AI-augmented SOC · Blast Radius Intelligence
And the answer is on the screen before the incident responder opens the case. Puck maps what every credential on every endpoint can reach — without touching production.
Click "Run" to watch the chain unfold.
Agents report back. Deviations happen. The blast-radius map builds itself.
The first 24 hours
First sweep, every fleet we've pointed Puck at has surfaced something the team didn't know was there: a long-lived AWS admin key in a senior engineer's shell history, a GitHub PAT with org-admin scope cached on a contractor's laptop, an unencrypted SSH key with prod database access, a service-account JSON in ~/Downloads. Not because the host was special. Because nobody had looked closely, and nobody had a way to look across the fleet at once.
Discovery isn't a scan. No rules to author, no packs to maintain. Same agentic investigation Puck runs for an incident, just pointed at the host's own posture: "what's here, and what does it reach?"
The problem at fleet scale
At 10,000 endpoints, nobody has a live answer to "if this laptop is compromised, what does it actually reach?" Scanners give you vulnerabilities. EDR gives you alerts. Secrets detection finds credentials in repos. None of them trace a credential from a specific endpoint to the systems it can authenticate to. You only see that chain when an incident forces an analyst to map it by hand.
How fleet scale changes things
A pathfinder explores one endpoint with a multi-turn LLM conversation. The brain compiles a signed plan, fans it out, and every agent reports back with reach — not just findings. The output is an endpoint-blast-radius map. High-confidence chains compile into Calibrated Detection — deterministic checks tuned to your environment that don't need an LLM to re-run.
Enterprise capabilities
OSS is on-demand. Enterprise is always-on, with continuous coverage and detection that compounds over time.
$ curl -H "Authorization: Bearer …" \ https://puck.acme.com/v1/graph/path \ --data '{"from":"eng-laptop-47","to":"customer-PII-prod"}' [ { "chain": ["eng-laptop-47", "AWS-SSO", "prod-admin", "vault", "customer-PII-prod"], "first_seen": "2025-06-12T14:31Z", "confidence": 0.94 } ]
Pricing
Annual platform license. Scales with environment complexity — never with the number of hosts you put it on. On-prem or dedicated single-tenant is the default; contact us for sizing against your environment.
Why we built this
The thing that always hit me was how long our blast radius stayed invisible. We'd find an AWS key during IR that had been in someone's shell history for a year — the laptop had always been able to reach production, we just never mapped it. Every incident, same rediscovery. Puck is the map I wished we'd had before the breach, not during it.
The read-only architecture is what makes it deployable. Calibrated Detection — patterns Puck has confirmed enough times in your fleet that they compile to deterministic checks — is what makes it compound. That's the whole product.
Jordan, Co-founder
Working in security since 2015 · Puck since 2025
Common questions
Inside your deployment. The brain runs on-prem in your network or in a dedicated single-tenant AWS account you own. You bring your own inference (Anthropic, OpenAI, Bedrock, or a local model) so the LLM call stays inside whatever compliance boundary you pick. We never see your endpoint content.
EDR detects. Puck maps. EDR fires an alert on eng-laptop-47; Puck answers "if that box is compromised, what does it actually reach." Different layers of the stack. No kernel driver, no blocking, no conflict with CrowdStrike, SentinelOne, or Defender. Most teams keep their EDR and add Puck on top — the EDR alert becomes the trigger for Puck's investigation.
BAS simulates attacks — we validate real access without exploitation. ITDR monitors identity infrastructure during an attack — we map what credentials actually reach, before one. Secrets detection finds credentials in repos — we find them on endpoints and trace the chain to crown jewels. Our category is Blast Radius Intelligence: an AI-augmented SOC tool that answers "from this endpoint, what does an attacker actually reach?"
Every command is policy-gated, logged, and replayable. The creativity is in what Puck chooses to investigate; the output is always deterministic and verifiable. If Puck tests whether an SSH key authenticates to host X, you can see exactly why it tested X, what it sent, and what came back. Every step shows its work — that's the trust contract.
SAML and OIDC for SSO, SCIM for provisioning, full audit trail per investigation — what was asked, what was run, what was found, who saw it. Exportable for compliance review.
Single Rust binary, pushed via your existing config-management (Ansible, Chef, Jamf, Intune). Brain runs on-prem or in a dedicated AWS account you own. Typical rollout to a 10K-endpoint fleet: under a week from contract to first investigation.
Early access
Three-month pilots. We run the hosted brain, you bring the IR scenarios worth solving and keep every finding. Tell us what you're working with and we'll get back to you today.