Cross-Boundary Cyber Resilience

The Immutable Proof Layer for Every Incident

AI triages. A hash chain proves it. Regulators accept it.

Transform Sentinel and CrowdStrike alerts into audit-grade evidence. Driven by an AI agent for deep analysis and secured by SHA-256 cryptography, ResilienceChain creates a verifiable record of truth. Instantly generate NCSC CAF compliance packs or execute secure, cross-tenant sharing for seamless collaboration.

Run the full NIST incident lifecycle, contain threats, and benchmark your MTTR, all from one workspace.

UrgentEscalatingChain verified · 12 events

Ransomware behaviour on FIN-SRV-03

Microsoft Sentinel · opened 14m ago

Triage Agent

LokBit deployment traced across FIN-SRV-03 and HR-WKS-14 via identical enc.elf hash. 72h deadline approaching; no REPORT action underway.

ImpactLateralMovementDefenseEvasion
CriticalIsolate FIN-SRV-03 and HR-WKS-14 from network immediately
sha256:76b4c6be5b0fb424d9a3bc47e2f68…Live

The problem

Cyber incident response stuck in silos

Alerts fire in the SIEM. Evidence fragments across EDR, email, Slack screenshots, PDFs. Regulator notifications miss the 72-hour NIS2 deadline because the report starts from zero. Cross-tenant handoffs happen over email.

Alerts in Sentinel, incidents in a spreadsheet

Your SIEM fires. Your response lives in a disconnected doc. Every handoff means manual copy-paste and broken context.

Evidence chain breaks at every handoff

Cross-tenant sharing happens over email. The audit trail lives on someone's laptop. Regulators can't independently verify anything.

72h NIS2 deadline missed

Regulator notifications fail because drafting starts from zero. A week of Word-doc work that should take minutes.

How it works

From SIEM alert to regulator pack in 5 steps

Every step leaves an append-only trail in a per-tenant SHA-256 hash chain, so the incident timeline is independently verifiable. Click any step below to see the machinery.

resiliencechain - ingest-from-any-siem
Sentinel alert received
Rule: Ransomware behaviour on file server
Severity: HIGH · Host: FIN-SRV-03
HMAC signature verified (SHA-256)
Incident opened · INC-428
append INCIDENT_OPENED event
seq 001 · hash 76b4c6be5b0fb424…

Incident lifecycle

Every incident walks the NIST SP 800-61 chain

Each stage is a chained event. Skipping a stage is flagged by the Triage Agent; lingering in one triggers a regulatory-deadline warning on the incident card.

01
Detect
Alert lands from SIEM
02
Contain
Isolate affected assets
03
Eradicate
Remove the threat
04
Recover
Restore operations
05
Verify
Confirm closure
06
Report
NCSC CAF / NIS2 pack
NIS2 requires notification within 72 hours of detection. ResilienceChain tracks time-in-stage and warns coordinators before deadlines lapse.

Platform

Three things competing SIEMs can’t claim

AI Agents

Real AI triage, not tagging

Every evidence file gets a full structured briefing - summary, IoCs, MITRE tactics, suggested actions, confidence. Incident-level triage correlates across files to flag lateral movement you'd otherwise miss.

Independently verifiable

Cryptographic evidence chain

Every event is SHA-256-chained per tenant. A regulator or external auditor can recompute the chain from exported events using only the published spec - no RC code required.

CC-BY-4.0

Open Evidence Schema

Every payload - AI analysis, webhook envelope, chain proof - is defined in a published JSON Schema. Partners write conforming code once; any RC tenant works.

Outcomes

What better incident response looks like

<1m
AI triage under a minute

Evidence Agent analysis in 20–30s. Triage plan in 30–40s. Coordinators stop reading raw logs to decide if the thing matters.

1✕
Regulator pack in one click

NCSC CAF-aligned HTML pack assembled from the chained events. What took a week of Word-doc drafting takes minutes.

Cross-tenant handoffs survive

Share an incident to your MSP, regulator, or sector peer with a scope. The receiver gets the full chain, cryptographically intact.

Independent verification

Auditors don't have to trust you - they compute the SHA-256 chain themselves against the published spec. No RC code. No intermediary.

Pilot

Start on your own alerts

The pilot programme wires ResilienceChain up to your real SIEM feed for 2–4 weeks. Run one incident through it end to end. Your regulator pack. Your coordinator reviewing the triage. Your chain proof.

Recommended

Pilot programme

2–4 week guided rollout on your SIEM feed.

  • Wire your Sentinel / CrowdStrike / custom source to a signed endpoint
  • Run AI Evidence + Triage on your real incidents
  • Generate one NCSC CAF regulator pack
  • Hands-on onboarding across your SOC team
  • Migration path documented, whether you stay or not
Start a pilot →

Partner programme

For MSPs, forensics firms, and regulators building on the open schema.

  • Partner Directory listing with capability tags
  • Co-authored conformance tests against the Open Evidence Schema
  • Cross-tenant share routing to your tenant by default
  • Joint case study for the visa narrative
Talk to us →

Pricing

Start free. Upgrade when your SOC grows.

Free forever for small teams. During the pilot phase we onboard customers hands-on - Stripe self-serve billing lands after the first cohort.

Starter
Free
forever

  • Up to 25 cyber assets
  • Up to 5 users
  • 2 inbound partner shares
  • NCSC CAF regulator pack
  • Evidence chain + immutable audit
  • Community support
Most popular
Team
£299/mo
per workspace

  • Up to 500 cyber assets
  • Up to 50 users
  • 25 inbound partner shares
  • Sentinel + CrowdStrike integrations
  • AI Evidence + Triage agents
  • Email support with SLA
Scale
Custom
contact us

  • Unlimited assets + users + shares
  • Custom integrations
  • Dedicated pilot support
  • NCSC pilot endorsement assistance
  • SOC 2 + ISO 27001 assistance

See it on live data

Our pilot tenant receives synthetic Sentinel alerts every few minutes. Log in to the demo, watch the Evidence Agent analyse a ransomware log, and click the chain-verified badge to inspect the SHA-256 proof.