Silent Edge
Our own security operations platform: a multi-tenant SOC console with tenant isolation enforced inside the database rather than the interface, live threat intelligence, and a client portal. Built because the firms that most need a 24/7 SOC are exactly the ones that cannot staff one.
- Tenant isolation
- Database-level
- Access model
- 4-tier
- Intel sources
- MITRE · KEV · NVD
The firms that need a SOC most cannot staff one
A security operations centre needs analysts on shift around the clock, a SIEM, threat intelligence, and someone who knows what to do at 03:00. That is a headcount problem before it is a software problem, and it puts real detection out of reach for small and mid-sized firms — who are targeted precisely because they are assumed to be undefended.
One console, many tenants
Silent Edge is a multi-tenant console where our analysts work across every client while each client sees only their own estate. Staff get the operations view — alerts, devices, threat intelligence, incident playbooks. Clients get a read-only portal scoped to their organisation. Access runs on a four-tier model, from owner-level command down to org-scoped analysts and read-only client accounts.
Isolation belongs in the database, not the interface
The hard part of multi-tenancy is not building the screens — it is guaranteeing that one tenant can never reach another's data, including when the application layer has a bug. Separation is enforced with row-level security policies in PostgreSQL, so it holds at the data layer regardless of what the interface does. A query that should return nothing returns nothing, even if the code asking is wrong.
- Authenticated requestSession carries the user's organisation and role
- Row-level securityPostgreSQL policies scope every table to the caller's org
- Role gateMiddleware enforces route access per tier
- Scoped responseOnly rows the tenant owns are ever returned
Intelligence that arrives before the incident
The platform ingests MITRE ATT&CK technique data, the CISA Known Exploited Vulnerabilities catalogue and NVD CVE records, and correlates indicators of compromise against telemetry from endpoint and RMM integrations. An AI specialist layer runs retrieval over an internal knowledge base, so analysts get grounded answers with sources rather than a plausible-sounding guess.
Running in production
Silent Edge runs on our own infrastructure behind nginx, containerised, serving both the client console and this site from the same platform. It is the system our analysts use daily — which means every rough edge is one we feel first.