research and Hunt, which builds structured HuntPlans. At shift change, case handoffs carry the evidence, earlier work and open questions to the next analyst. A standalone version, Sara Open, can be used without an account. Sara checks the analyst’s role on every message and logs each interaction for audit, customer data is not used to update model weights, and reasoning runs in the OmniSense region that serves the customer’s jurisdiction.
Enterprise SOC
Larger security operations use Enterprise SOC to hand triage, enrichment, classification and summarisation to the platform’s 20 specialist agents, among them the Analysis, Header Analyst, Enrichment, Suggest Playbook and Assign Analyst agents. It adds automated correlation, confidence scoring and containment, and every decision it makes can be traced back to its evidence and policy.
How It Works
The platform runs as one continuous loop of six layers that track the changing state of the environment rather than treating each ticket on its own. It can be deployed in the cloud, on-premises or in air-gapped environments.
| Component | What it does |
|---|---|
| Signal ingestion | Collects telemetry from identity providers, endpoints, cloud, network, SaaS, threat intelligence and existing SIEM, EDR and XDR tools, and normalises it into structured entities. |
| OmniMap | Maps relationships between identities, devices, workloads, access paths and past incidents to estimate the blast radius of an event. |
| OmniSense reasoning | Produces a risk score, a confidence level, the actions that are eligible and an execution decision for each event. |
| Autonomy Gate | Checks each action against customer policy before it runs, using WHEN and THEN rules, for example requiring approval before a given action. |
| Agentic Mesh | Carries out approved actions such as isolating an endpoint, restricting an identity, ending a session or isolating a cloud workload. |
| Decision memory | Records context, actors, actions, outcomes and analyst feedback, and feeds them back into the reasoning layer. |
Integrations
Connections both read and write, so OmniSense can act in a tool as well as collect from it. Customers can build their own connectors with an open integration framework, and those connectors fall under the same policy model.
| Area | Integrations |
|---|---|
| SIEM and security operations | Splunk, Elastic, ArcSight ESM, LogRhythm, Sumo Logic, Wazuh, Devo |
| Endpoint and EDR | CrowdStrike Falcon Host, SentinelOne, Sophos, Trellix, Carbon Black Defense |
| Identity and access | CyberArk, RSA, Thycotic, Google Authenticator, Have I Been Pwned |
| Email and phishing | Proofpoint, Mimecast, Cofense, Barracuda |
| Collaboration and ITSM | ServiceNow, Atlassian, Slack, Gmail, Zendesk |
| Threat intelligence | MISP, Anomali ThreatStream, ThreatQ, VirusTotal, GreyNoise |
| Cloud and network | Amazon, Microsoft, Google, Fortinet, Zscaler, Cloudflare |
Company Background
| Company | SIRP Labs Inc. |
|---|---|
| Offices | Bethesda, Maryland, United States, and London, United Kingdom. |
| Compliance | SOC 2 Type II report available on request. |
Note: This overview is compiled from SIRP’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.