Priam AVA

Priam AVA is an autonomous SOC alert investigation platform developed by Priam Cyber AI, based in London. It is designed to perform L1 triage on security alerts by gathering evidence, testing hypotheses, and returning a defensible verdict rather than summarizing alerts or executing pre-written playbooks. Core function: AVA operates as an investigation engine within the SOC workflow. For each alert, it collects evidence across endpoint and identity layers, applies a probabilistic reasoning engine called PEBRE (distinct from LLM-based inference), and produces a structured Investigation Report containing a verdict, evidence chain, reasoning, and identified gaps. Verdict types: - True Positive - False Positive - Inconclusive (when evidence is insufficient, AVA specifies what is missing) Key outputs: - Investigation Report per alert, including verdict, evidence, reasoning, and audit trail - 97% false-positive closure rate (observed in deployment) - L1 triage time reduction from 35-60 minutes to 1-2 minutes (observed) - L2 investigation time reduction from 150 to 24 minutes (observed) - 100% alert coverage commitment Deployment: AVA is available for enterprise SOCs and MSSP/MDR teams. It supports cloud, on-premises, and private deployments. It connects natively to existing SIEM and XDR/EDR platforms without requiring replacement of existing tooling. AVA is positioned as a third category of SOC tooling, distinct from detection (SIEM/XDR) and automation (SOAR), focused specifically on the investigation and conclusion phase of alert handling.