Back to platform
Where Spark sits · for everyone in the room

The layer above the SOC tools.

Spark does not replace the SIEM, EDR or SOAR your entities already run. It sits above them: it assesses every entity from the outside, tests the nation's AI before it goes live, fuses what the entities report into one national picture, directs the response and proves every decision with signed evidence.

No agent on any endpointNo internet path into the coreNo logs leave the ministryEvery decision signed, verifiable offline
0
Agents installed on any entity system
1
Sovereign core, on your hardware
7
Flows between the core and each entity
8
Applications, one codebase, one signed audit chain
Read it at your level

One platform, three readers, the same facts.

LEVEL 1 · MINISTER AND LEADERSHIP

How exposed is the state today, and who owns each risk?

One screen shows the national threat level, the entities behind it and whether the directive you issued was followed. Every number on it is signed and can be checked by anyone with the public key, without trusting Spark or the operator.

What you will never be askedTo install anything on a ministry's systems or to move any ministry's data.
LEVEL 2 · HEAD OF CYBER SECURITY

Warnings with a clock, directives with a score, incidents with a stage.

Every finding becomes a warning with an owner and an SLA; a directive is measured as compliance per entity; an incident moves through the national incident stages with a signed note at each step. The entities' SOC tools stay; Spark feeds them and is fed by them.

What Spark does not doCollect logs, run detection rules on events, or contain anything on an endpoint. That stays with the SIEM, EDR and SOAR.
LEVEL 3 · ENGINEER

Read-only in, signed out, nothing on the host but the host.

Inputs are public checks and read-only exports (assets, flows, DNS, the AWS audit output, scanner results) plus detections as incidents over REST. Outputs are HMAC-signed webhooks, TAXII 2.1, signed reports and an evidence bundle. PostgreSQL with a standby, an Ed25519 hash chain over every decision, an OpenAPI description at /api/docs.

What is not on the roadmap by designRaw-log ingestion. The SIEM already does that; Spark integrates with it instead.
National implementation

One sovereign core, read-only connections to every entity, signed evidence back.

Left to right: the internet and the entities' public surfaces, a connected relay in a DMZ, the national core in a sovereign data centre with no internet path, and the entities on the government private network. Pick a step of the loop to see which arrows carry it.

