Perpetual Systems provides a continuous security analytics platform that uses its AI agent, Simba, to automate detection creation, alert triage, and response actions while keeping raw security data in the customer’s own cloud storage. The system creates a feedback flywheel where case outcomes automatically refine detection rules, reducing false positives and improving SOC analyst efficiency. A unified query language, Hamelin, and immutable, append‑only case tracking enable seamless investigation and full auditability without moving data outside the compliance boundary.
Funding
Funding not disclosed
Founders
Product
Problem
Security Operations Centers (SOCs) often struggle with high volumes of alerts, many of which are false positives, and with static detection rules that do not adapt to evolving threats. Maintaining detection logic, investigating incidents, and ensuring data compliance across cloud environments require extensive manual effort and fragmented tooling.
Solution
Perpetual Systems offers a continuous security analytics platform that integrates an AI-driven agent, Simba, to automate detection creation, alert triage, and response actions. Simba leverages threat intelligence and case outcomes to suggest and refine detections, reducing noise and improving analyst efficiency. The platform separates a hosted management plane from a customer‑controlled data plane, storing raw security events in Apache Iceberg tables on the user’s cloud account, ensuring data never leaves the compliance boundary. A unified query language, Hamelin, enables parsing, detection, hunting, and investigation within a single syntax, allowing analysts and Simba to interact with data without context switching. All investigation activity is recorded in immutable, append‑only cases, creating a feedback loop that continuously enhances detection quality.
Target Audience
Primary customers are SOC teams, security analysts, and detection engineers in enterprises that require scalable, cloud‑native security analytics while retaining full control over their data.
Features
- AI agent Simba that proposes new detections, refines existing rules, and triages alerts, escalating to analysts only when needed
- Flywheel feedback loop where case outcomes automatically inform detection tuning and false‑positive reduction
- Management plane with web UI, API, and MCP for configuration, case management, and user state, hosted by Perpetual
- Data plane that ingests, parses, normalizes, and stores security events in customer‑owned cloud object storage using Apache Iceberg and Parquet formats
- Semantic layer that tracks datasets, fields, and transformations, enabling natural‑language queries and automated query generation
- Hamelin language that unifies parsing, detection, hunting, and investigation, eliminating the need for multiple query syntaxes
- Append‑only case tracking for full auditability and reproducibility of investigation steps
- Configurable response actions that can be reviewed, approved, or overridden before execution