SİBERAT
SİBERAT AX is a self-hosted security operations platform for IT and operational technology.
What SİBERAT is
SİBERAT AX is a self-hosted security operations platform for IT and operational technology. A branch appliance analyzes network and industrial protocol data, while a central appliance receives decisions and supporting evidence; raw packets and logs remain at the branch. The platform lists six detection surfaces: NDR, OT/ICS, ITDR, deception, IDPS signatures, and agentic AI. Industrial protocol support includes BACnet, DNP3, MMS, Modbus, OPC-UA, S7comm, EtherNet/IP, GOOSE, and IEC-104. Events are normalized to OCSF, with 41 protocol profiles, including 19 industrial profiles, and 16 extension event classes. The agent uses a defined tool catalogue, cites evidence in verdicts, and has an autonomy ceiling based on asset criticality, evidence strength, and action reversibility; some actions may require approval from a named operator. Listed security controls include mTLS, tenant isolation, signed firmware updates with rollback, and leased secrets. The product is aimed at critical infrastructure, public sector, and enterprise customers. Pricing is available on request. Endpoint enforcement, long-term raw-log archiving, cloud hosting, and free-form model queries are out of scope.
Good
- Raw packets and logs remain at the branch
- Covers six listed detection surfaces
- Supports a range of industrial protocols
- Agent verdicts cite evidence
- Firmware updates are signed and support rollback
Watch out
- Pricing is available only on request
- Endpoint enforcement is out of scope
- Long-term raw-log archiving is out of scope
- Cloud hosting is out of scope
Who it suits
SİBERAT AX is aimed at critical infrastructure, public-sector, and enterprise customers handling IT and operational technology. Its self-hosted two-appliance deployment is relevant to organizations that want raw packets and logs to stay at the branch.
Verdict
SİBERAT AX pairs branch-level analysis with central decisions and evidence, while keeping raw packets and logs at the branch. Organizations should weigh its self-hosted footprint and stated scope limits against their operational needs.
The facts
Each one read from SİBERAT's own pages, with the date it was checked.
What it does
- Agent controls
- The agent uses a defined tool catalogue, cites evidence in verdicts, and has an autonomy ceiling computed from asset criticality, evidence strength, and action reversibility.checked 9 Oct 2026
- Agent safeguards
- The agent uses a defined tool catalogue, cites evidence in verdicts and has an autonomy ceiling that can require approval by a named operator.checked 9 Oct 2026
- Data handling
- The page says raw packets and raw logs stay at the branch, while decisions and evidence travel to the centre.checked 9 Oct 2026
- Deployment
- The stated footprint is two appliances: a sensor at the branch and a brain at the centre.checked 9 Oct 2026
- Deployment footprint
- The product uses two appliances: a sensor at the branch and a brain at the centre.checked 9 Oct 2026
- Detection coverage
- Its six detection surfaces are NDR, OT/ICS, ITDR, deception, IDPS signatures, and agentic AI.checked 9 Oct 2026
- Event normalization
- It describes 41 OCSF protocol profiles, including 19 industrial profiles, and 16 OCSF extension event classes.checked 9 Oct 2026
- Integrations
- The page describes central response actions and vendor connectors, with intake, enrichment, and action on separate privileges; it does not name specific connector vendors.checked 9 Oct 2026
- Integrations and intake
- The page lists syslog, CEF, LEEF, key-value and positional log formats, Windows event collection via WEF/WEC or WinRM, and vendor connectors.checked 9 Oct 2026
- Intended customers
- The maker describes its solution scenarios as focused on critical infrastructure, public sector, and enterprise customers.checked 9 Oct 2026
- Limits
- The page says endpoint enforcement, long-term raw log archiving, cloud-hosted service, and free-form model queries are out of scope.checked 9 Oct 2026
- Normalization and storage
- SİBERAT AX normalizes records to OCSF and stores queryable events, summaries and evidence in a columnar store with governed retention.checked 9 Oct 2026
- Notable limits
- Endpoint enforcement, long-term raw-log archiving, cloud hosting and free-form model queries are listed as out of scope.checked 9 Oct 2026
- OT protocols
- Its industrial protocol analyzers cover BACnet, DNP3, MMS, Modbus, OPC-UA, S7comm, EtherNet/IP and GOOSE.checked 9 Oct 2026
- Product scope
- SİBERAT AX is an agentic security operations platform for OT and IT that analyzes data at branch appliances and provides context centrally.checked 9 Oct 2026
- Raw data handling
- Raw packets and logs stay at the branch; the centre receives decisions and their supporting evidence.checked 9 Oct 2026
- Security
- The product page lists end-to-end mTLS, tenant isolation, signed firmware updates with rollback, and leased rather than embedded secrets.checked 9 Oct 2026
- Security controls
- The stated controls include mTLS uplinks, tenant isolation, signed firmware updates with rollback, and leased rather than embedded secrets.checked 9 Oct 2026
- Support
- The maker says demo, proof-of-concept and architecture-workshop requests reach its technical team within 48 hours.checked 9 Oct 2026
- Support and sales
- The maker says demo, proof-of-concept, and architecture workshop requests reach its technical team within 48 hours.checked 9 Oct 2026
- What it does
- SİBERAT AX is an agentic security operations platform for IT and OT that analyzes network and industrial protocol data at branch appliances and sends decisions and evidence to a central system.checked 9 Oct 2026
The company
- Founded
- 2020checked 28 Sep 2026
- Headquarters
- Çankaya, Ankara, Türkiyechecked 28 Sep 2026
Money
- Industrial protocols
- The product lists support for BACnet, DNP3, MMS, Modbus, OPC-UA, S7comm, EtherNet/IP, GOOSE, and IEC-104.checked 9 Oct 2026
Alternatives to SİBERAT
- 1
MISP
Free planOpen sourceWebAPILinuxSelf-hosted7.9From €7.31 a year - 2
Pulse Intelligence
Free planWebAPILinuxmacOS6.8Free plan - 3
Google Cloud Secret Manager
Free planWeb6.5From $0.02 a month - 4
Kaspersky Threat Intelligence Portal
Free planWebAPI6.5Free plan - 56.5From $4,550 a year
- 6
IBM X-Force Exchange
Free planWebAPI6.3Free plan