Summary

• Sekoia Self-Hosted targets disconnected and customer-controlled security networks.
• Version 1.0.1 supports detection and response workflows but excludes Roy, AI Cases and Elevate agents.
• Deployment brings significant local hardware, support and upgrade responsibilities.

Sekoia has introduced a self-hosted security operations platform for government, defence and critical infrastructure organisations that need to keep sensitive telemetry in customer-controlled environments. The initial release can operate in restricted or disconnected networks, but excludes several advertised generative AI functions.

The 27 October launch concerns a deployment model for established detection and investigation technology rather than a complete offline replication of Sekoia’s cloud platform. The company’s version 1.0.1 notes explicitly exclude its Roy assistant, AI Cases and Elevate agents.

These differences matter to procurement because a product described in the broader marketing as autonomous may not deliver those functions when deployed in an isolated environment. The available version offers conventional event collection, investigation, dashboards, case management and supported automated playbooks.

Monitoring without a permanent cloud connection

Some industrial and government systems cannot send operational logs to an external service because connectivity is limited or policy prohibits the transfer. A self-hosted platform allows authorised staff to investigate those events locally and apply response workflows without depending on a constant internet connection.

Sekoia uses a containerised architecture built around K3s Kubernetes with supporting services for storage, messaging, event processing and monitoring. This design creates a dedicated operational platform rather than a simple software agent installed on one server.

The software can ingest events, apply detection rules, investigate alerts and coordinate case information. Threat intelligence can contribute to some detections after the appropriate databases have been imported, even though the platform’s separately branded Intelligence module is unavailable in this release.

Offline deployment complicates maintenance. Detection rules and relevant security information must be transferred into a disconnected environment through controlled processes, with procedures for verifying what has been imported and ensuring content remains sufficiently current.

Sekoia’s documentation notes that its automation playbook library cannot be independently updated after installation in version 1.0.1. This limitation is important when response procedures need changes more quickly than the complete platform release cycle.

Operational control has an infrastructure price

The vendor recommends self-hosting for organisations processing at least 500GB of security data daily or supervising 5,000 assets. Its reference architecture uses at least six substantial compute servers: three manager nodes and three worker nodes, with storage and other supporting infrastructure.

These requirements imply a different cost structure from purchasing access to a shared cloud service. Operators or certified managed security service providers must maintain the installation, monitor capacity, protect backups and plan recoveries after equipment or software faults.

Security monitoring depends on availability. If the logging pipeline stops receiving data or the investigative interface becomes unavailable during an incident, teams may be unable to assess an attack accurately even when the protected business systems continue running.

The initial documentation also says an in-place upgrade to a later version is not supported. That leaves customers needing a clear migration and continuity plan before committing long-lived operational records and playbooks to the deployment.

Segregating a security platform from external services can reduce certain forms of exposure, but it does not remove internal risks. Privileged accounts, configuration management, patching and secure administrative access remain critical to the security operations system itself.

AI capability is a separate question

Sekoia’s cloud offering promotes generative AI assistance and autonomous investigative functions. In the self-hosted version, those features depend on inference components that have not been included in the released product. Treating them as currently operational would exaggerate the technology being sold.

Future local inference could require additional accelerators, model maintenance and evaluation. AI-generated investigations would also need human review and audit records, particularly where an automated response might interrupt a critical service.

Regulated customers should verify the functionality and support commitments attached to the exact software version they plan to install. A capability described on a general product page cannot replace a version-specific feature list or contractual service guarantee.

Security teams also need to decide how far to automate responses. An alert about suspicious activity might justify collecting additional evidence automatically, while isolating an engineering workstation controlling equipment could carry consequences beyond the immediate security threat.

The company’s release notes give customers a useful account of what works today and what does not. Procurement evaluation should focus on those facts, the operational burden of self-hosting and the risks of keeping detection tooling current over time.

Local deployment can strengthen control over where security records are stored, but technical sovereignty is broader than physical location. Buyers need to examine whether suppliers can obtain remote privileged access, whether updates depend on outside infrastructure and how software dependencies are supported through the product’s lifetime.

Before deployment, an operator should test backup restoration, loss of individual cluster nodes and recovery of event ingestion after an interruption. The results will reveal how the architecture behaves under realistic faults, rather than relying solely on the presence of redundant components in a diagram.

Data retention also creates practical decisions. High daily ingestion volumes can rapidly increase storage demand, and different log types may have different legal or forensic value. Appropriate retention settings must balance incident reconstruction, privacy and the cost of secure storage.