Centeye Praxis · Agentic security operations
Praxis joins every alert into one case, checks what’s real and hands your team the facts and the fix to approve.
Same week password guessing, MFA push-bombing and impossible travel at one business, while its laptops raised alerts. Centeye platform data, Oct 2026
Part of the Centeye platform · Above both
The biggest time sink in security is working out what happened before anyone can act. Praxis takes that on. It is the operating layer above every Centeye product. It reads what each one finds, diagnoses what is real, connects the pieces into one case, pulls in the latest threat information and adds the context. Then it hands the case to Kavach, the security operations agent, who runs the playbook within your rules and puts it in your case review. Argus, the advisor, explains every case in plain English.
A security operations centre (SOC) is the team that watches alerts, decides what is real, investigates and responds. Most small and mid-market businesses, and most MSPs, can’t staff one around the clock.
Agentic security operations means AI agents do that work. They diagnose each signal, connect it to everything related, add what is known about the threat, and either hand a person a finished case or fix it within the rules you set. Praxis is that layer for every Centeye product, run like a well-managed team: it follows your rules, asks when it should, and records every step.
Capabilities
Each capability with a real situation: what happens, and what Praxis does about it.
Works every case day and night: runs the playbook for that kind of attack, takes each step at your dial setting, and puts the case in your review queue with the evidence attached.
At 2 am an odd sign-in, a new inbox rule and an endpoint alert arrive within ten minutes.
Kavach sees one attack, not three alerts, and opens one case with all three attached.
Explains every case in plain English, writes the weekly report for each business, and keeps AI tools and agents on their review dates.
A client asks what their security actually did last month.
Argus sends one page: what was caught, what was fixed, the hours it saved, and what is left for them.
When a new threat appears, Kavach pulls current threat information on it, checks whether the same signs show up anywhere else you manage, and adds it all to the case.
A new phishing kit starts stealing sessions this morning.
Kavach checks every client for its signs, and any match arrives as a case with the threat explained.
Every fix is checked afterwards at Microsoft or Google, undone where possible, and recorded: who, what, why and when.
Kavach ends a stolen session at 2:14 am.
It checks at Microsoft that the session is really gone, and records who, what, why and when.
Cases open as tickets in the standard PSA tools you already run. Alerts and approvals reach Slack, Microsoft Teams and email, from a phone if needed.
Revoking an app needs the on-call tech’s OK.
The request lands in Microsoft Teams with the case attached. One tap approves it, and the ticket updates itself.
Corrections become lessons for that client. A lesson can only ever make Kavach more careful, never less.
Kavach proposes disabling an account that turns out to be a director travelling for work.
The tech says why it was wrong. From then on, for that client, Kavach asks first in that situation.
In the console
Real screens from the Centeye console. The clients, people and data in them are made up.
The operating layer
Most of an analyst’s time goes on working out what happened. Praxis diagnoses, triages, checks and adds the threat context, then puts the facts in front of your team to decide. Here is every step, and the time it saves.
Every signal from every product is read the moment it arrives: what is real, what is noise, and how far an attack has got.
The person, the laptop, the mailbox, the AI apps and the agents involved are joined into one case on one timeline.
For a new threat, Praxis pulls the latest threat information on it and checks whether the same signs appear anywhere else you manage.
Kavach, the security operations agent, runs the playbook for that kind of attack, one step at a time, each at the dial setting you chose.
Every case lands in the case review with the evidence, the steps taken and what is left. You approve, adjust or close it, from a phone if needed.
Every fix is checked afterwards at Microsoft or Google, and undone where possible.
Argus writes it up in plain English. Your corrections become lessons that make Kavach more careful for that client.
Every case Kavach handles is work a person didn’t have to do: the triage, the fix and the write-up. These are the typical hands-on minutes for one analyst to do each by hand.
Minutes are Centeye’s working estimates of typical analyst time per action, based on industry-typical security operations work. Your dashboard counts the hours given back from the actions Praxis actually took.
Praxis always does the digging, so your team starts from the facts, not from a raw alert. What happens next is yours to set: every client starts on “tell me”, and you turn protective fixes up as trust grows. Disruptive steps always wait for a person. Every step is checked afterwards at Microsoft or Google, undone where the provider allows, and recorded in a tamper-evident log.
The digging that eats an analyst’s time on every alert.
Steps that contain harm and can be undone. Per client and per action: handle it, ask me first, do it myself, or just recommend.
Steps that interrupt people’s work or touch a whole client never run on their own, whatever the setting.
How it works
Praxis doesn’t stop at an alert. Praxis links what it finds to the rest of the attack, then fixes it at the setting you choose.
Spots what is wrong, as it happens.
Links it to everything related, in one case.
On your dial: tells you, asks first, or handles it.
In action
Pick a case to see what happened, what Centeye saw, and what it did.
Sunday, 2:14 am
A stolen session, a new mailbox rule and an AI note-taker connected the day before all appear on the same account within an hour.
Kavach links them into one case: account takeover, with a way back in through the AI app.
Sessions end and the rule is removed on their own, as set. Revoking the note-taker waits for one tap from the on-call phone. Argus writes the summary for Monday.
Monday, 7:30 am
Over the weekend, Centeye products raise 40 signals across 12 clients.
Kavach closes 33 as routine, with the reason written down for each, and joins the other seven into three cases.
Two cases were handled on their own, as set, and checked. One waits for a tap. The on-call tech starts Monday with three cases, not forty alerts.
Better together
Identity, endpoint, email, AI use and agents are one picture to an attacker. Each link below is made automatically, in the same case.
Getting started
Praxis comes with every Centeye product. There is nothing extra to buy or install.
Terms explained: AI SOC · MDR · Tool Sprawl
