Ollandi Controls
You choose how much Ollandi does
Observe & Notify, Assisted Response, and Controlled Autonomous Defense, from visibility only to containment within your policies.
Ollandi Platform
Controlled Response
Turn an investigated threat into a bounded response plan. Ollandi checks proposed actions against policy, authority, service dependencies, and reversibility, then routes them for approval or executes within the scope you grant.
Overview
A response plan with explicit execution limits
Choose operator-approved response or pre-authorized execution. Evidence and runtime checks determine whether a proposed action may proceed.
Candidate actions include session revocation, temporary access restrictions, and workload isolation. Scope and impact determine the checks and approvals required.
- Session and token revocation
- Access-path and network blocks
- Workload and host isolation
Execution requires an active authority grant and applicable policy. Missing context, excessive service impact, or insufficient confidence can block an action or trigger escalation.
- Runtime policy and authority checks
- Blast-radius and dependency checks
- Separation of duties built in
Post-action checks assess containment and service health. Supported reversible actions have rollback procedures; disruption, confidence changes, or an operator override can trigger reversal.
- Outcome verification
- Automatic rollback
- Residual-risk review
How it works
From proposed action to verified result
Each step records its inputs, checks, and result. Failed checks return the decision to an authorized operator.
Decide
Select a proportionate action for the suspected threat and affected scope.
Check
Check policy, authority, confidence, dependencies, and rollback requirements.
Contain
The permitted action runs through your infrastructure's own controls.
Verify
Measure containment, service health, and remaining exposure.
Record
The evidence of every step is kept for audit and review.
Attackers move at machine speed. Defense has to move faster, and it has to prove every move it makes.
David Idris, CEO, Glemad
More from Ollandi
Explore related capabilities
See
Realtime Visibility
Investigate changes, dependencies, and evidence gaps.
Learn moreVerify
Continuous Evidence
Inspect the chronology and provenance behind an incident.
Learn moreTrust
Safe autonomy
Review uncertainty, escalation, revocation, and evaluation.
Learn moreOllandi Platform
Platform overview
Explore the product workflow and deployment options.
Learn moreFAQ
Frequently asked questions
Observe & Notify does not change infrastructure. Assisted Response requires operator approval. Controlled Autonomous Defense permits named actions within active policy and authority; high-impact actions require human approval.
Checks cover current policy, active authority, confidence, blast radius, dependencies, timing, and recovery requirements. An earlier approval does not bypass runtime validation.
Verification gates assess the effect before dependent actions proceed. Eligible actions can be rolled back on disruption, confidence changes, or override; unresolved effects are escalated and recorded.
Earlier PulseADT deployments reported a mean response time of 2.1 minutes. This is historical deployment data, not an Ollandi 5 benchmark or response-time guarantee. Timing depends on telemetry, approvals, action type, and the connected system.
Get started
Review a proposed containment path
Bring an action your team handles today. We will review permission, service impact, approval, and recovery requirements.