UK security provider e2e-assure has updated Cumulo, an AI-first security-operations platform designed for organisations spanning information technology and operational technology. The company positions local models, customer-specific context and digital twins as a sovereign response to machine-speed threats.
The architecture’s most important choice is separation: the SIEM remains the deterministic system of record while AI analyses alongside it. That preserves evidence even when model conclusions change.
A digital twin supports testing where live systems cannot
Cumulo passively discovers IT and OT assets to maintain a representation of the customer environment. Security teams can simulate attacks and identify exposure without probing live industrial systems where an aggressive test could interrupt essential operations.
The twin must remain evidence-accurate. Stale topology, missing assets or misunderstood dependencies can create false confidence, so discovery coverage and update delay need explicit measurement.
New threat intelligence can be translated into detection rules quickly, which e2e-assure describes as a “zero-day SOC.” Immediate rule creation is useful, but organisations should distinguish an emerging indicator from proof that a previously unknown vulnerability can always be prevented.
Human analysts remain central. AI can correlate alerts and rank fixes, while cleared specialists judge risk and authorise response in environments where an automated containment action might affect physical processes.
Local models keep sensitive operational context under control
Customer-dedicated language models run in sovereign infrastructure and learn the organisation’s environment. Local inference reduces exposure of network knowledge and preserves capability during external cloud disruption.
Cumulo uses layers: a local model handles sensitive analysis, a broader security-intelligence layer correlates threats and frontier models provide non-sensitive enrichment. Routing rules must ensure operational details do not leak upward through prompts or generated summaries.
Multiple models cross-check investigations, and an anti-hallucination layer compares findings with threat intelligence and deterministic engines before an analyst sees them. Independent evidence is more valuable than several models repeating the same unsupported inference.
Administrators need records of the evidence, model version, disagreement and final analyst decision. Those traces support incident review and reveal when automation consistently misreads one part of the estate.
Sovereignty is valuable when it improves continuity and proof
Critical infrastructure operators care about data residency, but availability during a crisis is equally important. A defensive capability dependent on a remote service can disappear during connectivity failure or geopolitical restriction.
Local operation introduces responsibilities for patching, model updates, capacity and physical security. Buyers should test degraded modes and understand which features still require outside intelligence.
Cumulo’s tiers range from investigation and threat hunting to unified IT/OT monitoring and predictive digital-twin work. Organisations should choose according to operational maturity rather than assuming the most autonomous package is safest.
Procurement should examine integration with the existing SIEM and incident process. Analysts need one coherent case rather than parallel consoles that disagree without explaining why. Response tests should include loss of external connectivity, corrupted telemetry and a model outage, proving that deterministic detection and human operations can continue on their own.
The source is a vendor announcement, so claims of uniqueness and performance require customer evidence and independent testing. A proof of concept should use representative logs, known incidents and measured false positives.
It should also measure analyst workload before and after deployment, including the time required to challenge or correct AI findings.
The platform addresses a real design problem: security teams need AI speed without surrendering the evidence and authority required for consequential action.
Cumulo’s layered approach is strongest when the models remain assistants to a verifiable security process. Sovereignty then becomes more than national branding. It means the organisation retains its data, defensive capability and record of truth when external services—or the models themselves—cannot be trusted to remain continuously available.
