You decide how much Weft does on its own.
Some teams want every block in front of a human. Others want silence until something is contained. The autonomy dial sets that posture, changes whenever you do, and tunes by asset or action type.
Try the dial.
Four positions, set per asset class or action type. Most customers run more than one at a time.
Weft watches. People decide.
Weft detects, correlates and alerts with the full case attached. Nothing changes in your environment until a person acts.
- weft doesDetect, correlate, build the case
- you doEvery response decision
- good fit forRegulated systems and the first weeks of onboarding
Weft proposes. One tap sends it.
Weft builds the case and drafts the response. An analyst reviews the evidence and approves from the portal or the mobile app.
- weft doesDraft the response with evidence and rollback
- you doApprove or reject
- good fit forServers, executives and anything business-critical
Contain first, then explain.
Weft contains threats within the limits you set and immediately tells the on-call analyst what it did, why, and how to undo it.
- weft doesIsolate, revoke and block within policy
- you doReview after the fact
- good fit forLaptops, standard users and known attack patterns
Quiet until it matters.
Weft acts within policy and reports in a daily digest. Anything outside policy, or above a severity you choose, still pages a person.
- weft doesHandle routine containment end to end
- you doRead the digest and handle exceptions
- good fit forMature programs with well-tuned policy
Quarantine from your pocket.
The Weft app puts the full case in front of the on-call person: what happened, which sources agree, how confident Weft is, and what it wants to do next. One tap and a Face ID check quarantines the host. Another tap rolls it back.
- Push alerts with the evidence attached, not just a ticket number
- Step-up verification on every high-impact action
- Every tap written to the same audit record as the portal
- Rollback from the same screen that took the action
Guardrails at every position.
Autonomy only works when it’s accountable. These hold no matter where the dial sits.
Step-up for high-impact actions
Isolating a host or disabling an account requires fresh verification, separate from the session, so a stolen session token can’t authorize damage on its own.
Recorded and reversible
Each action carries its evidence, the policy that allowed it and a path to roll it back, in an audit record that can’t be edited after the fact.
On the web and on your phone
Review cases, approve recommendations and move the dial from the portal or the mobile app, wherever the on-call person happens to be.
See Weft run against your own stack.
Bring the tools you already own. We’ll show you what they can see together.