The Nerv platform
Seven modules. One platform. Zero blind spots.
Four modules cover the surfaces you already know you have. Three cover the ones AI created. All seven share one console, one agent estate and one AI security operations centre.
The platform
One platform. Seven modules.
Buying seven best-of-breed products from seven vendors gets you seven opinions about the same attacker. Nerv correlates across all of them. Pick any module for the detail.
Core coverage
The AI layer
Why Nerv exists
Four attack surfaces. Four consoles. Nobody owns the AI one.
Most small and mid-sized stacks are assembled from separate products bought at separate times. Each one sees its own slice of an attack. None of them see the attack — and none of them are watching the AI surface at all.
This is the surface Nerv was built for. The other three came with it.
- 80%
- of breaches involve compromised credentials
- 78%
- of organisations have no AI data leakage controls
- #1
- prompt injection, OWASP Top 10 for LLM apps
Sources: industry breach reporting and the OWASP Top 10 for LLM Applications. Figures are indicative of market conditions, not Stealth Cyber client outcomes.
What four consoles cost you4 failure modes
- 01Correlation happens in a human head.
- An endpoint alert and an identity alert are the same incident, but nobody joins them until Monday.
- 02Alert fatigue is the control failure.
- Four consoles generating four queues means the alert that mattered was the one nobody opened.
- 03Every gap is a licensing conversation.
- AI triage, hardening audits and identity response are sold as upsells, so the coverage you assumed you had, you don’t.
- 04Nobody owns the AI surface at all.
- Staff paste client data into chatbots, your AI applications answer whatever they are asked, and agents act on delegated authority nobody reviews.
Why your existing stack cannot see the AI surface4 reasons
- EDR watches processes.
- A malicious prompt is not a process. It is a legitimate API call carrying hostile text.
- Web filtering watches domains.
- The domain is api.openai.com and it is meant to be allowed.
- DLP watches files.
- The exfiltration is a paste into a text box, then a screenshot of the answer.
- SIEM watches logs.
- Model inputs and outputs are almost never logged, so there is nothing to correlate.
The difference
One attacker. One timeline.
A single intrusion crossing endpoint, identity, machine identity, browser and AI, correlated into one incident with one response, by the platform rather than an analyst reading seven consoles.
47
Seconds, end to end
First detection to full containment in the scenario opposite, with no human intervention. Measured in Stealth Cyber lab testing, not a client service level.
- 01Nerv-ID
Password spray from an offshore IP compromises three accounts
- 02Nerv-ID
Impossible travel detected, Sydney to Moscow in five minutes, sessions revoked
- 03Nerv-EDR
Credential dumping tool executing on the compromised endpoint, process killed
- 04Nerv-NHI
Stolen token replayed by an over-permissioned AI agent, scope revoked
- 05Nerv-ID
Forwarding rule created on the CFO mailbox, rule deleted automatically
- 06Nerv-WEB
Attacker pastes exported client data into a public chatbot, redacted in line
- 07Nerv-AI
Prompt injection attempted against the company AI assistant, blocked
- 08AI SOC
Full kill chain correlated, incident report generated, all sessions revoked
Operations
Every alert triaged. Not every alert queued.
Alerts from all seven modules are triaged, investigated and actioned by eight specialised AI agents, with Stealth Cyber analysts supervising and handling escalation. Automation does the volume. Practitioners do the judgement.
- NNova
- Alert triage and classification
- SSpectre
- Deep forensic investigation
- VVanguard
- Containment and response
- PPhantom
- Proactive threat hunting
- AAtlas
- Vulnerability prioritisation
- FForge
- Malware analysis
- GGhost
- Offensive security testing
- CCipher
- OSINT and intelligence
Agent names describe automated functions within the Nerv platform. They are software, supervised by the Stealth Cyber SOC team.
How it deploys7 surfaces, days not quarters
No appliances, no log shipping project, no professional services engagement to get to first value. One multi-tenant console across all seven modules, with per-client views for MSPs and a fleet view for you.
- Endpoint
- One signed binary pushed via your existing RMM, Intune or GPO. No runtime dependencies, no reboot.
- Browser
- Force-installed extension for Chrome, Edge, Firefox and Safari. Users cannot disable it.
- Identity
- OAuth consent in Microsoft 365 or Google Workspace. No agent, no change to mail flow.
- Machine identity
- Read-only discovery first, so you see every agent and key before anything is enforced.
- AI systems
- A proxy endpoint, an SDK integration or the browser extension, depending on what you own.
- Coding agents
- A repository and CI integration plus an agent-side policy. No change to how developers work.
- People
- Single sign-on and a directory sync. Training assigns itself from there.