The numbers on the arrows are the steps of the end-to-end loop: the same seven steps the platform walks through.
No agent on any endpoint No internet path into the core Every decision signed, verifiable offline Entities keep their SIEM, EDR, SOAR, firewalls and identity: nothing is replaced WHO SIGNS IN Minister and leadership level 1 report, signed Head of Cyber Security level 2 report, directives, incidents Analysts and entity liaisons level 3; up to 200 per node; entity-scoped views HTTPS over the government private network · sign-in clearance: eight checks · roles admin, analyst, viewer OUTSIDE Internet and public surfaces DMZ · CONNECTED Connected relay node SOVEREIGN DATA CENTRE · NO INTERNET PATH NCSA national core GOVERNMENT PRIVATE NETWORK Connected entities Entity public surfaces 1 Domains and DNS (DNSSEC), mail records (MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT), TLS and HTTP, public web applications and AI gateways. Checked from outside, as an attacker would see them. Entity cloud accounts AWS: the read-only audit script runs inside the entity's own account; only its output is exported to Spark. Azure and GCP: roadmap. External sources Exploited-vulnerability catalogue as a data file with each release; threat intelligence as STIX 2.1 bundles from the national CERT or a commercial feed; Spark release archives, checksum-verified (signed releases: pilot). What is looked for from outside Exposed versions on the exploited list, missing or weak DMARC and SPF, expiring TLS, exposed admin panels, DNS that can be forged, AI gateways that leak their system prompt or follow injected instructions. Live public checks 1 The scheduler assesses every registered entity domain: DNS, TLS, HTTP, mail records, DNSSEC state. Dynamic testing (OWASP, AI Fuzzer) only against targets in the authorised-targets registry, with written authorisation on file. Intake Intelligence bundles, catalogue updates and release archives are received here, never inside the core. Checksums and signatures are verified before anything moves on. Secure drop Entities outside the government network upload read-only exports over HTTPS with mutual TLS. Nothing is kept on the relay beyond the transfer window. Sign and hand over Results, bundles and exports are signed (Ed25519) and carried into the core one way: a data diode where one exists, a verified import where not. The target list reaches the relay as a signed file by the same route. No inbound ports anywhere: the relay only opens outbound connections, and the core never accepts a connection from the relay side. The one-way import is the only crossing. checks bundles 1 Load balancer and TLS The only entry from the government network; certificates from the agency's own CA. Application node 1 Spark Enterprise Edition, stateless; 32 cores, 128 GB; UI, API, scheduler. Application node 2 Identical peer behind the balancer; active-passive today, active-active: roadmap. Identity: local accounts, authenticator app and passkeys today · SAML, OpenID Connect and SCIM: roadmap, one release cycle APPLICATIONS · EVERY ACTION ON THE SIGNED AUDIT CHAIN 2 3 National Cyber Command National picture, threat index, directives, incidents Spark SHIELD Mail and DNS checks, warnings with SLA, exploited-CVE match Domain AI Scanner External attack surface per entity, graded, re-assessed OWASP and Compliance Dynamic web testing of authorised targets, mapped to controls AI Fuzzer Campaigns against authorised AI gateways; OWASP LLM, ATLAS Cloud Health Check AWS configuration review from the exported audit output Infrastructure Monitor Flows, DNS and assets from exports; posture per entity Adversary Elimination Guided hunt and control changes, run with the entity SRE-1, the Spark AI model A reasoning layer computes every answer; a grounding check rejects anything not in the facts; a sovereign language model on the GPU node only phrases it. No tools, no network. Spark Learn Classifiers and baselines trained on the platform's own data (domain risk, unsafe replies, behaviour). Models never leave the deployment. PostgreSQL Primary and synchronous standby (NVMe); every row scoped by organisation Object storage 7 Evidence bundles, signed reports, backups; restore tested Signed audit chain Ed25519 hash chain over every result and decision; verified at sign-in and offline GPU, scheduler 6 Language models on the host; continuous re-assessment; Prometheus metrics INTERFACES · THE ONLY WAYS IN AND OUT REST API and OpenAPI Scoped service tokens; every UI read is an API call; /api/docs Webhooks and e-mail HMAC-SHA256 on every warning, incident and directive event TAXII 2.1 and STIX Indicators, policy decisions, exchange with other nodes Imports JSON, NDJSON, CSV, STIX bundles via admin console or API Entity portal Entity-scoped view behind the same clearance sign-in Signed reports, evidence Three-level situation report; evidence bundle, offline-verifiable DNS, AWS audit, scanner results Read-only exports: assets, flows, 1 JSON: pilot incidents (REST); alerts as CEF or SIEM and EDR detections in as 1 ticketing, SOAR, SIEM assignments: webhooks to Warnings, directives with SLA, 4 see their posture acknowledge, report compliance, Entity portal: owners 4 authorisation on file) and web apps (written Authorised testing of AI gateways 2 with tier-1 nodes protective-DNS policy, exchange TAXII 2.1: indicators, 1 evidence bundles Signed situation reports and 7 National SOC and CERT (existing, kept) Alerts in as incidents; Spark incidents and warnings out by webhook; intelligence both ways over TAXII. Spark feeds it and is fed by it, never replaces it. Ministry, government services Public portals, citizen AI assistant, cloud estate Keeps: SIEM · EDR · SOAR · firewall and WAF · identity · cloud 5 Energy and water utility IT and OT inventories from exports; OT protocol monitoring: partner Keeps: SIEM · EDR · SOAR · firewall and WAF · identity · cloud 5 Telecommunications operator National resolver, DNS, large public surface Keeps: SIEM · EDR · SOAR · firewall and WAF · identity · cloud 5 Financial institution Regulated reporting, mail authentication, web and API estate Keeps: SIEM · EDR · SOAR · firewall and WAF · identity · cloud 5 Healthcare provider Patient portals, AI triage gateway, cloud accounts Keeps: SIEM · EDR · SOAR · firewall and WAF · identity · cloud 5 Tier-1 entity with its own Spark node Spark Enterprise Edition on the entity's hardware with its own database; exchanges with the national core by TAXII 2.1 and signed reports, never shared tables. National resolver, protective DNS Consumes SHIELD policy decisions from the TAXII collection and blocks at the resolver. Pilot. What each entity provides A named owner, an authorised-targets list with written authorisation, scheduled read-only exports, a webhook endpoint or mailbox for directives, a service account for its SIEM or SOAR. LEGEND API call over HTTPS with mutual TLS File export or import (JSON, NDJSON, CSV, STIX) One-way transfer into the core (data diode or verified import) 4 Step of the end-to-end loop (right) Pilot: runs today, proven on representative data Roadmap: not built Trust boundary or kept system THE END-TO-END LOOP: THE NUMBERS ON THE ARROWS 1 Collect 2 Detect 3 Prioritise 4 Assign 5 Act 6 Verify 7 Report 1 exports, live checks, detections · 2 catalogue match, failed policy, injected AI · 3 severity, SLA, threat index, SRE-1 · 4 owner, directive, incident stage 5 the entity, with its own tools · 6 re-assessment and acknowledgement · 7 signed, three levels, verifiable offline with the public key THREE STAGES, EACH WITH A GATE Proof of value one node, SQLite, a handful of entities Pilot one application node, PostgreSQL, up to 50 entities National two nodes, primary and standby, GPU node, relay, hundreds of entities Spark Software Middle East Cybersecurity Solutions · Reference architecture for the national programme · Sizes, limits and measured figures: section 3 of the team brief · Laboratory figures, no production deployment yet
Download for slides and print:PNG 3840 × 2160PDF A3The diagram is in English in every language of this platform.
Complement, not replace

