Vault Sentinel Cyber Recovery

Vault Sentinel is an AI-powered cyber recovery solution built for the scenario traditional resilience tooling cannot handle: a destructive cyber attack in which a large number of platforms are compromised, including Tier 0 foundational infrastructure, and access to the rest is simply not available. When the environment an organisation would normally recover with is itself the casualty, Vault Sentinel is what remains standing.

Data is held in secure, isolated vaults protected by a ZeroLink Airgap, a true air gap by architecture, not a "secure network." Nothing in production can reach the vault, and the vault trusts nothing from production. Every object is scanned on ingestion, with scanning detecting threats and anomaly detection identifying behavioural anomalies before they enter the vault. Dedicated forensics environments are available to investigate suspect objects in isolation.

Everything in the vault is stored in platform-native formats, a core feature, not a detail. Recovery has no dependency on vendor software or vendor infrastructure, because it is precisely that software, and the Tier 0 foundational infrastructure supporting it, that is lost in an attack. A vault that survives is worthless if the tooling needed to read it did not. Vault Sentinel captures the entire stack, from the network layer through to business applications: infrastructure configuration, all cloud services not only the contents of compute and databases and the SaaS platforms the business depends on. Where traditional tooling covers only a handful of major SaaS vendors, cyber recovery demands the widest possible coverage, and Vault Sentinel builds connectors for the platforms your organisation actually runs on.

Recovery is organised around the business, not the infrastructure. Business services are mapped as full dependency hierarchies up to the Minimum Viable Company, the smallest set of services and objects the organisation needs to operate. Runbooks are assigned to objects, data sets and business services, providing an accurate Recovery Time Objective for each node in the hierarchy, with RTO automatically rolled up to the Minimum Viable Company. Recovery scenarios are created in cloud directly from business services or the Minimum Viable Company, so the organisation knows before an attack exactly what can be recovered and how fast. The entire business service can be retrieved in two clicks.

Execution is directed through crisis management command and control. Mobilisation and impact assessment bring the right people and priorities together in the first minutes. A library of master runbooks generates Active Runbooks that direct engineers and specialists task by task, with recovery progress visible minute by minute across the enterprise.

Supporting the engineers and the crisis management team is Clara, the AI recovery assistant, backed by multiple technology and business agents. Clara Live monitors consoles and screens during a recovery, providing context-sensitive advice and support to engineers as they work, expert guidance at the moment it is needed, at every position in the recovery.

Vault Sentinel is founded on the CMORG cyber vault principles, co-chaired by the Bank of England and UK Finance, and helps organisations across every sector evidence regulatory obligations for operational resilience, such as DORA in Europe, the Bank of England and FCA operational resilience rules in the UK, and equivalent expectations from regulators including APRA, MAS and the FFIEC agencies internationally. Vaults are positioned regionally to meet data sovereignty requirements.