01
Panorama
Where every shift starts: workspace indicators, a security digest and the cases that need attention. Every figure opens the operational view with the same filters, so the numbers always add up.
Learn more: PanoramaKalkar product · Cybersecurity
Atalaya: all your security, from a single vantage point.
An AI-assisted security operations platform. It unifies events, incidents, vulnerabilities, assets and threat intelligence, investigates with specialised agents and automates response with human control and full traceability.
The problem
Too many tools. Too many alerts. Too little real visibility.
Security data is scattered across SIEM, MDR, vulnerability scanners, ITSM and intelligence feeds.
Analysts lose time rebuilding context by hand, jumping from console to console.
Metrics don’t match across tools and nobody knows what coverage they really have.
A closed ticket doesn’t prove the problem is actually fixed.
The solution
Unify, investigate, automate and verify.
Unify
One common data model for events, cases, assets, software, vulnerabilities and intelligence, always keeping the link to the original source.
Investigate
A 360º case file and specialised AI agents that summarise, correlate and recommend.
Automate
A visual workflow builder with triggers, agents, conditions, approvals and actions.
Verify
Every data point with its provenance, every action audited, every automation under control and approval.
Platform tour
From signal to verified decision.
02
Case file
The whole investigation in one place: evidence, indicators, sources, correlated events, tickets, MITRE ATT&CK, playbook and response. Confirmed facts are always kept apart from hypotheses.
Learn more: Case file 03
Vulnerability Center
Exposure by CVE, QID, software or asset, with trends and comparisons across subsidiaries. Prioritisation weighs real exposure, not just technical severity.
Learn more: Vulnerability Center 04
Atalaya Brain
An assistant that understands what you are looking at and coordinates specialised agents. Every answer shows which agents took part, which sources they used and what is awaiting approval.
Learn more: Atalaya Brain 05
Atalaya Flows
Turn your procedures into executable processes with a visual builder: triggers, searches, agents, conditions, human approvals and outputs.
Learn more: Atalaya Flows 06
Exposure Map
Interactive graphs connecting assets, software, vulnerabilities, events and cases, telling documented relationships apart from inferred ones.
Learn more: Exposure MapWhat sets it apart
What makes Atalaya different.
AI advises, people decide.
Agents suggest correlations and actions, but never change operational data or run sensitive actions without going through policy and approval.
“Accepted” is not “done”.
Atalaya tells apart an accepted request, a simulated action, an action awaiting approval and an execution confirmed by the external system.
Empty is not the same as safe.
When a search finds nothing, Atalaya shows which sources were queried and what coverage was reached, so “no results” is never mistaken for “no risk”.
Provenance on every data point.
Every figure links to the records behind it and to the source tool.
Workspaces with real boundaries.
Isolation by subsidiary, site, country or source is enforced in the backend, not just by hiding buttons.
AI transparency.
Every answer shows which agents took part, which sources were queried, which steps failed and which conclusions are inferred.
Who it is for
The same data, four ways of working.
SOC analyst
Daily prioritisation, event and case investigation, assisted correlation and guided response.
- Panorama
- Events
- Case file
- Response
Vulnerability manager
Exposure by CVE, QID or software, remediation metrics and comparisons across subsidiaries.
- Vulnerability Center
- Assets
- Metrics
- Report
CISO and leadership
Executive summaries, trends and aggregated exposure without losing access to the evidence.
- Executive summary
- Trends
- Evidence
Platform administrator
Workspaces, permissions, connectors, ingestion and audit.
- Connectors
- Workspaces
- Permissions
- Audit
Integrations
It connects to your security ecosystem.
A decoupled connector architecture: adding a new source doesn’t mean rebuilding the views.
ITSM and ticketing
- Jira
- ServiceNow
SIEM, detection and response
- Microsoft Sentinel
- Microsoft Defender
- ReliaQuest GreyMatter (MDR/XDR)
Vulnerabilities and assets
- Qualys VMDR
- Snow Atlas
- Corporate CMDBs
External surface and validation
- Hadrian
- Pentera (on the roadmap)
Identity and cloud
- Microsoft Entra ID
- Microsoft Azure
Awareness
- KnowBe4
Threat intelligence
- VirusTotal
- RSS feeds
- Web search
- Indicator enrichment
Outputs
- Slack
- Webhooks
- JSON
The brands mentioned belong to their respective holders. Connector availability depends on the version and the deployment.
Architecture
A common model at the centre, the original source always at hand.
A modern web frontend, a services backend and a relational database with schemas separated by responsibility: operations, privacy, intelligence, authorisation, audit and analytical projections. Deployable in the customer’s own cloud (Microsoft Azure) with secrets management, private networking and corporate authentication.
Sources
SIEM / MDR
Vulnerabilities
ITSM
Intelligence
Connectors
Common data model
Operational modules
Atalaya Brain
Atalaya Flows
Users per workspace
Audit log
Security and compliance
Designed to operate on sensitive data.
Access control
Roles and permissions per workspace, enforced in the backend.
Full audit trail
Who did what, when and with what result, including agents and workflows.
Privacy by design
Pseudonymisation and personal data kept in a restricted-access vault.
Regulatory alignment
Designed to make alignment with ENS, NIS2 and GDPR easier.
FAQ
What people usually ask us about Atalaya.
Does Atalaya replace my SIEM or MDR?
No. Atalaya unifies and orchestrates them: it builds on your current tools and adds context, investigation and automation on top.
Can the AI take actions on its own?
Only those the policy allows and, for sensitive actions, always with a recorded human approval.
Where is the data hosted?
On the cloud infrastructure agreed with you, preferably the customer’s own (Microsoft Azure), with secrets management and private networking.
Can I separate data by subsidiary or site?
Yes, with workspaces and data scopes enforced in the backend: each person sees only what they should, including in the assistant’s history.
Can we build our own dashboards?
Yes, with Atalaya Studio: you describe them in natural language and they are reviewed before publishing, always respecting workspace permissions.
What happens if a connector fails?
The interface says so (partial, stale or no coverage) instead of showing a misleading empty result.
How is remediation measured?
With metrics that separate what is currently fixed from what was fixed in a period. Technical validation of closure (Proof-of-Fix) is on the roadmap.
Is it available to public administrations?
Yes. Atalaya can be deployed on the infrastructure the public body chooses and is offered for pilots and tenders. See the public sector page.
Do I need to change my current tools?
No. Decoupled connectors let you start with the sources you already have and add more without rebuilding the views.
Want to see Atalaya with your own use cases?
We walk you through the platform with scenarios close to your organisation’s and look together at how it would fit your current tools.