# Cotool

> AI for the blue team. Security Operations optimized for Agents.

Cotool is a security operations platform built for AI agents. It covers two
use cases: an agent-native SIEM (log storage, federated search, Python
detections, every alert investigated) and an open AI SOC (agents that triage,
investigate, respond, and hunt, with customer control over models, tools,
instructions, and actions).

## Products

- [Observe](https://www.cotool.ai/observe.md): Security log storage optimized for agents, plus federated search across legacy SIEMs, data lakes, and any tool with an API.
- [Detect](https://www.cotool.ai/detect.md): Detections written as Python, tuned automatically from alert dispositions, and run on stored or federated data.
- [Respond](https://www.cotool.ai/respond.md): Response agents defined in natural language that triage and investigate alerts from any source, with human-in-the-loop controls.
- [Hunt](https://www.cotool.ai/hunt.md): Curated threat intelligence filtered for relevance and exposure, and hypothesis-driven hunts that produce new detections.
- [Integrations](https://www.cotool.ai/integrations.md): 91 built-in integrations, plus custom MCP servers and CLI tools.

## Key facts

- Models: frontier and open-weight models, configurable per agent. Model recommendations are based on BlueBench, Cotool's public benchmark for defensive security.
- Agents and skills can be managed in the UI or synced from Git as YAML.
- SOC 2 Type II. Security and compliance details: https://trust.cotool.ai
- Product documentation: https://docs.cotool.ai
- Book a demo: https://www.cotool.ai/request-demo

Every page on this site is available as Markdown: append `.md` to any URL,
or request it with `Accept: text/markdown`.

## Pages

- [Cotool — AI SOC and Agent-Native SIEM for the Blue Team](https://www.cotool.ai/index.md): Security operations optimized for agents. Cotool stores and searches your logs, runs Python detections, and investigates every alert with agents you control.
- [About Cotool](https://www.cotool.ai/about.md): Cotool is our vision of how security work should be: faster, simpler, and less exhausting.
- [Blog — AI Security Operations and Research](https://www.cotool.ai/blog.md): Engineering, research, and company updates from Cotool on AI agents for detection, response, threat hunting, and security operations.
- [Security Log Storage and Federated Search for Agents](https://www.cotool.ai/observe.md): Store security logs in Cotool with fast search at a fraction of traditional SIEM cost, and let agents query everything else where it already lives.
- [AI Detection Engineering with Python Detections](https://www.cotool.ai/detect.md): Cotool detections are Python code. Agents write, backtest, and tune them, investigate every alert they raise, and run them on data wherever it lives.
- [AI Threat Hunting and Actionable Threat Intel](https://www.cotool.ai/hunt.md): Cotool curates threat intel, filters it for relevance and exposure in your environment, and runs hypothesis-driven hunts that turn findings into detections.
- [AI Alert Triage and Incident Response Agents](https://www.cotool.ai/respond.md): Build response agents in natural language that triage and investigate alerts from any source, using your playbooks, tools, and human approval where needed.
- [AI-Native SIEM Built for Agents](https://www.cotool.ai/siem.md): A SIEM built for AI-native security operations: low-cost log storage, fast and federated search, Python detections, and every alert investigated by agents.
- [AI SOC Without the Black Box](https://www.cotool.ai/ai-soc.md): Agents triage, investigate, and resolve every alert, and hunt for what your detections miss. You control the models, tools, instructions, and actions.
- [Security Integrations: SIEM, EDR, Identity, Cloud](https://www.cotool.ai/integrations.md): Built-in integrations across SIEM, endpoint, identity, cloud, code, and the rest of your security stack, plus custom MCP servers and CLI tools.
- [Partner with Cotool](https://www.cotool.ai/partners.md): Cotool is partner-first. Bring agentic detection, response, and threat hunting to your customers as a reseller, MSSP, integration partner, or strategic advisor.
- [Meet the Cotool Team at Black Hat USA 2026](https://www.cotool.ai/blackhat-2026.md): Meet the Cotool team during Black Hat USA 2026 in Las Vegas. Book time with our founders and get invites to our events during the week.
- [Cotool Research — AI in Security Operations](https://www.cotool.ai/research.md): Benchmarks evaluating frontier and open-weight AI models on real security operations work, led by BlueBench, Cotool's benchmark for defensive security.
- [BlueBench — AI Benchmark for Defensive Security](https://www.cotool.ai/research/bluebench.md): BlueBench ranks frontier and open-weight models on defensive security work: incident response, threat hunting, and detection engineering across six benchmarks.
- [BlueBench Capability Leaderboard](https://www.cotool.ai/research/bluebench/capability.md): Overall BlueBench score and per-category results for incident response, threat hunting, detection engineering, and malware analysis.
- [BlueBench Reliability Leaderboard](https://www.cotool.ai/research/bluebench/reliability.md): Reliability = 100 − mean(max − min) across 6 benchmarks. Inverted spread, not same-task repeatability; higher is tighter.
- [BlueBench Cost Efficiency](https://www.cotool.ai/research/bluebench/cost.md): BlueBench score against USD per evaluated task, with the Pareto frontier of tested models.
- [BlueBench Methodology](https://www.cotool.ai/research/bluebench/methodology.md): How BlueBench tasks are built, scored, weighted, and combined into capability, reliability, and cost results.
- [Request a demo](https://www.cotool.ai/request-demo.md): See how Cotool agents detect, investigate, and respond across your security stack. Book a demo with the Cotool team.
- [Agreements](https://www.cotool.ai/license.md): Current and prior versions of the Cotool Master Subscription Agreement and Data Processing Agreement.
- [Privacy policy](https://www.cotool.ai/privacy-policy.md): How Cotool collects, uses, and protects personal data, and how to exercise your privacy rights.
- [Subprocessors](https://www.cotool.ai/subprocessors.md): Cotool Inc uses the following subprocessors to support its product offerings.