What the entities keep, what Spark adds, what Spark does not see.

THE ENTITIES KEEP

Their own tools

  • SIEM: log collection, search, retention, detection rules
  • EDR and endpoint protection
  • SOAR: automated containment and playbooks
  • Firewalls, WAF, network protection
  • Identity provider and directory
  • Patching, configuration change, hands-on incident response
Nothing is replaced. Spark sends findings and incidents to these tools by signed webhook and takes their detections back as incidents.
SPARK ADDS

The national layer

  • External assessment of every entity domain, as an attacker sees it
  • Mail and DNS policy checks, exploited-vulnerability correlation
  • AI assurance: every government AI gateway tested before go-live and after every model update
  • The national picture, threat index and visibility
  • Directives with measured compliance, warnings with an SLA
  • Incident command through the national incident stages
  • Signed situation reports and an evidence bundle verifiable offline
Running software, tested by its own suites; see the status table below for what is pilot and what is roadmap.
SPARK DOES NOT SEE

And says so

  • Attacks in progress inside an entity, unless its tools report them
  • Raw logs and event streams
  • Endpoints, processes, memory
  • Anything it has not been authorised in writing to test
That is why the programme includes a reporting mandate through directives and, on the pilot roadmap, alert-level ingestion from the entities' SIEMs.
Status, honestly

What is generally available, what is in pilot, what is on the roadmap.

Generally available means running software in this platform, tested by its suites. Pilot means it runs today and is proven only on representative data. Roadmap means not built.

Generally availableNational Cyber Command · Spark SHIELD · Domain AI Scanner · OWASP and Compliance scanner (light depth) · AI Fuzzer (representative depth) · Cloud Health Check for AWS · Adversary Elimination as a guided workflow · SRE-1 and Spark Learn · sign-in clearance with authenticator and passkeys · user management · the signed audit chain · the Enterprise Edition (PostgreSQL, backups, TLS, Docker, systemd, OpenAPI, metrics)
PilotInfrastructure Monitor on real exports · entity posture from real telemetry · resolver enforcement of protective-DNS decisions · full-catalogue fuzzing with a detector per class and Arabic probe variants · alert-level ingestion from entity SIEMs (CEF or JSON) · signed release bundles and a software bill of materials
RoadmapSAML 2.0, OpenID Connect and SCIM · SOAR actions and automated containment · web and API protection (partner) · OT protocol monitoring (partner) · Azure and GCP configuration review · live exploited-vulnerability feed synchronisation · active-active clustering
Not plannedRaw-log collection, search and retention · endpoint agents · running a 24/7 SOC for the entities. These stay with the entities' SIEM, EDR and SOAR by design.

Measured on one laptop or one container: 520 requests per second with 32 clients, 10,000 signed audit entries written in 1.7 s and verified in 0.8 s. No production deployment yet; the pilot exists to measure the design targets on your hardware.

Named comparison · as of 20 October 2026

Where the sovereign terms are real, and where they are not.

Against the cloud-native majors the differences are structural. Against self-hosted platforms they are not, and this table says so. "Not found" means not found in public documentation, not confirmed absent.

