XMfortress Respond
Automated response before damage is done.
XMfortress Respond does not just report, it acts: detected activity is automatically isolated or redirected to honeypots, while your security team is informed and stays in control.
- 03:14db-02 isolatedAutomatic
- 03:15Connection redirected to honeypotAutomatic
- 03:16Lock account svc-backupApproval required
- 07:40Lift isolation of app-02Recommendation
Shown with sample data
FIGRespond · Automated Response
Response in seconds
Automatic first response in the time windows where human response would come too late.
Deception as everyday practice
Honeypot redirection becomes part of daily defense instead of a research project.
Low maintenance
AI-based assessment replaces the extensive script maintenance of traditional SOAR platforms.
Full audit trail
Every action and every override documented in an audit-proof way.
01XMfortress Respond
Automated Response
- 01
Detect what deviates from the norm
XMfortress Respond learns the normal behavior of your environment: sign-in patterns, data flows, typical applications and network paths. Deviations are assessed with trained models, not static thresholds.
- 02
Isolate before damage is done
In the case of a well-founded anomaly, the affected system is cut off from critical zones within seconds – reversible, logged and with manual override.
- 03
Redirect to honeypots
Attacker activity can be redirected into a controlled honeypot environment. Behavior, tools and targets feed back into your own detection.
- 04
Human in the loop, always
XMfortress Respond acts within your policy – from recommendation through approval to fully automatic, depending on severity, zone and risk approval.
02Respond
The policy model
You define which actions XMfortress Respond may carry out on its own – in line with your maturity, risk appetite and regulatory requirements.
| Action class | Description | Typical setting |
|---|---|---|
| Recommendation | XMfortress Respond recommends an action without carrying it out. | Low severity |
| Approval | The action requires approval by the SOC. | Medium severity |
| Automatic | The action is carried out immediately and logged. | High severity, clear indicators |
| Manual override | Every action can be overridden at any time. | Always active |
03Respond
XMfortress Respond compared
| EDR alone | SOAR platform | Respond | |
|---|---|---|---|
| Detection | Endpoint focus | Data source agnostic | Behavior-based, multiple sources |
| Response | Limited | Script-based, maintenance-heavy | Policy-based, AI-assessed |
| Deception/honeypot | Not included | Only via integration | Natively integrated |
| Maintenance effort | Medium | High | Low |
| Audit readiness | Variable | Variable | Built in by design |
04Platform
Seven products. One brand.
05FAQ
Frequently asked questions
Does XMfortress Respond act without approval?
Only where you allow it. For each action class, you decide whether XMfortress Respond recommends, waits for approval or acts automatically. Override is always possible.
Are the actions reversible?
Yes. Isolations and redirections are reversible and fully logged.
How is XMfortress Respond introduced?
Together with your organization: action classes, escalation paths and honeypot profiles are defined in a structured onboarding before the agent goes live.
Know your exposure.
Control your risk.
6Contact
Talk to us about your attack surface, your priorities and the right way to get started with XMfortress.