Cloud services, a handful of laptops, no security team, and staff already using AI tools nobody approved.
Small organizations get the same threats as large ones and none of the staffing. The tooling is priced and designed for a team you do not have.
CAVER charges one flat price, ships ready-made content for the cloud services you already run, watches the AI tools your staff adopted before anyone wrote a policy, and keeps enough history that an insurer's questionnaire is a search rather than an apology.
It also states the limit that matters most at this size: CAVER is a platform, not a managed service. If nobody will read what it produces, buy it with monitoring attached.
Nothing here is a failure of diligence. It is arithmetic.
CAVER charges a flat fee per deployment. There is no charge per gigabyte.
That is a pricing decision, but it only works because of how the system is built. On a storage lake, what a search costs depends on how many files it opens, not how many bytes you have kept. CAVER continuously merges small files into fewer, larger, sorted ones.
On a real production system running about 100GB a day, that change did two things:
Older data moves to a sealed tier that is simply a folder. Months outside your search window are never opened at all. There is no separate index to rebuild before a search or an alert can reach that folder: detections and dashboards query it directly, measured at 172 milliseconds for an alert and 76 milliseconds for a dashboard panel over a million events.
What this means for you: "how far back can I search" becomes a storage question, not a performance question. You stop choosing between logging everything, because you cannot predict what you will need and staying inside budget.
A suite of five tools on a single data store. Not four products bolted together, and not four contracts.
| Layer | What it does |
|---|---|
| SIEM core | Search and alerting. Eight query languages (SPL, SQL, KQL, ES|QL, LSQL, Sigma, PromQL and LogQL), plus an AI assistant as a ninth way to ask. |
| CAVERN | The detection content: more than 400 ready-made vendor packs and 5,000+ rules, mapped to the SigmaHQ open rule standard and tagged to MITRE ATT&CK, so your coverage is expressed in terms an auditor and a peer organization both recognize. Includes an editor that back-tests a new rule against your real history before you turn it on. |
| ECHO | Service monitoring: what is up, what is degraded, what depends on what. |
| UBA | 65+ behavior models that need no training data. Off-hours activity, unusual access, lateral movement. |
| SLAM | Case management and response, with approval gates. Paired with the Evidence Locker. |
AI tool adoption in small organizations has outrun the tooling built to watch it, and this is where a small business is most exposed relative to a large one.
Most small organizations are Windows and Mac laptops plus a stack of cloud accounts. That is what the ready-made content is built around.
Available on request, typically delivered within 30 days of order: Carbide for Windows laptops with a signed MSI and Intune or Group Policy enrollment and token-free enrollment, a way to orchestrate Defender or XProtect from Carbide, USB and removable-media audit with an installed-software inventory joined to known-exploited vulnerabilities, and reports that email themselves weekly or monthly to the owner or an insurer contact. Available to design partners: a simplified Carbide Console with a device list, policy, disk-encryption status and recovery-key escrow for BitLocker and FileVault, and a log value report that shows which sources serve no policy and can be cut.
The reason teams turn detections off is not that the detections are wrong. It is that nobody is left to work the output.
Roughly a third of alerts are never investigated, an investigation takes over an hour, and an analyst closes twenty to thirty in a shift. A three-digit queue does not fit inside a staffed team by arithmetic. So CAVER ships named workers rather than more alerts: each one holds a single job, runs it on its own beat, and reports what it found.
An agent that speaks only when it finds something is indistinguishable from one that is broken, and the second is far more common than anyone admits. Every run is written down whether or not it found anything, carrying what it checked and over what window. A quiet morning becomes evidence rather than an absence of evidence.
Twenty of the thirty-six are rules, joins and thresholds: the same data gives the same answer on any day, and it can be explained to an auditor as a query. The other sixteen are baselines, peer groups and rarity, which is still arithmetic over your own history. Five can use a language model to write their summary in prose; turn it off and you lose the wording, not the finding.
You get the same eleven platform agents a large enterprise gets. They are the ones that notice a feed stopped sending or a certificate is about to expire, which is exactly the work that goes undone when nobody is watching.
Every agent ships disabled, and you enable them one at a time from the product. That is deliberate. Nothing switches itself on and starts mailing you.
The workforce, the roster and the controls are shipped and in the product. The connections that feed individual agents land per data source, so an agent whose source is not connected yet says exactly that and names what it needs, rather than reporting a confident nothing. Ask us which of the thirty-six are live against your feeds before you count on any one of them.
A vulnerability list ranked by severity score tells you what could be exploited. Two public feeds tell you what is.
CAVER ingests CISA's Known Exploited Vulnerabilities catalog, about 1,200 CVEs with confirmed exploitation, and FIRST's EPSS scores, an exploitation probability for roughly 200,000 CVEs, every day, and joins both onto your findings by CVE. The vulnerability screen gains an exploited-in-the-wild filter and a sortable probability column.
The effect on a real board is the difference between "4,000 findings" and "these eleven are being exploited right now, start here".
In 2026 CISA published an advisory in which two organizations faced the same red team with the same tradecraft and both fell to full domain compromise. One isolated three phished workstations in 10, 2 and 20 minutes and cut the command channel. The other actioned zero alerts. The difference was not the tooling and not the detection content; it was how fast a person acted on what the tooling already knew.
So CAVER measures that interval, per incident, from the case record:
We publish compression and query speed as first-class numbers because they are how CAVER beats a per-gigabyte platform. Time to contain is the number that decides whether any of that mattered, and it is on the same screen.
