Transforms generic security alerts into precise, actionable notifications by integrating employee insights and account identity data. Reduces alert fatigue in SecOps teams by providing real-time Slack notifications for high-risk actions, along with verification, attribution, and detailed activity mapping across systems. Enables faster response to threats like account takeovers and privilege escalation by combining automated risk assessment with out-of-band confirmation methods.
Funding
Funding not disclosed
Founders
Product
Problem
Security operations (SecOps) teams are overwhelmed by the volume of generic security alerts, leading to alert fatigue and delayed response to critical threats. These alerts often lack context, making it difficult to quickly assess risk and prioritize investigations.
Solution
Crowdalert transforms generic security alerts into precise, actionable notifications by integrating employee insights and account identity data. When employees perform high-risk actions, such as making infrastructure changes with an AWS key, they receive a direct message in Slack. This message notifies them of the potential risk and gathers information about their verification, intention, and sequence of actions. Crowdalert automatically maps employee identities across accounts and systems, providing a comprehensive view of their activities. For critical actions, out-of-band verification methods, like WebAuthn, can be used for round-trip confirmation.
Target Audience
The primary target audience is SecOps teams seeking to reduce alert fatigue and improve response times to security incidents like account takeovers, business email compromise, and privilege escalation attacks.
Features
- Real-time Slack notifications for high-risk employee actions
- Automated mapping of employee identities across accounts and systems
- Out-of-band verification using methods like WebAuthn
- Integration with Datadog Vector pipeline for visibility across systems
- Employee feedback loop for alert enrichment and prioritization