domain
Cybersecurity
Agent fleets in the SOC, and revocation that actually propagates
Security teams were early adopters of agent fleets for triage, enrichment, and reporting, and they are also the teams most alert to the new attack surface a fleet creates. CueCrux addresses both sides.
On the operations side, every agent action mints a signed receipt on the hash-chained spine, so incident timelines are reconstructible from cryptographic evidence rather than correlated logs. When an agent's behaviour looks wrong, you replay exactly what it retrieved, decided, and mutated, in order.
On the containment side, revocation propagates with proof. Pulling an agent's access is a signed pull with per-agent acknowledgements, and when zero holders remain the system produces an attestation saying so. "We revoked it" becomes a checkable claim rather than a hope. Standing credentials shrink too: RCX issues short-lived capability tokens scoped to tools, tenant, and tier, self-issued locally and offline-verifiable, so a captured token is worth little and a policy refusal is a signed artefact.
For frameworks like NIST CSF, ISO 27001, or NIS2, the receipt spine doubles as control evidence: detection, response, and recovery activity carried out by agents arrives pre-documented.