Augmenta operates a fully automated CSOC, supported by a small portfolio of bespoke platforms. Each is in production today, each is governed under our operating model, and each is identity‑bound to a Vault‑managed zero‑trust identity plane.
Xaelo is our custom software platform for strict compliance, fraud prevention and budget efficiency. It acts as the central backbone of our security team - pulling in data, adding helpful context, labelling the threat type, and passing each case to the right level of engineer.
Unlike standard commercial security-automation tools (SOAR) that take months of tedious coding to set up, Xaelo is shaped to our operating model from the ground up - which lowers operational cost and shortens onboarding.
It is split into small, locked, heavily encrypted compartments. To log into Xaelo, users must first go through our master security gatekeeper, which controls access to every other company server and database.
Our HashiCorp Vault deployment is the foundation of our identity model. Human access is mediated by Active Directory via LDAP; applications authenticate via AppRole with response‑wrapped SECRET_IDs. Database access uses dynamic credentials, scoped per‑application.
Every privileged operation is logged with a request identifier, source address and authenticated identity, and shipped to our SIEM. If audit logging fails, the platform fails closed.
| Domain | Examples | Scope |
|---|---|---|
| Vault platform | vault‑admin, vault‑operator, vault‑auditor | Platform administration, KV, audit |
| CSOC operations | csoc‑tier1, csoc‑ir, csoc‑engineer | Tiered, secret/csoc/** |
| Applications | fga‑app, sirp‑backend, soc‑triage | AppRole, per-app KV + dynamic DB |
Manager and Auditor roles are explicitly forbidden from overlapping - verified weekly.
Tiko‑Ceemo is our state‑change alerting service. It dispatches critical alerts over the Meta WhatsApp Business API and piggy‑backs over the WhatsApp messaging tunnel, improving the movement of the traffic. Alerts fire only on state transitions, which keeps the channel meaningful and within WhatsApp’s policy envelope, and minimises data‑costs to engineering and technical staff.
The implementation supports multiple recipients, runs against a temporary or permanent system‑user token, and is ready for an optional webhook to receive delivery status and replies.
Sentinel continuously compares firewall configurations against a client‑specific baseline and against industry standards. Each drift produces a finding: severity, owner, recommended remediation, and the diff that caused it.
Findings are shipped to the SIEM and surfaced in a living register, queryable by analyst tier or by client unit. The output is evidence, not a static PDF.
| Severity | High |
| Rule | Inbound ANY → mgmt port |
| Baseline | Deny outside corp‑jump |
| Detected | 2026‑05‑21 09:14 UTC |
| Owner | Platform/Networks |
| Remediation | Restrict source, request change ticket |
A structured platform that allows us to securely report incidents to the regulators of the markets we operate in. It enforces consistent reporting taxonomy, supports redaction policies, and produces a signed submission envelope that the regulator can verify independently.
The platform also archives historical submissions. When a regulator asks “has this happened before, and what did you do?” the answer is a query, not a project.
We can step through any of these platforms under NDA, including the operating manual and a sanitised audit trail.