Unified Hybrid Fabric
One plane across cloud and on-premises
Supported telemetry is normalized into shared infrastructure state, with approved actions routed through connected controls.
Ollandi Platform · Powered by Ollandi 5 Preview
One operating picture, from change to response
Connect signals across your systems to understand what changed, which services are affected, and how to respond. Ollandi brings investigation, response controls, and the incident record into one workflow.
Performance and capacity
Reported performance and architecture specifications
Detection, response, and false-positive figures come from earlier PulseADT deployments. Coordination and capacity specifications are described in the Ollandi 5 paper.
<500 ms
Consensus across defense agents
For critical threats
0.8 min
Mean time to detect
Earlier PulseADT deployments
2.1 min
Mean time to respond
Earlier PulseADT deployments
1.2%
False-positive rate
Earlier PulseADT deployments
50,000+
Assets per regional cluster
Scales out by adding clusters
Architecture
How the platform connects the work
Select a layer to explore how data becomes shared context, findings, permitted actions, and an incident record.
CloudOn-premisesIdentityNetworkEndpointsApplicationsPhysical estates
Reasoning
Cognitive Security Core
Neural pattern recognition and logical inference support threat assessments. Intent hypotheses inform possible attack paths; verified feedback informs governed model updates.
- Security-native pretraining on infrastructure, tradecraft, and policy
- An explainable justification for every threat assessment
- Next-phase prediction and pre-positioned countermeasures
Hypotheses, confidence, and evidence-linked explanations
Core innovations
The reasoning capabilities behind the workflow
Ollandi 5 Preview combines specialized security reasoning with coordinated agents. These capabilities build on Glemad’s ADT and CDA research.
Neuro-Symbolic Threat Intelligence
Assess findings against context
Pattern recognition identifies suspicious behavior; logical inference relates it to entities, sequences, and policy.
Adversarial Counter-Reasoning
Assess likely attack paths
Inferred objectives and reachable dependencies help identify possible next steps and suitable countermeasures.
Zero-Latency Consensus Protocol
Coordinate domain assessments
Agents share findings and seek consensus. The paper reports sub-500 ms coordination for critical scenarios; loss of quorum triggers escalation.
Self-Evolving Defense Surface
Refine detection under governance
Confirmed incidents and analyst feedback inform staged updates. Learning cannot expand configured authority.
Continuous Evidence Generation
Preserve the decision record
Observations, checks, approvals, and outcomes remain linked for investigation and review.
In action
One attack, five domains
Follow an illustrative compromise across on-premises systems, identity, network, cloud, and backups. See how shared context informs a containment decision.
- 01
On-premises
Credentials harvested from an on-premises mail server
Domain signals: Host behavior and account activity.
Ollandi: Links the host, the account, and the cloud identity it syncs to.
- 02
Identity
Directory sync abused to gain cloud privilege
Domain signals: Directory and privilege changes.
Ollandi: Relates the new privilege to the identity and change window; assesses a possible cloud pivot.
- 03
Network
VPN pivot into cloud networks
Domain signals: Session and network-path records.
Ollandi: Attack stoppedIn this scenario, authorized session revocation and privilege suspension close the access path.
- 04
Cloud and SaaS
Data staged for exfiltration through a SaaS OAuth app
Domain signals: OAuth permissions and data-access activity.
Ollandi: In this example, the closed access path prevents this stage.
- 05
Backups
Backups tampered with to erase evidence
Domain signals: Backup access and configuration changes.
Ollandi: Backup exposure informs the response plan; the incident record remains available.
Illustrative scenario based on the cross-domain attack chain described in the Ollandi 5 technical paper.
Action classes
Control matched to impact
You decide how each class of action runs. Actions are assessed by impact and reversibility. Insufficient evidence or authority blocks execution or routes the decision to an operator.
| Class | Examples | How it runs |
|---|---|---|
| 0 · Observational | Evidence collection and increased monitoring | Within the authorized observation scope |
| 1 · Reversible containment | Session revocation, temporary network block, privilege suspension, MFA re-enforcement | Within policy, with agent consensus and rollback |
| 2 · Semi-reversible enforcement | Credential rotation, workload quarantine, deployment rollback, host isolation | Within policy, with supermajority consensus and safety verification |
| 3 · High-impact | Account disablement, broad network isolation, policy rewrite | Explicit human approval |
| 4 · Emergency | Site-wide containment, mass session termination | Pre-authorized emergency protocols with review |
Production deployment
Deployment across local, regional, and global tiers
Ollandi runs as a three-tier distributed system across cloud, on-premises, and hybrid environments.
Edge tier
Lightweight collectors in connected environments, from cloud VPCs to on-premises network segments and edge sites, filter and analyze locally to keep traffic low.
Local first-pass analysis
Regional tier
Regional clusters host the domain agents, shared memory, and consensus for their region, running active-active with automatic workload redistribution.
50,000+ assets per regional cluster
Global tier
Global services hold the authoritative entity graph, policy store, and evidence archive, and share threat intelligence across regions.
Cross-region correlation and governance
30 sAgent failover RTO
60 sRegional cluster failover RTO
5 minGlobal tier recovery RTO
Coverage
Seven domains, more than 100 integrations
Domain Intelligence Packs give Ollandi depth in cloud, identity, runtime, network, endpoint, on-premises, and ATM estates. Connections to existing systems support observation and permitted response actions.
Amazon Web Services
Cloud platforms
Microsoft Azure
Cloud platforms
Google Cloud
Cloud platforms
Glemad Cloud
Cloud platforms
Microsoft Entra ID
Identity and access
CrowdStrike Falcon
Endpoint protection
Splunk
SIEM and logs
Palo Alto Networks
Network and firewall
Ollandi Controls
You choose how much Ollandi does
Observe & Notify, Assisted Response, or Controlled Autonomous Defense, across the Domain Intelligence Packs your environment needs.
In production
An example from payments infrastructure
FAQ
Frequently asked questions
The operator-facing product for connected infrastructure investigation and response. Teams select domain coverage, review findings, and work within a configured level of response authority.
Ollandi 5 Preview, Glemad's proprietary security reasoning model, built on the Autonomous Defense Transformers and Coordinated Defense Agents model families Glemad has developed since 2020.
Ollandi adds persistent infrastructure context and hypothesis-based investigation across connected systems. Existing tools may continue to provide telemetry or enforcement. The Why Ollandi page explains how to assess fit and overlap.
Yes. Start with Observe & Notify or incident replay. Review the quality of findings and proposed actions before deciding whether to enable response.
The operating Control determines whether Ollandi observes, prepares a response for approval, or executes named actions within granted authority. High-impact actions require human approval.
The Ollandi 5 technical paper covers the architecture, threat model, action taxonomy, deployment design, and evaluation framework in full.
Get started
Evaluate the workflow on one incident
Choose an incident or service path. We will review the available context, proposed response, and evidence needed to assess the result.
- Detection, response, and false-positive figures are reported for earlier PulseADT deployments using ADT-4 Pro, with mature telemetry and defined policy baselines. They are not a benchmark of Ollandi 5 Preview. Results depend on telemetry, scope, and policy configuration. Consensus latency, scale, and failover figures are from the Ollandi 5 technical paper.