How Hydra investigates an alert

1. The path of an alert

1. The alert arrives. Your monitoring tools send it to Hydra, or Hydra collects it from them. Hydra stores it under your organisation's own workspace and keeps the full original event, not only a summary.
2. Hydra checks the event. It looks at what the event itself shows, using the built-in patterns described in section 2. This step needs no AI and no network.
3. Hydra gathers context. It links the alert to the machine, user and addresses involved, finds other alerts that share them, and reads what your analysts decided about similar alerts before. If a reputation lookup has been run for the addresses and files involved, Hydra uses its result.
4. An AI model writes the verdict. The model reads everything Hydra gathered and returns one of three verdicts: attack, harmless, or needs a person. It must cite the numbered steps its verdict relies on.
5. Hydra's rules check the model. The rules can overrule the model. Section 3 explains how.
6. Hydra saves the result. The verdict, the evidence score, every step and an audit entry are stored. If the verdict is a likely attack, Hydra can notify the contact you chose and prepare recommended actions for a person to approve.

2. What the built-in checks look for

Hydra has built-in checks. Some recognise attack patterns and some recognise routine activity, so the same kind of event can be cleared as well as flagged. Each check names the technique or the normal activity it recognises, so every point it adds can be explained. Here are eight families, each with a harmless look-alike.

Where these checks apply. Today the built-in checks cover Windows events, as recorded by Sysmon or the Windows security log. For alerts from Okta, AWS, Google Cloud or Linux hosts, Hydra relies on the AI model and the evidence it gathers, because we have not yet written built-in checks for them. We are adding them, and we will say so here when they exist.

3. How the verdict is made

There are three verdicts: attack (a true positive), harmless (a false positive), and needs a person (needs context). The AI model proposes one. Hydra's rules then check it.

• If the event shows a strong attack pattern, the model cannot dismiss it. A model that says "harmless" is overruled and the alert goes to a person.
• If the event matches routine activity and shows no attack pattern, the model's "harmless" is accepted only with evidence cited.
• A verdict with no cited evidence becomes "needs a person". So does any verdict whose citations do not point to real steps.
• If the evidence is thin, a model that says "attack" is not accepted on its own. The verdict becomes "needs a person".
• The AI never sets the evidence score. Hydra calculates it.

If the AI model is unavailable, Hydra does not make up a verdict. The alert waits, and an analyst can press Run investigation.

4. The evidence score

Every verdict has an evidence score from 0 to 100. It measures how much evidence points to an attack. It is not a probability, and a score of 95 does not mean "right 95 times out of 100".

The score starts low and adds up evidence. It rises when the event itself shows attack patterns, when other alerts on the same machine or user agree, and when a reputation lookup flags an address or file. It falls when the event matches routine activity, or when your analysts have often called this alert harmless. Each factor is listed beside the score, so you can see why it is what it is.

On its own, what the event shows can lift the score to at most 80. Going higher needs something outside the event to agree. That is deliberate: the score that could ever allow an action without a person is set high on purpose.

5. Actions and approvals

Hydra can recommend isolating a computer, disabling an account, resetting a user's sessions, blocking an address, or revoking a cloud access key. It does this through Microsoft Defender, CrowdStrike, Microsoft Entra ID, Okta, Google Workspace, Palo Alto Networks and AWS, depending on where the alert came from.

• A person approves each one. Only people with the manager, admin or owner role can approve. Analysts and viewers cannot.
• Advice-only today. Hydra does not run any of these actions yet. It records the approval, and your team carries it out in your own tools.
• A kill switch stops every action at once.
• Most actions can be undone, and the undo is recorded too.
• Every decision is logged in an audit trail in which a changed or deleted entry can be detected.
• An optional setting can let one kind of action run without a person, but only above a very high evidence score. It is off by default and we do not turn it on in evaluations.

6. What else an analyst can do

• Ask questions about an alert in a chat. The assistant is told to rely on the alert's evidence and never to claim that an action was taken.
• Produce an incident report from an alert, review it, and export it as a PDF.
• Mark a verdict agree or disagree. Those marks feed how often Hydra's calls match your analysts' calls, and the false-positive rate it uses next time.

7. Where your data goes

Hydra is hosted by us on Google Cloud in Iowa, in the United States. When model processing is enabled, we run an open model ourselves in that environment. We do not use Vertex AI or send alerts to another hosted model provider, and we do not train models on your data. Hydra reads alert details, not file contents, email contents, passwords or payment card data. The full list of providers is on our Security page.

8. What Hydra does not do yet

• The built-in checks cover Windows events only.
• While it investigates, Hydra does not run new queries against your own tools. It works from the alert and from what it has stored.
• Hydra does not run reputation lookups on its own yet. An analyst can run one, and Hydra then uses the result.
• Our latest lab test used Qwen3.8-27B with engine v2 on 277 recorded cases. Engine v2 is not enabled in production; the program-evidence result is an upper bound, not a production estimate. Read it in full.
• We have no customers yet.
• We do not offer on-premises or air-gapped deployment. We host Hydra.
• Today we do not run your security monitoring. Your analysts do. Running it for you as a licensed service is the plan, and it waits for our licence.

9. What we are working on next

These are plans, not features, and we are not giving dates.

• Read-only questions to your own tools during an investigation, inside limits you set.
• Keeping the full evidence behind each step, not only a summary of it.
• Built-in checks for identity and cloud alerts.
• Scheduled threat hunts.
• An operated service: once we hold our licence, we plan to run Hydra for you, with our analysts handling the alerts that need a person.

Talk to us about an evaluation

Last reviewed: 21 October 2026 by Samuel Maclar.