Elastic, Guardsix, Gurucul and Securonix

About Guardsix

Guardsix is a European security company that sells a sovereign security platform for lean defenders, with products for SIEM, NDR, SOAR, fleet management and access governance.^[1][14]

Guardsix says its platform is aimed at European organisations that protect society, such as energy, healthcare and public services, and the partners who serve them. Guardsix says cloud-first security shifts control away from defenders while leaving accountability behind, and says it closes that gap by giving customers control over their data, deployment and operations. Guardsix says it designs for European legal and operational requirements, partners with regional cloud providers, and offers on-prem and sovereign-ready deployments. Guardsix offers on-demand or instructor-led training to help analysts grow from day one.

Guardsix SIEM is for lean teams defending Europe in energy, healthcare and government, and for the MSSPs who serve them. Guardsix says it delivers sovereign log management across hybrid, on-prem, OT and cloud environments, and continuous audit-ready evidence for NIS2, DORA and GDPR Article 32. Guardsix SIEM is self-hosted and air-gappable, and its pricing is node-based, so spend scales with the infrastructure rather than with data volume. Content packs aligned with NIS2, DORA and GDPR requirements are ready to use. Guardsix SIEM brings logs from IT estates, OT environments, identity systems, network devices and applications into a single instance that the customer controls.^[7][9][11]

Guardsix NDR pairs with Guardsix SIEM as one platform with a chain of events across IT and OT. Guardsix says it uses machine-learning analytics and stitches related signals into a timeline across the seven phases of an attack. Guardsix says Guardsix NDR is designed so any analyst on a lean team can use it productively from day one. Guardsix SOAR is the automation and response layer of Guardsix SIEM, and its playbooks execute locally. Alerts from Guardsix SIEM and NDR enter SOAR with full context already attached, and Guardsix SOAR can expand with hundreds of additional integrations across EDR, identity, cloud and OT.^[9][10]

Guardsix Governance for Healthcare gives hospital IT and compliance teams the visibility, reporting and audit trails that healthcare regulators expect. Guardsix says the access control model it built first for healthcare applies to any regulated environment where access has to be visible, explainable and defensible.^[12]

Guardsix describes two audiences. For critical national infrastructure operators, Guardsix says it helps them. Guardsix points to hospitals, energy grids, water management and transportation as systems whose failure harms communities. Guardsix says it prices by the number of nodes, devices or entities in an environment.^[13]

Guardsix was formerly Logpoint, which officially announced its transformation into Guardsix on March 12, 2026. Guardsix traces its history to a company founded in Denmark as a cybersecurity consulting business. Swedish investment firm Summa Equity acquired a majority stake in Logpoint, and Guardsix names Summa as its majority investor. Logpoint acquired the Danish cybersecurity company Muninn, specialised in AI-driven NDR. Logpoint also acquired the Israeli company SecBI, specialising in SOAR, XDR and automated threat detection. Mikkel Drucker joined Logpoint as CEO. Guardsix A/S carries the company reg. no. 26 30 19 39, and Guardsix says it is EU-HQ and EU-governed.^{[1][2][5][10][11][12]}

About Gurucul

Gurucul sells unified Entity Intelligence, which fuses Behavioral AI with traditional detections across humans, machines and AI systems. Gurucul REVEAL is a cloud-native engine architected to federate analytics across globally dispersed, heterogeneous environments. The Entity Intelligence Engine from Gurucul includes 5,000+ glass-box ML models and patented Link Chain Analysis. Gurucul has been focused on R&D and engineering for more than a decade.^[1][4][5]

Gurucul has an open architecture that allows customers to replace a SIEM or augment a stack. Gurucul can be deployed as SaaS, cloud, on-premises or hybrid. Gurucul offers 10,000+ content items and a native Data Pipeline Manager. Gurucul uses Agentic AI across the threat lifecycle for triaging, escalating and responding. Gurucul's Virtual AI SOC Analyst performs L1 evidence gathering. Gurucul provides a native AI assistant and federated search across a customer's data ecosystem. Gurucul NG-SIEM maps ML detections directly to regulatory frameworks including NIST 800-53, PCI DSS, and HIPAA. Gurucul REVEAL identifies over-privileged accounts, rogue credentials, and subtle lateral movement.^[1][5]

Gurucul Data Optimizer filters, deduplicates, and down-samples logs. Gurucul Data Optimizer is built natively into the Gurucul SIEM platform and consolidates ingestion control, filtering, real-time transformation and contextual enrichment into a single engine. Gurucul can route specific streams to any SIEM, XDR, or low-cost cold storage while keeping the ability to search and replay data for compliance and forensics. Gurucul lets customers pick from a library of built-in integrations, spin up custom connectors, or request a new one in 48 hours. Gurucul offers storage in a customer's data lake, a 3rd-party SIEM, on-prem, or Gurucul storage. Gurucul defines security data pipeline management as the process of filtering, enriching, and routing security telemetry before it reaches downstream tools like SIEM, XDR, and data lakes. Upwork modernized its SOC with Gurucul's Next-Gen SIEM.^[1][4][5][7]

