Product · Features
Every capability, side by side.
Every feature of every Centeye product in one matrix: what it detects, how it correlates the same person across products, how it responds, and who stays in control.
Every product includes
One platform under every product.
One multi-tenant console for every client
Each client is its own tenant with its own rules, MSP dial settings and weekly report. Your team works every client from one place.
- Multi-tenant from day one
- Rules and dial settings per client
- Weekly report per client
One case per incident
Every signal is linked to the rest of the attack: the same person or identity across identity, endpoint, email, AI use and AI agents.
The MSP dial
Every response runs automatically or waits for approval. The MSP or admin sets it per client and per action.
Every fix checked
Each response is checked afterwards at Microsoft or Google, and undone where the provider allows.
Tickets and alerts where you work
Tickets in standard PSA tools. Alerts in Microsoft Teams, Slack and email.
A weekly report per client
A plain-English summary of what happened and what was done, for each client.
The capability matrix
Every feature, product by product.
Each row is a feature. The columns show whether it detects, correlates the same person or identity across products, or responds, and who controls it. Every response sits on the MSP dial: the MSP or admin sets it to run automatically or wait for approval, per client and per action.
| Feature | Detects | Correlates | Responds | Control |
|---|---|---|---|---|
| AI security | ||||
| Centeye Lumen AI governance and registry · Microsoft 365 · Google Workspace · Chrome and Edge · Windows Explore → | ||||
| Every AI tool in use, by whom, with an owner and a review date | ● | – | – | Always on |
| Company data pasted or uploaded into AI tools, including personal accounts | ● | – | – | Always on |
| AI apps connected to mail and files, and old consents still open | ● | – | – | Always on |
| Each browser action, a paste, an upload, a personal sign-in, against your policy | ● | – | – | Always on |
| Company data sent to an AI tool tied to the same person’s identity risk (Gatewatch) and device (Ironwatch) | – | ● | – | Always on |
| Give every AI app an owner and a 90-day re-approval | – | – | ● | MSP dial · auto or manual |
| Revoke an AI app’s access (checked at the provider, restorable) | – | – | ● | MSP dial · auto or manual |
| Block an AI site, an AI service or a browser extension | – | – | ● | MSP dial · auto or manual |
| Coach the person in the moment, notify the owner, request a review | – | – | ● | MSP dial · auto or manual |
| Centeye Synthwatch AI agent security · Microsoft 365 / Entra ID · Google Workspace · Copilot · Gemini Early access Explore → | ||||
| Every AI agent and non-human workload, with its owner and identity | ● | – | – | Early access |
| Agents that can read, write or surface more data than their job needs | ● | – | – | Early access |
| Behaviour outside an agent’s normal profile | ● | – | – | Early access |
| Exposed or over-privileged agents, models, datasets and pipelines | ● | – | – | Early access |
| AI apps and copilots inside your SaaS, and SaaS-to-SaaS spread | ● | – | – | Early access |
| An agent’s behaviour tied to its owner, the identities it runs as and the grants it holds | – | ● | – | Early access |
| Revoke an agent’s grant (checked at the provider) | – | – | ● | MSP dial · auto or manual |
| Lock its service principal, reset its API token, end its sessions | – | – | ● | MSP dial · auto or manual |
| Send an agent back to its owner to re-approve its access | – | – | ● | MSP dial · auto or manual |
| Agent registries from Microsoft and Google; agents running on laptops | – | – | ● | Coming |
| Core security | ||||
| Centeye Gatewatch Identity threat detection and response · Microsoft Entra ID · Google Workspace Explore → | ||||
| Risky sign-ins from Tor, VPNs and known-bad addresses | ● | – | – | Always on |
| Impossible travel and stolen session tokens | ● | – | – | Always on |
| Password sprays and MFA-fatigue attacks | ● | – | – | Always on |
