Org
Graph
halyard-prod
UTC
Detection & response · for teams without a SOC
Signal reads every one anyway. An AI analyst triages your cloud, identity and endpoint alerts around the clock — and when one is real, hands a human a one-tap fix. The night shift you were never going to hire.
(01)
On night shift for
(02)
The problem, briefly
A 400-person company throws off about eleven thousand security alerts a month. Roughly eleven of them matter. Signal reads all eleven thousand, argues with itself about the eleven, and wakes a human only when there’s an actual decision to make.
11,000 alerts / month
10,989 closed by the analyst
11 worth a human
1 tap each
(03)
Product
Three verbs, one screen, forty-one seconds. Signal does the reading and the reasoning. You keep the say-so.
(04)
Incident replay · INC-2291
A real night at a customer, replayed straight from Signal’s audit log. Names changed, timings untouched, zero adjectives added.
$ signal replay INC-2291 --from 03:12:00Z
events read 36human time spent 24 sactions run 3 / 3customer impact none
Identity
logins · live
Signal learns where and how each person signs in, then notices when physics gets involved.
Triage
today
Endpoint
fleet
98.6%
1,187 of 1,204 reporting
17 asleep. It’s 3 a.m.
Cloud
api calls
Not sampled. Every call, every region.
4,164 / min3 regions
Secrets
rotation
A leaked key expires before anyone finishes pasting it.
tok_ci_deploy••••••••7f3a
rotated 4 s ago
next rotation in 6 h
Control
try it
Revoke 4 sessions for j.okafor?
confidence 0.94 · reversible for 24 h
Mean time to detect
first event → someone knows
9h 42m
919× faster
Mean time to contain
first event → threat can’t act
2.6 days
891× faster
Alerts a human reads
per week, per org
1,340
−99.6%
Night-time pages
per month, 22:00–07:00 local
23
−91%
Methodology: customer-reported baselines, verified against their own ticketing history where it existed. Jan–Jun 2026, n = 212. We’ll show you the SQL if you ask nicely, and also if you ask rudely.
(07)
Integrations
Read-only by default. Signal asks for write access one action at a time, and only for playbooks you switch on. Most teams are fully connected before their first meeting ends.
integrations
median setup
agents to install
Cloud
Identity
EDR
Git
Chat
Paging
Containers
SIEM
MDM
DNS
Ticketing
Secrets
CI/CD
(08)
From the other end of the pager
“In our first quarter, Signal woke me up twice. Both times it was right, and both times the fix was one tap from done. I’ve started charging my phone in the kitchen.”
Ines Albuquerque
CISO · Halyard · 840 engineers
312,044
alerts read
2
pages at night
0
incidents past containment
25–250 identities
$7/ identity
/ month
Team tops out at 250 identities
For teams who want someone reading the logs, starting tonight.
100–2,000 identities · most teams
$12/ identity
/ month
≈ $4,800 / mo, billed annually
For orgs where “we’ll look at it Monday” stopped being an answer.
1,000+ identities or regulated
$15/ identity
/ month, from
Usually starts around 1,000 identities
For when the auditor, the board and the insurer all want the same PDF.
Read-only by default
SOC 2 Type II
Your data stays in your region
Monthly plans cancel any time
No per-alert surprises, ever
(10)
Free threat review
Give us read-only access for 14 days. You get a written report of what’s already happening in your cloud and identity stack — the boring, the weird, and the “wait, how long has that been public?” No agents to install. No sales theatre.
14 days
read-only access
1 written report
0 obligations
