Overview
Perpetual is the complete system for agentic security operations. It is used to develop, deploy, monitor, and tune detective controls that produce alerts, to hunt for threats, and to carry findings through triage, investigation, and response. Perpetual is agentic: background agentic loops carry out bounded work at defined points in these workflows, while the Simba agent works in the foreground at your direction.
Perpetual employs a hybrid-SaaS architecture: its data plane is fully managed by Perpetual Cloud, a SaaS application. The data plane, which is primarily composed of a serverless query engine and Iceberg-compatible lakehouse, runs in a dedicated cloud account inside your AWS billing organization. This architecture balances the performance required for threat hunts and complex correlations with the storage efficiency required for large security data lakes.
Develop detections from threat reports or your own insights
You can develop a detection from your own insight, or incoming threat reports can trigger background detection development. In either path, agents produce a reviewable detection that you can test and refine with Simba before deciding whether it goes live.
Detections produce signals and alerts
A live detection continuously evaluates security events and records each match as a signal. Perpetual’s detection engine supports complex detection styles, including time-series aggregations and ordered correlations over sliding windows, with their logic expressed in Hamelin. You decide which detections also raise alerts, sending those signals into triage.
Focus investigation on the highest-risk alerts
Perpetual groups and scores alerts, then opens cases for the highest-risk alerts that fit within the investigation budget. Perpetual proactively manages token spend by spending budget on case investigations in priority order. Within each case, agents pursue bounded questions in parallel and assemble their findings into the investigation. You can direct further work with Simba, decide what response to carry out, and close the case with its final outcome.
Use case outcomes to improve detections
Case dispositions turn investigation outcomes into evidence about detection quality. With Simba, you can find patterns across cases, test a proposed change against event history, and prepare it for review. You are always in control: changes only ship when you approve them.
Common questions
Are you a SIEM?
If by SIEM you mean a system that collects and queries security events, runs detections, raises alerts, and supports investigations, then yes. Perpetual organizes those responsibilities as agentic security operations, with Simba and background agentic loops working across its lakehouse and query engine. If by SIEM you mean a system that forces you to discard useful events to control an ingestion bill, makes hunts compete with detections for fixed compute, requires continuous maintenance of scheduled searches, and stores the surviving events in a proprietary format in someone else's data center, then no. Perpetual has none of those constraints.
Do you replace mine, or sit beside it?
Perpetual is designed to become your primary system, but you can move sources into it incrementally. Simba can also use MCP tools exposed by other systems in your security data ecosystem alongside Perpetual’s own queries. Events in those systems remain outside Perpetual’s continuous detection and triage, though scheduled skills and hunts can still access them through MCP.
Are you an AI SOC platform?
Perpetual includes agentic triage and investigation, but it is broader than an AI SOC platform layered over an alert queue. It also supports developing and operating the detections that produce those alerts. Simba can hunt through the underlying security events, work a case with you, and help improve a detection from the case outcomes. Perpetual exposes the chats, queries, evidence, and proposed changes behind that work. You retain authority over case outcomes, response, and the changes that ship.