Real measurements from a production system handling about 100GB per day.
| Search | Time |
|---|---|
| Empty hour | 6 ms |
| One hour of data | 38 ms |
| 24 hours of data | 453 ms |
| 48 hours across two data centers | 627 ms |
Published figures show searches under 50 ms at the 95th percentile. The counterpart matters just as much: a 120-second ceiling still applies to large summarized searches, and searches over recent data under load run around 1.1 to 1.2 seconds. We are working on that ceiling. Both numbers are published because a best case is not a guarantee.
Ask any vendor, including us, for the range across your own data types during a trial. Not just one blended figure.
| Area | Typical SIEM | CAVER |
|---|---|---|
| Pricing | Per gigabyte; retention becomes a budget lever | Flat per deployment |
| Data ownership | Often vendor-hosted, proprietary format | Your storage, your keys, open format |
| Archived data access | A restore or rehydration job, often billed per query | Queried directly from your own bucket, no restore step |
| Encryption at rest | Assumed, rarely verified | Checked before start; refuses to run on storage it cannot confirm |
| Setup | A project with a professional-services line item | Ready-made packs for the services you already run |
| AI tool oversight | Rarely built in | Included, across vendors |
| Your existing detection content | A rewrite, or left behind | Sigma, Splunk, Elastic, Sentinel, QRadar and Defender rules convert in, with a report on what did not |
| Evidence handling | Export logs; chain of custody is manual | Cryptographic custody, verifiable offline |
| Compliance reporting | Usually a separate product | More than 20 frameworks built in, signed export |
| Where it runs | Many are cloud only | Cloud, on-premise, air-gapped, single box |
An established SIEM has real advantages we will not pretend away:
Those are genuine switching costs. Our answer is the parallel-run and collector-only options above, which let you measure the difference instead of taking it on faith.
For the moment an incident becomes a legal, regulatory or contractual matter.
At that point someone outside your security team needs to trust the record without trusting your vendor. The Evidence Locker is built for that:
What this means for you: an answer to an insurer or a larger customer that is a search rather than an apology.
The AES-256 password protects the contents of the archive. The list of file names and their sizes is still readable without the password, which is how the ZIP format works. If a file name would itself reveal something, rename it before export.
Reports for HIPAA, PCI DSS, SOC 2, ISO 27001 and NIST CSF generate in one click as signed PDFs with evidence rows, branded for you. A cyber-insurance questionnaire becomes a report you attach. Legal hold and WORM storage keep the record from being changed.
One product, not a different tool for every environment.
CAVER runs on Kubernetes, a virtual machine, an isolated network, or a single box. License activation does not need an internet connection, and a lapsed license gives you a 14-day grace period rather than shutting off mid-incident.
This is your risk decision. Both are real products. Neither is a discouraged version of the other.
SAML 2.0 and OpenID Connect are both configured in the product: paste or fetch your identity provider's SAML metadata, or point at your OIDC issuer for discovery, then map the attributes or claims to roles. Test against the live provider before you can turn it on: enable is refused without a successful test in the last 24 hours. A saved change or a disable takes effect on the next request, no restart, and local login stays reachable so an identity-provider outage cannot lock your operators out. An OIDC client secret is sealed in the product's credential vault, never stored in the clear.
SCIM provisioning is configured the same way: an operator mints a bearer token for the identity provider, shown once and stored only as a hash, revoked on the very next request rather than the next restart. Group membership from SAML, OIDC, or SCIM maps to roles by the same rule.
To try it, a one-command demo or Docker Compose gets you running in minutes. Production can be Terraform for AWS or Azure, or a single EC2 box with an offline image flow. caver-doctor checks health and fixes common faults, and the Caver Guide assistant helps configure sources in plain English. Detection health shows rules that cannot fire because a source is missing, and rules turn on by themselves when the data arrives. Vulnerability Center correlates CVEs to your assets, re-ranked by how important the asset is, with a fast lane for known-exploited entries. A cost screen shows what each stream and tier costs you, and fifteen open threat feeds are on by default.
Mostly cloud services, and mostly already covered by a ready-made pack.
| Category | How it reaches CAVER | Status |
|---|---|---|
| Cloud platforms | Native audit trails from AWS, Azure, Google Workspace, Microsoft 365, Cloudflare | Ready-made packs |
| Endpoints and network | EDR, Sysmon, firewalls, VPN, DNS, proxies | Ready-made packs |
| Carbide, our own endpoint agent | Kernel-level process telemetry on Linux, Windows and macOS, shipped to CAVER directly | Included; AIX for design partners |
| Exploitation feeds | CISA KEV and FIRST EPSS, joined onto findings | Ingested daily |
| Identity | Entra ID, Okta, Active Directory, Duo | Ready-made packs |
| Industrial equipment | More than a dozen industrial protocols decoded passively from mirrored traffic | Included, no extra product |
| AI tools | Microsoft Agent 365 event data, plus Claude, Copilot, OpenAI and others | 24 packs, 200+ rules |
More than 400 ready-made vendor packs ship for the common systems, so the bespoke work is the exception rather than the starting point.
A trial is 60 days, $25K to $75K, credited fully toward your first year if you proceed. If you are replacing Splunk, a displacement credit of 25% to 50% off year one is available separately.
Do not take this paper on faith. Test it directly:
CAVER is a platform, not a managed service. It will tell you what happened; somebody still has to read it and act. If you have nobody to do that, buy it with monitoring attached rather than on its own. We would rather say so now than have it sit unwatched for a year and be blamed for the incident it recorded.