Autonomous SOC analyst that investigates alerts end to end without playbooks

CounterShadow Ltd. was founded in London in 2024 by chief executive Jonathan Zulberg and chief technology officer Tony Masse, and has closed a first investment round of undisclosed size. The company builds AMI, short for Autonomous Machine Intelligence, an AI analyst aimed at the part of SOC work that consumes the most hours and produces the least satisfaction: deciding whether an alert matters. The design choice that distinguishes it is the absence of playbooks. Rather than following a branching script an engineer maintained, AMI reasons about each alert and decides what to check next.

An investigation runs in four stages. AMI ingests the alert and plans an approach, applies context about the organization such as asset ownership and normal behavior, enriches the alert by querying connected tools for supporting evidence, and then issues a verdict with severity and a recommended action. Integrations number more than 100 and cover CrowdStrike, Microsoft Sentinel, Splunk, Palo Alto Networks, and AWS among others, and investigations run in parallel rather than in a queue. The company says a typical investigation completes in around eight minutes. Every step is recorded in a readable evidence package so an analyst can audit the reasoning, and the platform can be deployed in cloud, private cloud, on-premises, or offline environments.