Crogl is an AI‑driven platform that autonomously investigates security alerts and threat‑hunting advisories, pulling context from existing SIEM, EDR, ticketing and data‑lake tools without requiring schema normalization. The system runs entirely on‑premises, in private cloud or air‑gapped environments, ensuring that all data and model inference stay within the customer’s infrastructure while producing fully documented, audit‑ready investigation reports for analysts to review and act upon.
Funding
$25M raised to dateRaised to date based on public sources. This may differ from the amount the company actually raised and is based only on what is publicly available on the internet.
1OFounders
Product
Problem
Security Operations Centers (SOCs) face overwhelming alert volumes, with most alerts never investigated or documented, and existing automation requires extensive data normalization and manual playbook maintenance, leading to slow response times and loss of institutional knowledge.
Solution
Crogl provides an on‑premises, private‑cloud, or air‑gapped AI platform that autonomously investigates security alerts and threat‑hunting advisories while preserving full auditability. The system combines a live knowledge graph, AI orchestration layer, and LLM reasoning to enrich each alert with contextual data from existing SIEM, EDR, ticketing, and data‑lake sources without schema normalization. It then executes investigation workflows, queries integrated tools, and generates fully documented reports that analysts can review, modify, and approve. All processing and model inference remain within the customer’s environment, ensuring data never leaves the organization and supporting regulated or classified settings. The platform also includes a skill library and builder, enabling teams to extend or customize investigation playbooks using the same AI components.
Target Audience
Primary customers are SOC teams and security analysts in enterprises, regulated industries, and government agencies that require high‑volume alert triage, audit‑ready documentation, and strict data residency.
Features
- Neuro‑symbolic architecture that fuses a live knowledge graph with LLM reasoning for context‑aware investigations
- Native integration with SIEMs, EDRs, ticketing systems, and data lakes (e.g., Splunk, Microsoft Sentinel, CrowdStrike, ServiceNow, Snowflake) without schema mapping or recoding
- Fully autonomous investigation workflow: data gathering, cross‑referencing, evidence synthesis, and audit‑ready report generation
- On‑premises, private‑cloud, and air‑gapped deployment options ensuring zero data exfiltration
- Model‑agnostic support for frontier APIs, self‑hosted open‑weight models, or enterprise LLM services
- Built‑in skill library for alert investigation, threat hunting, and report creation, plus a skill builder for custom workflows
- Role‑based access control, SSO integration, and persistent audit trail for compliance and governance