And because we are also an MSSP: you can run Nerv yourself, or hand the console to our SOC and receive outcomes instead of alerts. Same platform, your choice of who watches it.
The real comparison
What this actually replaces
Nerv is not a line item on your antivirus renewal. At this size, the honest alternative is hiring the security function yourself, or continuing to have nobody own it. So compare it to that.
Hire one security analyst
$135K
per year, fully loaded
- Security tooling still to be purchased
- Available around 38 hours a week
- One person, one set of skills
Nerv Enterprise, ten seats
$19.8K
per year, all seven modules
- Every module included, nothing to add
- AI SOC triage around the clock
- Live in days, not quarters
What the headcount number leaves out3 caveats
- You cannot hire your way to round the clock.
- Genuine 24/7 coverage is three to five people. One analyst is asleep for two thirds of the week, and attackers have always known which two thirds.
- The salary is the start, not the total.
- That analyst still needs an endpoint tool, an identity tool, a log platform and a training platform before they can do the job you hired them for.
- This is not an argument against hiring.
- When you do hire, that person starts with a platform already running and a year of correlated history behind them, rather than a purchase order and a six month rollout.
Salary range from published Australian market salary data for cyber security analysts, August 2026. The loaded figure adds superannuation at the 12% guarantee rate plus an allowance for recruitment, equipment and leave cover, and excludes payroll tax, which varies by state and threshold. The Nerv figure is Enterprise list pricing at the ten seat minimum.
Commercials
Per user. Per month. From ten seats.
One price covers every module in your tier, for every user, on every device they use. AI triage, multi-tenancy, hardening audits, training content and the SOC are inclusions, not upgrade paths.
Ten seat minimum · No enterprise floor · Once off onboarding fee
Essentials
Nerv-EDR + Nerv-WEB
Endpoint protection and AI data leakage prevention. The floor for any team with staff using AI tools.
$30
per user / month
$300 / month at 10 seats
Professional
Adds Nerv-ID and Nerv-TRAIN
Identity threat detection across Microsoft 365 and Google Workspace, plus AI awareness training triggered by real behaviour.
$75
per user / month
$750 / month at 10 seats
Enterprise
All seven modules + AI SOC
Adds Nerv-AI, Nerv-NHI and Nerv-CODE. Full cross-surface correlation and the AI security operations centre.
$100
per user / month
$1,000 / month at 10 seats
Managed
All seven + Stealth Cyber SOC
Everything in Enterprise, operated by our analysts. Monthly reporting, incident response retainer, advisory hours.
Custom
scoped to your environment
Confirmed in a written proposal
Indicative list pricing in AUD per user per month, excluding GST, based on a ten seat minimum and an annual commitment. Volume tiers apply above fifty seats. Final pricing depends on seat count, term and managed service scope, and is confirmed in a written proposal.
Fit
Practitioner-led. Not vendor-led.
Nerv was built by the team that runs the incident response engagements, the red team work and the Essential Eight uplifts. Every detection exists because we needed it on a real job. We are not a reseller with a dashboard.
Not the right fit for teams under ten seats, or large enterprises with a mature SOC already running a platform they are happy with. We will tell you that in the first meeting rather than the fourth.
Where Nerv is the obvious answer5 profiles
- 01Startups and scale-ups, from 10 seats
- Shipping fast, usually with AI in the product, and with nobody whose actual job is security. You do not need two hundred staff to buy this.
- 02Small professional services firms
- Accounting, legal and advisory practices from ten people up. Client confidentiality is the product, and staff are already using AI on client work.
- 03Growing companies facing assurance
- Healthcare, finance, legal and anyone hitting their first enterprise security questionnaire, SOC 2 audit or ISO 27001 push.
- 04AI-forward teams of any size
- Already shipping AI features, running internal AI tools or letting agents write code, and aware that nothing currently watches them.
- 05MSPs and MSSPs
- Multi-tenant from the first login, per-client dashboards, white-label ready, partner margin on the platform.
Why Stealth Cyber4 credentials
- Offensive security at the core
- OSED and CED certified leadership. We attack systems for a living, which is why the detections are where they are.
- Real incident response experience
- Credential theft, business email compromise, ransomware and MSP supply chain compromise, investigated end to end.
- Governance credibility
- Contributions to state government information security standards, IRAP pre-audit work, ISO 27001 and SOC 2 programmes underway.
- Follow the sun coverage
- Teams in Australia, Brazil and the United States. Local accountability, extended hours, one platform.
Next step
A 30 minute technical walkthrough of the console against your environment, or a scoped Nerv-AI red team assessment of one AI system.