Product · AI threat detection
Sentinel watches every Polfence product for you: sign-ins, tunnels, DNS queries, remote sessions, access grants and monitors. It correlates the signals, explains each finding in plain language and, when you allow it, contains the threat on its own and tells you what it did.
Brute force and credential spraying, impossible travel, DNS beaconing and DGA, data-exfil patterns, traffic spikes, unusual remote controllers, privilege creep, API-key abuse and more. Every finding carries the exact evidence that triggered it.
Monitor only, assist (Sentinel proposes, you click), or autonomous (Sentinel acts within the actions you allow). Every automatic action is logged and reversible with one click.
Block an IP everywhere, quarantine a device at the WireGuard layer, suspend a VPN profile, lock a remote machine, block a domain across Shield, or flip the DNS kill switch.
Findings are summarised, prioritised and explained by an EU-hosted language model. No key configured? You get the same workflow with rule-based text. AI never acts on its own.
What happened, what Sentinel did, what needs a human. One email, written for the person who has to decide, not the one who wrote the rules.
Every finding and action is an audit event, so it flows to Slack, Teams, webhooks and the REST API like everything else.
Start free in under a minute, or book a demo and we'll map it to your setup.