Skip to content
Pre-release. Every product is in development; none is generally available yet. See the roadmap

AegisIQ · Security monitoring and response

It watches, contains and reports. It never strikes back.

AegisIQ is an agentic security monitor for the IQ platform and the systems beneath it. It is built to detect attacks and misuse, by people and by AI agents, and, planned, to contain them on your own systems within reversible limits, track public vulnerability intelligence and propose patches for a person to review.

In development

The foundations are built: a tamper-evident incident record, the first sensors and a way to measure every detection against replayed attacks. Detection rules are built and measured; they run live on our test server once the rule set is signed off. Firm notices, the monthly report and the file-scanning service are built and on the test server. Containment is planned for December 2026.

How you reach AegisIQ. AegisIQ is reached through PracticeIQ, the one application you sign in to; your firm's security notices and monthly report appear there. Both are built on the test server and not yet live for firms. AegisIQ has no firm-facing sign-in of its own.

Register interest in AegisIQ Jump to the roadmap

Capabilities

What AegisIQ does.

Each capability is marked with where it stands: built and in alpha testing, in development, or planned.

  • In development

    See

    Sensors on the gateway, identity events, application audit, agent tool calls, hosts and certificates. Security events carry metadata only, never client content.

  • In development

    Detect

    Credential stuffing, scanning, floods, token abuse, tenant-isolation probing, exfiltration signals, prompt injection and misuse by agents. Every rule is measured against replayed incidents before it ships.

  • Planned

    Contain, reversibly

    Ban an address at your gateway, revoke a token or certificate, disable an account or quarantine one firm's API access. Every action expires and can be reversed, with dry runs, approvals, blast-radius caps and a kill switch.

  • Planned

    Know

    Public advisory and threat feeds matched against what you actually run, giving a prioritised exposure list with patch clocks.

  • Planned

    Patch, with a person

    Fixes proposed as reviewable changes with tests and rollback notes. AegisIQ never merges a change by itself.

  • In development

    Report

    A tamper-evident incident register, notices for each firm inside PracticeIQ and a monthly report scoped to the firm, built and on our test server. Whether a breach is notifiable stays a person's decision.

  • Planned

    Evidence packs

    Evidence packs, and drafts for the Australian Signals Directorate's ReportCyber and for hosting abuse desks.

  • In development

    Scan files before anyone opens them

    Uploaded files are checked for malware and nothing is readable until the scan is clean. The scan service runs on our test server; connecting it to every upload path is in progress.

Who it is for

Built for the people who carry the risk.

AegisIQ reads security events from every layer of the platform and acts only on assets the operator owns. Planned: a local model will help explain and group events; it will never take action.

  • Firms that host the platform

    Security monitoring that understands the IQ platform, on your own servers or in a hybrid setup.

  • IT and security leads

    Evidence and clear explanations, with containment kept within limits you set.

  • Our own operations

    AegisIQ protects the Cogent cloud first, so it is tested against the platform it defends.

Roadmap

Where AegisIQ is heading.

Dates are planning targets and can move. "Done" means built and tested by us in development or on our test server; it does not mean generally available. Nothing on this roadmap is generally available yet. Last updated 25 Oct 2026.

  1. Foundations

    Done

    Built October 2026, ahead of its 12 Nov 2026 target

    The foundations every detection is built on and measured against.

    • Security events that never carry client content (Done)
    • A tamper-evident record of events and incidents (Done)
    • Sensors on the gateway and every service (Done)
    • Detection rules measured against replayed attacks (Done)
    • Operator tools (Done)

  2. M1 Watch

    In progress

    Target 26 Nov 2026

    See attacks on the test server in near real time, with alerts.

    • Detection of brute force, scans, floods and token abuse (Done)
    • Host intrusion and tenant-isolation probing signals (Done)
    • Detection of misuse by agents (Done)
    • Malware scanning of every uploaded file (In progress)
    • Alerts (In progress)

  3. M2 Contain

    Planned

    Target 10 Dec 2026

    Reversible, expiring containment on your own systems, with approvals and a kill switch.

    • Ban, revoke, disable and quarantine actions that expire and reverse (Planned)
    • Ownership check before any action (Planned)
    • Approvals, allowlists and a kill switch, proven by safety tests (Planned)

  4. M3 Know

    Planned

    Target 24 Dec 2026

    Public vulnerability and threat intelligence matched to what you run.

    • Public advisory and threat feeds (Planned)
    • An inventory of the software inside every service (Planned)
    • Prioritised exposure list with patch clocks (Planned)

  5. M4 Assist

    In progress

    Target 14 Jan 2027

    A local model will explain and group events; it will never take action. Firm views come first.

    • Model-assisted triage on a local model (Planned)
    • Incident reports and evidence packs (Planned)
    • Support for a firm's breach-response process (Planned)
    • Per-firm views and digests (Done)

  6. M5 Release-candidate ready

    Planned

    Target 28 Jan 2027

    Patch proposals for review, adversarial testing and hosting profiles.

    • Patch proposals as reviewable changes (never merged automatically) (Planned)
    • Adversarial testing of AegisIQ itself (Planned)
    • Hosting profiles: same host, cloud, on-premises, air-gapped (Planned)

See the full roadmap, including the platform

Try AegisIQ early.

Register for the beta and tell us about your practice. We will be in touch when invited trials open.

Register for the beta Get product updates