Signals without a shared account
Reports and operational events can sit in separate systems, making it difficult to establish what an incident involves.
SENTINEL CORE · HOLD
For security operations teams, site managers and service partners
Incident oversight, with evidence at the centre.
Sentinel Core is a security operations platform designed to keep incident information, supporting evidence and response decisions together. It gives teams a structured basis for reviewing what happened, deciding what needs attention and coordinating a response under clear human responsibility.
The problem
A clear response starts with a clear incident record.
Evidence apart from decisions
Supporting material can lose its source context as it is copied, summarised or passed between teams.
Unclear response ownership
An escalation is difficult to review when the assessment, decision and responsible person are recorded separately.
What it does
What you get.
A composed workflow for understanding incidents, reviewing their evidence and coordinating a responsible response.
Establish the incident picture
- Bring agreed operational sources and reports into a shared incident context.
- Distinguish the initial signal from information confirmed through review.
- Keep open questions and the current assessment visible to the team.
Keep evidence in context
- Connect supporting material to its source and the incident it concerns.
- Record annotations and handling decisions alongside the material under review.
- Define retention, access and sharing requirements for the incident workflow.
Coordinate a considered response
- Make acknowledgement, escalation and follow-up responsibilities explicit.
- Keep the reasoning behind a response decision available for later review.
- Prepare a clear handoff with the relevant evidence and unresolved questions.
Why this matters
A professional response must remain understandable after the immediate pressure has passed. Connecting the incident, its evidence and the reasoning behind action gives people a clearer basis for review. Sentinel Core is designed to support that accountability throughout the workflow.
How the record works
Keep the basis for a decision in view.
What was reported?
Preserve the initial account and distinguish it from subsequent assessments.
What supports the assessment?
Keep relevant source material and its limitations beside the incident.
Who decided the response?
Attach the responsible person's reasoning to escalation and follow-up decisions.
What remains open?
Make outstanding questions and responsibility clear at each handoff.
Who uses it
The same record, seen from every chair.
Security operators
Review incident information and prepare the next step with its supporting context.
Security managers
Understand the assessment, ownership and follow-up behind an incident response.
Service partners
Work from an agreed handoff with clear access and responsibility boundaries.
Evaluation
Start with a focused workflow.
Select an incident workflow and agree the sources, review authority and evidence-handling requirements before connecting it to an operational process.
Agree the scope
- Incident types and the sources appropriate to them
- Review responsibilities and permitted response actions
- Evidence access, retention and controlled handoff requirements
Questions to evaluate together
- Can reviewers follow an assessment back to its sources?
- Is the person responsible for each response decision clear?
- Does a handoff preserve the evidence context and open questions?
Evidence for the questions that matter.
Evaluate the relevant product and conditions. Request scoped evidence for access, provenance, recovery, human review and offboarding before agreeing a pilot.
- Who can access the information?
- Ask for the product's access boundaries and applicable isolation tests.
- Where does the information come from?
- Agree the sources and inspect a representative source-to-record example.
- What happens when something fails?
- Agree operational ownership and request relevant monitoring and recovery evidence.
- What can we review and take with us?
- Confirm review history, retention, export formats and offboarding within the agreed scope.
For investors and partners
A clear proposition for accountable security operations.
Sentinel Core brings the portfolio's emphasis on evidence and human review into incident operations. Its relevance to investors and partners lies in a concrete organisational need: coordinating a response while retaining the basis for decisions. A scoped evaluation can examine that workflow and its handling requirements without assuming deployment maturity or guaranteed outcomes.
Identity
Sentinel Core applies the Optimized Core focus on traceability and human responsibility to security incidents. It keeps oversight, evidence and considered response at the centre of the product story.
observe → assess → hold → reviewEvidence, held for review.
Explore a clearer incident workflow.
Describe your team and the workflow you want to evaluate, with an anonymised example if you like. We discuss scope, connections and readiness before any data is shared.
JPH van Mastrigt · Founder & Technical Director
