Collateral, research, and how to reach us.
Whitepapers, solution descriptions, datasheets, role briefs and engineering notes. Nothing is listed here before it exists — where an item is still in preparation this page says so, so you never spend a click finding out.
Learn the platform
The same curriculum our customers get inside the product, open to anyone. No sign-up, no demo booking, no form.
EventLake Academy
Twenty-one lessons in five tracks — reading an alert to a verdict, the one gate every automated action passes, posture ranked by reachability, and what a blank board means. Each carries a stated objective, worked examples carried through to a verdict, and the documentation it is built from. Two of the five ways we teach these need an estate of your own, and this page says which and why rather than faking them.
21 lessons · 5 tracks · no sign-upGetting started
Five steps from nothing to your first event coming back, each one a link into the operations manual that does the work rather than a copy of it.
5 steps · links into volume 05Whitepapers, method & engineering notes
The long-form technical arguments — architecture, assurance, coverage gates, and the reasoning behind the design decisions.
Notes on Active Defense
Eleven papers on the architecture of active defense — the two-plane thesis, explainable alerts, legitimacy, bounded autonomy, evidence, coverage honesty, and what it means to install the most privileged software in your estate. Opens with the eight-page platform booklet.
11 papers + booklet · indexProblem Pamphlets & Syndication Feeds
Recurring single-problem briefs solving one common operational problem per issue across SOC Weekly, Enterprise & Audit Biweekly, and Buoy Consumer Monthly tracks — plus RSS 2.0, JSON Feed 1.1, and zero-OEM paradigm contrasts.
3 tracks · RSS & JSON feedsTrust & assurance brief
How the platform is built, tested and operated — written for a review team rather than a buyer. Eight things you can verify without taking our word, our disclosure commitments, and a deliberately non-empty list of what is still outstanding.
4 pp · PDFMethod · Claiming an AI attack name
When a detection may claim an adversarial-ML or agentic-AI technique identifier, and when it may not — why behavioural proxy rules are separated from direct model-telemetry proofs.
method note · HTMLCoverage gates
How build-time CI guards compare every published detection count on this website against the running detector registry so coverage numbers cannot be inflated by hand.
assurance proof · HTMLEngineering notes
Six architectural decisions we would defend — single-record storage, Ed25519 sealing at ingest, dual-control actuation, and what each trade-off cost.
6 essays · HTMLSolution descriptions
What the platform does for one problem, end to end, in the language of the team that owns it.
OT & ICS security
Where availability is the safety control and the response that is correct on a laptop is a safety event on a controller. What runs unattended, what only ever proposes, and why the boundary is where the value is.
1 p · PDFUnified SIEM + UEBA on a sealed lake
Correlation and behavioural analytics over one substrate instead of stitched across panes. A baseline is a query over the same sealed events the correlation rules saw — so a finding traces to what the system actually observed, not to what a re-run returns today.
3 pp · PDFMulti-regime data governance
Consent, subject rights, erasure and grievance across regimes that make different demands of the same record. Retention carries its basis, erasure destroys a key rather than a haystack, and every finding cites the provision that governs it.
3 pp · PDFBriefs by estate & role
Where the shape of the estate or the evaluation seat changes the engineering — written for the team that runs one, not as a vertical brochure.
Regulated financial services
Where the supervisory question is not "were you attacked" but "can you demonstrate what you knew, when, and what you did about it" — an estate old in layers, supervised continuously, and where availability is itself a regulated outcome.
2 pp · PDFMSSP and multi-tenant operations
Where crossing customer boundaries is the job rather than the exception, margin is a function of analyst minutes, and you inherit every customer's retention, residency and erasure rules — which do not agree with each other.
2 pp · PDFCloud-native and Kubernetes estates
Where the subject of an alert may not exist by the time anyone reads it, most identities are not people, and the control plane is the estate — so the workload, not the container, has to be what an alert names.
2 pp · PDFDatasheets
The specification sheets — what is covered, what integrates, and what it takes to run. Every figure on these carries the date it was measured and the machine it was measured on.
Coverage transparency sheet
Measured detection coverage per framework, dated, with the gaps that exist by construction named rather than omitted.
in preparationIntegration catalogue
Every built-in source with its protocols and formats, the OT/IIoT set, and the signed plugin path for proprietary formats — counted from the running registry, not from a list maintained by hand.
generated · per releaseSizing & TCO
The written companion to the calculator: how the numbers are derived, and where the processing-cost advantage comes from.
in preparationPamphlets
The short form — one page, for a desk or a stand.
Platform one-pager
One lake, two planes, every capability an event consumer — the whole thesis on a single printable page, including what consolidation costs.
1 p · PDFLicensing explainer
One meter per product line and every capability inside a line included — why there is nothing to upsell you once you are in one, and the distortion this meter still carries.
1 p · PDFFliers by role
One page each, by audience. The OT & ICS sheet is the same file listed above as the OT solution description.
For security leadership — the platform line
Your platform should stop things, not just tell you about them: one event model where the thing that observes is also the thing that enforces.
1 p · PDFFor security leadership — the verification line
You already accept documents you cannot check. Asking the issuer rather than inspecting the paper, with every check kept as an event you can produce later.
1 p · PDFFor heads of security operations
Your queue is not too long — it is full of the wrong work. Separating unusual from unauthorised, with verdicts that cite the ticket and expire with it.
1 p · PDFFor identity and access programme leads
You finished the hard part; the adversary moved to the easy one. What a session is still asserting eight hours after a phishing-resistant sign-in.
1 p · PDFFor data protection officers and privacy counsel
Security telemetry is personal data and the defensive purpose does not suspend the obligation. Retention as a property of the record class; erasure that destroys a key.
1 p · PDFFor governance, risk and compliance leads
Fourteen months later: what did you know, when, and what did you do? Why an alert that keeps a query decays silently, and what it costs at the moment you need it.
1 p · PDFFor operations and engineering leadership
The response that is correct on a laptop can be a safety event on a controller. Where the platform proposes and a person with process authority decides.
1 p · PDFGeneral enquiries
Questions about the platform, an evaluation, partnership or procurement — write to us and a person will answer. For a walkthrough on your own data, book a demo instead; to report a security flaw, use the disclosure page, which runs under a published response commitment rather than a mailbox.
Available now
Not collateral — live tools and published records you can use today.
Platform support matrix
Every capability the agent ships, per platform, with the grade of evidence behind each cell. Generated from the agent's own catalogue — no hand-written cells.
generated · per releaseSizing calculator
Size a deployment from your estate inventory or from raw volume, SaaS and on-premise side by side.
interactiveSecurity & vulnerability disclosure
The published disclosure programme, its advisories, and the door to report a flaw.
RFC 9116