Trusted by leading enterprises and MSSPs
No. Defense is abductive work. You infer an attacker's intent from logs that look completely normal, and that reasoning barely shows up in pretraining. You can't fine-tune a skill the data never held. It has to be grown with RL against a real reward: data you can grade, and an environment that knows a good investigation from a bad one.
Holodeck. It's a deterministic, Gymnasium-compatible environment where the reward comes from machine-checkable truth, not a model's opinion. Same seed, same run, so nothing drifts and there's no LLM judge to game. The calls a machine can't make, like severity and escalation, go to expert human graders, and a held-out set catches anything trying to hack the reward.
Yes. Tasks ship as JSONL with verifiers and Inspect-compatible formats, split into train, test, and held-out. Holodeck speaks Gymnasium, so your base model drops in without a custom harness. Deterministic and assertion graders give you an RL-usable reward; rubric and human graders sit alongside as acceptance and regression signal, not the reward itself.
Verified data, a deterministic environment, expert validation, and a published eval. Take them on their own or together. Every piece is built for the RLVR toolchain you already run.
Verified security training data
Holodeck, a deterministic RL environment
Expert human validation
The Cyber Defense Benchmark
We take real attack chains and investigations across threat hunting, detection engineering, triage, and offensive security, then break them into tasks a model can be scored on. Each one carries verified ground truth wherever the work can be checked by machine. It ships as JSONL and Inspect-compatible tasks, split into train, test, and held-out.
We take real attack chains and investigations across threat hunting, detection engineering, triage, and offensive security, then break them into tasks a model can be scored on. Each one carries verified ground truth wherever the work can be checked by machine. It ships as JSONL and Inspect-compatible tasks, split into train, test, and held-out.
Drop a base model into the loop. It observes, acts, and earns a reward, learning to run an investigation the way an analyst would. The reward comes from machine-checkable ground truth, so the same seed always produces the same run. Nothing drifts, and there's no LLM judge to talk your agent past. It plugs straight into the RLVR toolchain you already run.
Severity, escalation, the judgment that separates a real analyst from a checklist: none of it comes from a generalist crowd. Career threat hunters and detection engineers grade those tasks and your model's outputs, and a held-out, human-graded set catches the reward hacking an environment can miss on its own.
A published benchmark, built to resist memorization, across the 13 MITRE ATT&CK tactics that make up a real breach. No frontier model has cleared the bar yet. Run it before you train to find the gaps, then run it again after to see exactly what moved.
Generalist vendors staff doctors, lawyers, and bankers. We staff career threat hunters and detection engineers. Security is the one domain where the ground truth has to come from people who've actually run operations, not a crowd.
Holodeck scores every investigation against machine truth. There's no reward model to drift and no LLM judge to sweet-talk. Same seed, same result, so the reward is exact and reproducible.
Every trajectory is our own IP with verified ground truth, informed by operating security through the world's largest MDRs, not sourced from their logs. We don't resell customer or production data.
We won't claim a number we haven't earned. Bring a base model, baseline it on the Cyber Defense Benchmark, train it in Holodeck, and we measure the lift together.