Gurucul SOAR includes built-in response playbooks for use cases including incident response, threat hunting, vulnerability management, and compliance reporting. Gurucul SOAR integrates with downstream security solutions to block, disable or isolate risky users and entities. Gurucul SOAR customers can add micro playbook services to standard processes and link them together in workflows for different remediation paths. Gurucul's dynamic risk engine normalizes risk scores from 0-100. Gurucul Open XDR includes a library of customizable response playbooks, federated search across the data fabric, and link analysis for contextualizing incidents. Gurucul Open XDR incorporates identity and access analytics with user behavior to detect, prioritize, and respond to identity-based attacks. Gurucul Open XDR is cloud-native, open, and architected to federate security analytics across globally dispersed cloud and hybrid infrastructures. Gurucul lets analysts perform federated searches to query decentralized security and observability data.^{[1][8][9][10]}

Gurucul Identity Analytics (IdA) gives analysts a real-time, 360-degree view of activity on-premises, on mobile devices, and in the cloud. Gurucul Identity Analytics gives security teams dynamic risk scores and analytics data that help inform provisioning, de-provisioning, authentication, and privileged access management. Gurucul Identity Analytics addresses Segregation of Duties (SoD) violations and toxic combinations of access. Gurucul Identity Threat Detection and Response (ITDR) delivers real-time insight into the identity attack surface and gives security teams visibility into over-privileged, rogue, orphaned, or compromised accounts. For cloud security monitoring, Gurucul ships with 5,000+ machine learning models out-of-the-box. Gurucul offers data masking capabilities that let security teams run analytics across geographically dispersed cloud environments.^[11][12][13]

Gurucul offers a product that connects AI activity with the people, machines, access, and data around it. Gurucul shows every AI agent, model, and tool in use, and who owns it. Gurucul gives insider risk teams one entity risk score across employees and AI agents. Gurucul combines UEBA capabilities with identity and access analytics for healthcare insider threat teams. Gurucul uses user and entity behavioral analytics, with 97% alignment with the MITRE ATT&CK framework, and integrates healthcare threat intelligence from CISA and Health Information Sharing and Analysis Center.^[3][4][14]

Gurucul delivers healthcare cybersecurity solutions to detect real-time threats, streamline compliance, protect patient data, and minimize the attack surface. Gurucul unifies relevant data including Security, Network, IT, IoMT, OT, Cloud, Identity, Electronic Health Records (EHR) and priority application data. Gurucul establishes behavioral baselines for each medical device and monitors activity patterns such as volume, time, location, and network flows. A large Midwest U.S. healthcare organization with over 14 hospitals and 29,000 employees turned to Gurucul to prevent insider threats and protect and update medical devices storing patient health information. Gurucul describes MSSPs as needing an open and flexible security analytics platform to tailor detections, investigations and response to their customers' requirements. For regulated industries, Gurucul names NIST, PCI DSS, HIPAA and GDPR, with on-prem, multi-cloud or hybrid deployment. Gurucul addresses enterprises and regulated mid-market organizations.^{[4][5][6][14][15]}

About Securonix

Securonix sells Unified Defense SIEM, which it describes as a connected operating model for modern SecOps for enterprises. Securonix Unified Defense SIEM brings together SIEM, UEBA, SOAR, ThreatQ intelligence, Data Pipeline Manager, ThreatWatch, and Sam, the AI SOC Analyst. Securonix unifies analytics, threat intelligence, investigation, and response into a single cloud-native platform. Securonix says enterprises and MSSPs rely on it to modernize security operations, reduce operational risk, and move toward proactive, intelligence-driven defense.^{[1][2][4][8][11]}

Sam, the AI SOC Analyst, is embedded directly into the Unified Defense SIEM and is designed to work alongside human analysts, not replace them. Sam executes Tier 1 and Tier 2 work across triage, investigation, and response within the Securonix Agentic Mesh. Securonix coordinates AI agents across detection, investigation, and response through the Agentic Mesh, with human oversight. The Securonix Agentic Mesh coordinates specialized agents while Agentic Guardrails keep AI-supported work policy-bound, explainable, and auditable.^[4][8][9]

Securonix also describes AEBA as extending behavioral analytics beyond humans to detect abnormal AI agent behavior.^[4]

On the SIEM side, Securonix unifies threat detection, investigation, and response on Snowflake's Data Cloud. Securonix offers over 500 connectors that ingest data from across a hybrid infrastructure. Securonix describes its built-in SOAR as an integration between SIEM and SOAR that puts all of the data in one place. Securonix threat models map to both the MITRE ATT&CK and US-CERT frameworks. Securonix describes a scalable data lake with fast access to one year of hot data for investigations, threat hunting, and response.^[10]

Securonix ThreatQ is a threat intelligence platform. ThreatQ is now part of Securonix and brings curated threat intelligence into the Securonix security operations portfolio. Securonix ThreatQ integrates across SIEM, SOAR, EDR, NDR, cloud platforms, case management systems, and intelligence sources. Securonix ThreatWatch helps security teams move from emerging threat awareness to exposure validation. ThreatWatch is available as an add-on service and is not included with every deployment. Securonix Threat Research Agent is a bring-your-own-LLM agent built into the ThreatQ platform. Securonix lists Data Pipeline Manager for telemetry routing, retention, and cost control.^{[4][8][11][12]}

Securonix is headquartered in Addison, Texas, with offices in India, California, Georgia, New Jersey, the United Kingdom, Germany, and Singapore. Securonix is backed by Vista Equity Partners. Securonix says it is a chosen cybersecurity provider for 1,000+ enterprise and MSSP customers. Its pages feature a customer interview with the EVP and CISO of HDFC Bank. Securonix also runs training courses, and each learning credit provides up to four hours of instruction.^{[3][4][9][10][12][14]}