An AI SOC that runs on US-hosted GPUs you control.
SOC, SIEM integration, GRC and threat intelligence in one multi-tenant platform. AI agents triage every alert on Nimbo GPUs in your region, so your logs never leave for a third-party AI provider.
Every alert gets an analyst. Most of them are AI.
Raw events flow through a layered agent pipeline. Each layer either closes the alert with its reasoning attached, or hands it up with more context. Humans see the alerts that need judgement.
AI analysis on every alert
Routing, verdict, recommended severity, MITRE ATT&CK technique and the reasoning behind it, stored with the alert for audit.
Agent studio
Build, clone and publish SOC agents from blocks; turn agents and scheduled flows on per tenant.
Cases and workflows
Create cases, suppression and detection rules, and notifications straight from an alert.
One console for security operations and compliance
SIEM integration
Ingest from Wazuh, Splunk, IBM QRadar, Microsoft Sentinel and Elastic, in push or pull mode, with per-source rate limits and health.
GRC
Framework library with control hierarchies, risk scores, automated monitors and evidence: comply once, satisfy many. Map your own controls to ISO/IEC 27001, SOC 2, NIST CSF, PCI DSS, HIPAA, NYDFS Part 500, SEC Regulation S-P and the FFIEC CAT.
Threat intelligence
A shared knowledge base of indicators, actors, malware and campaigns, plus dark-web monitoring, vendor risk, a CVE tracker (CISA KEV, NVD, OSV) and phishing intelligence.
Digital exposure
External attack-surface discovery from your domains and IP ranges, DMARC monitoring, and phishing simulation campaigns.
vCISO command center
Posture, GRC readiness, cyber maturity, open cases and noise reduction on one screen for each organisation.
Employee portal
Policies to acknowledge, training, phishing-awareness campaigns and self-service endpoint agent install for every staff member.
Ask your SOC a question. Out loud.
The security copilot reads alerts, logs and threat intelligence and answers in plain language. Speech-to-text and text-to-speech models let analysts ask by voice and get spoken briefings, all on Nimbo GPUs.
- US-only by designOpen models served by Nimbo Turbine in US regions or on your Nimbo Rack. Logs and prompts never leave the United States.
- Voice modelsWhisper Large v3 for transcription and a neural text-to-speech voice for read-outs and on-call briefings.
- Grounded answersEvery answer cites the alerts, events and indicators it used.
- Priced like infrastructureAI analysis is billed on the same token rate card as Nimbo Turbine. Bundles for MSPs on request.
Controls only the operator of the GPUs can provide
Attested tenancy
Dedicated GPUs by default, DPU-enforced network segmentation per tenant, GPU memory scrubbed between tenants, and a downloadable isolation report.
Confidential inference
NVIDIA confidential computing with CPU and GPU attestation exposed through the API. NVIDIA reports B200 keeps 96 to 98% of throughput with encrypted NVLink.
Guardrails in the token price
Prompt-injection, jailbreak, topic and PII policies per API key, built on NVIDIA NeMo Guardrails.
Source for the Blackwell figure: NVIDIA Technical Blog.
Run security for many organisations from one console
An operator console aggregates every tenant, then lets you switch into any of them. GRC content is authored once and published to many tenants.
- Cross-tenant alert queueOne queue with tenant, severity and assignee filters, plus per-tenant ingest and storage health.
- Append-only audit trailOperator logins and tenant impersonation recorded, signed and exportable as audit evidence.
- Per-tenant billingAgents, storage and AI analysis metered per tenant.
How Nimbo Secure protects your data
Security tooling sees your most sensitive logs. These are the controls built into the platform, whether it runs on Nimbo capacity or on your own hardware.
Tenant isolation
- Separate data per tenant.Each organisation's events, alerts and evidence live in their own encrypted store and index.
- Dedicated GPUs by default.No GPU sharing across customers; GPU memory is scrubbed between tenants.
- Network segmentation.Per-tenant VPCs with deny-by-default firewall rules.
Confidential AI with attestation
- Confidential computing.AI agents can run on NVIDIA Hopper and Blackwell GPUs in confidential mode.
- Remote attestation.Verify the GPU, driver and model image through the API before any log is sent.
- Open models you can inspect.No prompts or logs go to a third-party AI provider.
Identity and audit
- SSO and MFA.SAML and OIDC sign-in with role-based access per tenant.
- Approvals for actions.Containment steps proposed by AI agents need a named analyst to approve them.
- Append-only audit trail.Every login, query, approval and operator impersonation is recorded and exportable.
Data protection
- Encryption everywhere.TLS 1.2+ in transit and AES-256 at rest, with customer-managed keys as an option.
- Data stays where you put it.Pin processing to a Nimbo region or to your own Nimbo Rack.
- Never used for training.Your logs, prompts and answers are not used to train any model.
Want the detail behind these controls? Ask for the security pack →
See the AI SOC on your own logs.
Connect a Wazuh or Splunk source in a pilot tenant and watch the agents triage a week of alerts.