CYBERSECURITY PARTNER · GRAYBOX SECURITY OPERATING

75% of analyst time goes to alerts that don't matter.
Reclaim it.

The Agentic SOC is yGen's on-premise, multi-tenant security operations platform — five autonomous agents that triage, investigate, respond, hunt, and harden your security posture. Co-built and co-delivered with GrayBox Security.

◆ THE SOC PROBLEM · BY THE NUMBERS
4,000+ Alerts per day in average SOC
75% Analyst time on repetitive triage
3.5M Unfilled cyber jobs globally
277 days Average breach detection time
◆ BEFORE & AFTER

What changes when agents take over.

Real shift in how a SOC operates. Analysts move from alert queues to strategic decisions. Detection times collapse. Cost-to-serve drops.

◆ BEFORE · MANUAL SOC

Analysts drown in alert queues.

Tier-1 analysts spend most of their day acknowledging false positives. Real threats sit in the queue while analysts work through noise. Cloud SIEM bills scale per-GB ingested. Per-token AI tools add another variable cost layer.

  • Reactive investigation cycles taking hours
  • OPEX scales unpredictably with usage
  • Data sovereignty dependent on vendor regions
  • Talent pipeline empty — 3.5M unfilled roles
◆ AFTER · AGENTIC SOC

Five agents handle the noise.

Triage, investigation, response, hunt, and posture agents run autonomously on AI Box. Phoenix orchestrates handoffs. Analysts supervise outcomes, tune detection logic, and focus on adversary simulation — not ticket clearance.

  • Autonomous triage at machine speed
  • Fixed-cost on-prem model — no token meters
  • 100% on-premise data sovereignty
  • 5–10× client capacity per analyst
↓ 75% analyst time reclaimed
5–10× capacity per analyst
~60% lower cost-to-serve
◆ SOLUTION ARCHITECTURE

The full stack, end to end.

Five-layer architecture running entirely on-premise. Zero cloud token dependency. Multi-tenant isolation via VLAN + container-level segmentation.

LAYER 01
Data Sources
Endpoints·Identity (AD/Entra)·Cloud·Email·Network·SaaS
LAYER 02
SIEM + Detection
Wazuh/Elastic·Log correlation·Threat intel feeds·File integrity·Vuln detection·Compliance
LAYER 03 · PHOENIX AGENTIC LAYER
5 specialist agents · LangGraph orchestration
Triage Agent·Investigation Agent·Response Agent·Hunt Agent·Posture Agent
LAYER 04 · LLM RUNTIME
AI Agent Box · on-prem inference
Ollama (LLaMA·Qwen·Mistral)·RAG via Qdrant·Local inference·No cloud tokens
LAYER 05
Human-in-the-Loop
Oversight & governance·Detection engineering·Threat hunting·Strategic decisions
◆ ROI & BUSINESS CASE

The economics work.

Two real-world deployment scenarios. Cost models compared against cloud-native SOC alternatives. Payback measured in months, not years.

SCENARIO B

Multi-Tenant SOC Service

MSSP / PARTNER-DELIVERED MODEL
  • Cloud SOC per client$15K+ / mo recurring
  • AI Box rack (per facility)$300K – $500K
  • Capacity per rack10–20 clients
  • Cost per client (monthly)~$3K – $5K
  • Margin per client3–5× cloud baseline
Estimated payback period
4 – 8 months
◆ DEPLOYMENT PATH

From discovery to live SOC.

A repeatable 14-month maturity model. Each phase is independently valuable — clients see operational lift from Month 3.

PHASE 01 · SOC 1.0

Deploy & Unify

AI Box installed. Wazuh + Phoenix integrated. Endpoint, identity, cloud sources connected. Auto threat disruption enabled.

MONTHS 1–3
PHASE 02 · SOC 2.0

AI-Augmented Ops

Triage and investigation agents activated. RAG knowledge base loaded with client playbooks. Analysts shift from alert queues to decisions.

MONTHS 4–8
PHASE 03 · SOC 3.0

Agentic Automation

Full multi-agent orchestration — contain, remediate, hunt. Continuous posture optimization. Multi-box clustering for scale.

MONTHS 9–14
PHASE 04 · ONGOING

Continuous Optimization

Quarterly posture reviews. Detection engineering retainers. New agent development. Recurring advisory cycle.

QUARTERLY
◆ COMPLIANCE & GOVERNANCE

Built for the regulators.

Sovereignty isn't a feature here — it's the architecture. Every decision is logged. Every model runs locally. Every byte stays within your perimeter.

Data Privacy Act (RA 10173) Full compliance with PH National Privacy Commission requirements. No PII leaves designated infrastructure.
Audit Trail by Design Every agent decision, tool call, and computation logged with inputs, outputs, and timestamps. SOC 2-aligned.
Multi-Tenant Isolation VLAN segmentation + container-level isolation per tenant. No data mixing across MSSP clients. Provable.
Human-in-the-Loop Governance Analysts retain decision authority over containment and response actions. AI advises — humans approve.
◆ PARTNER STORY · GRAYBOX SECURITY

The partner template that
defined the model.

"GrayBox brought the SOC operations and the client relationships. yGen brought the AI Box and Phoenix. Together: an Agentic SOC that was production-ready in months — not vaporware, not a Microsoft re-skin."

— GRAYBOX SECURITY · WAZUH PLATINUM PARTNER · MSOC + MDR
Read the GrayBox case study →
◆ NEXT STEPS

Build the SOC
your CIO has been asking for.

Two-week discovery workshop. Four-week PoC deployment. Eight-week pilot with up to 5 clients. Then GA. We deliver the platform — your team brings the relationships.