PlatformRuns with no internetLicenceSource open to the customerAI red teamingAI assistant without third-party AI
Spark PlatformYesNo internet path into the core by designPerpetual for anything deployed; escrow on insolvency or change of controlYesSource open to the agency's reviewersIn the platform, offlineEvidence mapped to OWASP LLM Top 10 and MITRE ATLAS; a subset of the catalogue fires live todayYesSRE-1 on the host; a hosted open-weight language model only phrases the answer
Microsoft Sentinel and DefenderNoCloud services; not in Azure Local disconnected operationsSubscriptionNoThe government source programme covers Windows and Office, not these productsOpen-source tool and a cloud agent in previewPyRIT; Foundry red-teaming agentNoSecurity Copilot runs on Azure OpenAI; prompts evaluated in ANZ, EU, UK and US
CrowdStrike FalconNo"No on-premises equipment"SubscriptionNot foundConsultingAI Red Team Services, since November 2024NoCharlotte AI in the cloud, OpenAI and Anthropic models integrated
Palo Alto Cortex XSIAM and XDRNoCloud data lake; the Broker VM only proxies air-gapped networks to itSubscriptionNot foundCloud productPrisma AIRS AI Red Teaming, since October 2025NoCloud copilot, model provider undisclosed
Google SecOpsNoCloud onlySubscriptionNot foundConsultingMandiant AI red teamNoGemini in the cloud
Cisco SplunkSplunk Enterprise on premisesSplunk Cloud is cloud onlySubscriptionPerpetual licences ended November 2019Not foundCloud productCisco AI Defense validation since early 2025, free tier March 2026; on-premises version in developmentNoAssistant models run on Splunk-hosted cloud or Azure OpenAI
Elastic SecurityYesDocumented air-gapped mode, self-managedSubscription tiersCode is publicSource-available licencesNot foundConnectorsThird-party or self-hosted models
IBM QRadar SIEM (on premises)YesPerpetual or subscriptionNot foundConsultingIBM X-ForceNo offline option found
Trend Micro Vision OneYesOn-premises air-gapped tier, per the vendorSubscriptionNot foundSelf-hosted scanner, pre-release, and consultingNoCloud
Fortinet FortiSIEMYesOn premisesPerpetual availableNot foundNot foundNoCloud

Vendor documentation and announcements, October 2026; the dated sources are in the team brief. Say "Microsoft, CrowdStrike, Palo Alto and Google do not offer this today", never "nobody can".

Hard questions, straight answers

The eight questions a reviewer will ask, answered before they are asked.

Is this not vulnerability management with a dashboard?
The detect step you saw is exposure detection. Intrusion detection stays with the entities' SIEM and EDR; their detections come in as incidents through the API, and Spark correlates them across entities, directs the response and proves it. What no SIEM does is the directive and compliance loop, the AI gateway testing and the signed national evidence.
Who else does AI red teaming?
CrowdStrike (consulting, since November 2024), Cisco and Splunk (cloud product, since early 2025), Palo Alto (cloud product, since October 2025) and Microsoft (open-source tool and a cloud agent in preview). None sells a customer-operated, fully offline version, and no agency runs a standing test of its own gateways yet. That is the position Spark takes.
Can a company your size deliver a national programme?
Not alone, and we do not ask you to assume it. The programme is staged: a proof of value you can approve this quarter, a pilot that a Qatari alliance partner bonds and staffs with us, and a national rollout that opens only when the gates are passed. Every stage leaves you with signed, usable capability you keep.
What do you not see?
Attacks in progress inside an entity, unless its tools report them. Raw logs. Endpoints. Anything not authorised in writing. By design: the national layer should not own the ministries' logs, for sovereignty, volume, cost and liability.
Why trust a new vendor with a national platform?
Do not trust us, verify us. The source is open to your reviewers, the dependency list is four libraries plus open-weight models, every decision is signed and checkable offline, a penetration test by an assessor you name precedes production, and a perpetual licence with escrow means the system is yours whatever happens to us.
Does it run without the internet?
Yes. The core has no internet path. Live public checks run from a connected relay and come in one way as signed bundles; updates arrive as checksum-verified archives; intelligence arrives as STIX bundles. Microsoft Sentinel and Defender, CrowdStrike, Cortex XSIAM and Google SecOps cannot run that way; Elastic, Trend Micro, QRadar and FortiSIEM can.
Why not just buy a SIEM?
Because a national agency should not own dozens of ministries' logs, and the ministries that already bought Splunk, Sentinel or CrowdStrike will not replace them. The programmes nations copy, like the UK's Active Cyber Defence, are not SIEMs either. The national layer has to be tool-agnostic to be adoptable.
What is generally available and what is not?
The eight applications, SRE-1, Spark Learn, the clearance sign-in, user management, the signed audit chain and the Enterprise Edition are generally available. Real-telemetry posture, resolver enforcement, full-catalogue fuzzing and alert ingestion are pilot. Identity federation, SOAR actions, OT protocol monitoring and cloud review beyond AWS are roadmap. The status table above is the reference.
Validation lifecycle→ Back to platform→