| Privilege escalation and dormant accounts waking up | ● | – | – | Always on |
| Risky app consent and unknown non-human identities | ● | – | – | Always on |
| Inbox rules, forwarding and delegation an attacker leaves behind | ● | – | – | Always on |
| A risky sign-in tied to the same person’s device alerts (Ironwatch) and the email that started it (Lighthouse) | – | ● | – | Always on |
| Revoke every session, disable the account, force a password reset | – | – | ● | MSP dial · auto or manual |
| Remove the MFA method an attacker added | – | – | ● | MSP dial · auto or manual |
| Restrict a user’s sending in Exchange Online, then release it | – | – | ● | MSP dial · auto or manual |
| Remove an admin role for a while, fence with conditional access (Microsoft) | – | – | ● | MSP dial · auto or manual |
| Enforce MFA enrolment (Microsoft) or 2-step verification (Google) | – | – | ● | MSP dial · auto or manual |
| Centeye Ironwatch Endpoint detection and response · Windows · macOS Explore → | ||||
| Malware and files known to be dangerous | ● | – | – | Always on |
| Everything Microsoft Defender already flagged | ● | – | – | Always on |
| Behaviour that doesn’t fit, checked against core security rules | ● | – | – | Always on |
| Ransomware starting to change files | ● | – | – | Always on |
| A malware or ransomware alert tied to the same user’s sign-ins (Gatewatch) and the email that delivered it (Lighthouse) | – | ● | – | Always on |
| Kill the process, quarantine the file, capture memory | – | – | ● | MSP dial · auto or manual |
| Isolate the machine from the network | – | – | ● | MSP dial · auto or manual |
| Remove persistence and block a file hash across the client | – | – | ● | MSP dial · auto or manual |
| Roll files back from a snapshot and turn shadow copies back on | – | – | ● | MSP dial · auto or manual |
| One-click evidence bundle for an investigation | – | – | ● | Coming |
| Centeye Lighthouse Email security · Microsoft 365 · Gmail Explore → | ||||
| Phishing and known-bad links | ● | – | – | Always on |
| Payment-fraud and credential-request BEC | ● | – | – | Always on |
| Social engineering with no link at all | ● | – | – | Always on |
| Display-name and lookalike-domain impersonation | ● | – | – | Always on |
| Suspect links, opened in a sandboxed browser | ● | – | – | Always on |
| Weak SPF, DKIM and DMARC on each domain | ● | – | – | Always on |
| A clicked phishing email tied to that account’s next sign-ins (Gatewatch) and the laptop that opened it (Ironwatch) | – | ● | – | Always on |
| Quarantine the message (reversible) | – | – | ● | MSP dial · auto or manual |
| Pull a campaign from every inbox | – | – | ● | MSP dial · auto or manual |
| Disable bad inbox rules and trace forwarding chains | – | – | ● | MSP dial · auto or manual |
| Block an attachment hash, revoke app tokens, step up MFA | – | – | ● | MSP dial · auto or manual |
| Block a sender domain or URL; scan attachments themselves | – | – | ● | Coming |
| Above both | ||||
| Centeye Praxis Agentic security operations · Across every Centeye product Explore → | ||||
| Kavach, the analyst on shift: watches, links, proposes | ● | – | – | Always on |
| Argus: writes the weekly client report and runs review dates | ● | – | – | Always on |
| One case per attack: the same person or identity across identity, endpoint, email, AI use and AI agents | – | ● | – | Always on |
| Every fix on your dial: tell me, ask me first, or handle it | – | – | ● | MSP dial · auto or manual |
| Two approvers for client-wide critical steps | – | – | ● | MSP dial · auto or manual |
| Every action checked at the provider afterwards, undone where it allows | – | – | ● | MSP dial · auto or manual |
| Tickets in your PSA; alerts and approvals in Slack, Microsoft Teams and email | – | – | ● | MSP dial · auto or manual |
MSP dial: the MSP or the client’s admin decides, per client and per action, whether a response runs automatically or waits for a person. Every response is checked afterwards and undone where the provider allows. Synthwatch is in early access.
Getting started
See it on your own tenant.
Connect Microsoft 365 or Google Workspace in minutes. Everything starts on “tell me”.