Security · The defenders / In development
ArMoVault
Prove what your detections actually catch.
“Security teams can count their detection rules. Few can prove what those rules would actually catch.”
How it works
Every detection, tested against its attack.
ArMoVault runs each detection against the attack it claims to catch, shows the gaps, and drafts the fix. Every day, on any SIEM.
- Take each detectionEvery rule, whichever SIEM it runs on.
- Run its attackThe attack the rule claims to catch.
- Show the gapsWhat the rule really catches, and what it misses.
- Draft the fixA proposed fix for every gap it finds.
Why we're building it
“Rules get counted, rarely proven.”
Between us: eight-plus years inside enterprise SOCs, from both sides of the work. One of us designs the platforms; the other writes and tests the detections. We kept hitting the same gap.
Security teams can count their detection rules. Few can prove what those rules would actually catch.
A daily, SIEM-agnostic test of every detection against its attack, with a drafted fix for every gap.
ArMoVault is in development by Arno Arzumanyan and Moïse Aubert (ARMO). Join the early list and we'll let you know when it's ready.