## Research benchmarks

- [Impact & Exfiltration](https://www.cotool.ai/research/bluebench-simulation-003.md): BlueBench-Simulation-003: Three simulated end-of-intrusion investigations (ransomware impact, backup sabotage, and data exfiltration) scored against complete hidden ground truth
- [Identity & Active Directory Attacks](https://www.cotool.ai/research/bluebench-simulation-002.md): BlueBench-Simulation-002: Four simulated Windows identity-tier attacks (password spray, domain persistence, credential-attack detection, and a hands-on-keyboard operator) scored against complete hidden ground truth
- [Initial Access & Command-and-Control](https://www.cotool.ai/research/bluebench-simulation-001.md): BlueBench-Simulation-001: Five simulated investigations covering a mail-borne endpoint compromise, a DMZ webshell, and DGA botnet beaconing, scored against complete hidden ground truth
- [AWS Cloud Intrusion](https://www.cotool.ai/research/aws-cloud-intrusion.md): BlueBench-Intrusion-003: Real AWS intrusion through leaked CI credentials, testing detection engineering and evidence-backed investigation reports
- [Windows Enterprise Intrusion](https://www.cotool.ai/research/windows-enterprise-intrusion.md): BlueBench-Intrusion-002: Real multi-host Windows Active Directory intrusion spanning detection engineering, malware analysis, and open-ended incident reporting
- [macOS Threat Investigation](https://www.cotool.ai/research/macos-threat-investigation.md): BlueBench-Intrusion-001: Real macOS infostealer intrusion spanning incident response, threat hunting, and detection engineering
- [NYU CTF Bench](https://www.cotool.ai/research/nyu-ctf.md): Real CTF challenges from CSAW competitions covering reverse engineering, forensics, and miscellaneous problem-solving
- [Cybench (Defensive Subset)](https://www.cotool.ai/research/cybench.md): Defensive security CTF challenges testing forensics, reverse engineering, and miscellaneous security skills
- [BOTSv3 Blue Team CTF](https://www.cotool.ai/research/botsv3.md): Blue team CTF scenarios testing incident response and threat hunting
- [Sigma Detection Classification](https://www.cotool.ai/research/sigma.md): Multi-label classification of MITRE ATT&CK techniques from Sigma rules
- [CyberMetric](https://www.cotool.ai/research/cybermetric.md): Multiple-choice cybersecurity knowledge evaluation across 10,000 questions

## Blog posts

- [Jevons for Cybersecurity](https://www.cotool.ai/blog/jevons-for-cybersecurity.md): Falling costs of telemetry and AI investigation are expanding what defenders can detect, making broader security coverage affordable.
- [Ramp Scales Detection & Response Without Scaling Headcount](https://www.cotool.ai/blog/ramp-detection-response-case-study.md): How Ramp uses Cotool to automate triage, close the loop on detection tuning, and expand coverage without scaling headcount.
- [Trust But Verify: Benchmark Research Key to Gauging AI Security Claims](https://www.cotool.ai/blog/bluebench-benchmark-ai-model-assessment-verification.md): AI agents are taking on real defensive security work, but how do you know which models actually deliver? Cotool’s BlueBench puts them to the test across real-world security tasks, delivering benchmarks that measure model capability, cost, reliability, and failure modes.
- [Introducing Cotool Router](https://www.cotool.ai/blog/introducing-cotool-router.md): Cotool Router gives security teams automatic cross-provider fallback, access to open-weight models, and evaluation-informed model selection for any security task.
- [Agents as Software](https://www.cotool.ai/blog/agents-as-software.md): What does security look like in a world where intelligence is everywhere?
- [Beyond CTFs: Evaluating AI Agents on Real Intrusion Data](https://www.cotool.ai/blog/beyond-ctfs-evaluating-ai-agents-on-real-intrusion-data.md): We benchmarked frontier models on a real macOS infostealer intrusion. This is not a CTF, which tend to test narrow, artificial scenarios. Tasks spanned incident response, threat hunting, and detection engineering.
- [The Security Infrastructure Powering EliseAI's Rapid Scale](https://www.cotool.ai/blog/case-study-eliseai.md): How EliseAI uses Cotool to automate investigations, expand detection coverage, and defend customer data across housing and healthcare
- [Announcing our $7.4m seed fundraising to build the AI Operating system for security teams](https://www.cotool.ai/blog/announcing-our-seed-round.md): Cotool announces $7.4m seed round led by Andreessen Horowitz to build the AI Operating System for security teams
- [Evaluating AI Agents in Security Operations (December 2025)](https://www.cotool.ai/blog/evaluating-gpt-5-1-claude-opus-4-5-and-gemini-3-pro-ai-agents-in.md): Which frontier model should you use for SecOps automation? We added the latest cohort of frontier models to our benchmark to find out.
- [Evaluating AI Agents in Security Operations](https://www.cotool.ai/blog/evaluating-ai-agents-in-security-operations.md): We benchmarked frontier AI models on realistic security operations (SecOps) tasks using Cotool’s agent harness and the Splunk BOTSv3 dataset. GPT-5 achieved the highest accuracy (63%), while Claude Haiku-4.5 completed tasks the fastest with strong accuracy. GPT-5 variants dominated the performance-cost frontier. These results provide practical guidance for model selection in enterprise SecOps automation.
- [Context Management for Agentic Security](https://www.cotool.ai/blog/context-management.md): How we are solving the LLM Security Data problem
- [Security without the Spectacle](https://www.cotool.ai/blog/security-without-the-spectacle.md): Why would anyone want to start an AI security company?