The agentic workforce
for defenders

Legion comes with built-in security expertise, learns how your team works, and turns both into agents that keep getting sharper.

Understands how you work.
Learns why you act.

Legion maps your knowledge, people, and processes, and the map grows with every investigation.
Investigate

Triage and investigate at scale, with your team’s knowledge and judgment.

Respond and remediate

Contain, eradicate, and remediate within the authority
you grant.

Hunt and search

Correlate evidence across tools, logs, and past cases to hunt
proactively.

Improve detections

Turn investigation patterns into detection tuning, mapped to
MITRE ATT&CK.

Born and raised in-org

Built to make you soar

Legion learns your current processes, tools and context, deploying trusted agents optimized for your team

AI SOC

Triage and investigate alerts with your organization’s context, tune detections from what you find, and carry confirmed threats through to approved
remediation.

Dashboard showing an Account Takeover use case with a process graph illustrating steps like Review Security Incidents, Collect and Review Information, and Investigate LinkedIn activity with related percentage metrics.
DLP

Separate real exfiltration from false positives, establish who did what and why, then revoke access, quarantine data, or close the exposure.

LEGION interface recommending an email as benign, noting it is a promotional message from Microsoft OneDrive with no malicious indicators and an IP linked to Adobe Inc.
Exposure management

Test exploitability against your environment to prioritize real risk, then drive the fix with the teams that own it.

Control Room dashboard displaying six security cases including phishing, malware, suspicious emails, and signature violation with progress steps and action buttons.
Threat intelligence

Check whether a threat is active against your assets, and feed what you learn
into detection and response.

Control Room dashboard displaying six security cases including phishing, malware, suspicious emails, and signature violation with progress steps and action buttons.
Control Room dashboard displaying six security cases including phishing, malware, suspicious emails, and signature violation with progress steps and action buttons.
Email investigation flowchart showing security review, email analysis, threat detection, triage, and remediation steps.
LEGION interface recommending an email as benign, noting it is a promotional message from Microsoft OneDrive with no malicious indicators and an IP linked to Adobe Inc.
LEGION interface recommending an email as benign, noting it is a promotional message from Microsoft OneDrive with no malicious indicators and an IP linked to Adobe Inc.

Zero integrations for all your tools and processes.  Ready to fly from day one.

Introducing

Legion Investigator

Turn practice into agents.

Start from a browser recording, runbook, or past case. Legion turns it into an agent you review, refine, and deploy.

Combine judgment and consistency.

Agents reason where judgment matters and follow fixed steps where consistency does, in a single workflow.

Extend across security work.

Build agents for the processes your team runs, in the tools it already uses.

Learn more

TRUST AND CONTROL

Trust that’s earned, not assumed

Compare the work

Run agents beside your analysts on live cases and compare them, decision for decision.

Set the bar for autonomy

Define the benchmarks and gates. Agents gain autonomy only by clearing them.

Inspect and refine

See every step, decision, and source, and edit the logic behind them.

Operate at enterprise scale

Governance and compliance built into every deployment.

Introducing

DragonClaw

DragonClaw is Legion’s orchestration layer. It reads your intent, picks the right agents, and runs them across your tools, never acting without your permission.

Find what to automate.

See which alerts, workflows, and tasks eat the most time, and which are ready to become agents.

Hunt across every tool.

Ask one question across all your tools. Hunt new threats and hand strong leads to the Investigator.

Report in plain language.

Describe the report or board summary you need. Schedule it, and ask what’s behind the numbers.

Learn more

Banner with a griffin icon and text reading 'Capture analyst behavior in a click, learns from real analyst behavior and captures how investigations unfold across tools and alerts.'LEGION application interface showing Sessions tab with options to start recording and view previous investigation sessions.
Banner with a stylized bird symbol and text reading: 'Recorded audit trail. Get a built-in resource for training, documentation and compliance review.'Dashboard showing phishing investigation summary with status 'Success', analyst info, duration, and detailed investigation steps including case extraction, user detail search, incident entity extraction, IP reputation checks, and query results.
Banner with a gryphon icon and text: Build an expansive team-wide memory. Classify by use case, map processes, and see your team’s patterns.

Trained from scratch on your tribal knowledge.

Ready to let Legion breathe fire?
0:00 / 0:00
EXPLORE guided mode

“Legion blew me away. It’s one of the first times I’ve seen AI actually capture, summarize, and build on real analyst work instead of just making things up.”

Sr. Threat Hunter @ F500 Healthcare
book a demo