METHODOLOGY

How we measure the Intelligence Fabric

Every number we quote on the platform page is grounded in named customer deployments — BT, Kingspan (3,500+ employees), Advantage Solutions, Miller Insurance, ED&F Man, and IPSL — plus aggregate production telemetry from the SenseOn Intelligence Fabric. This page documents the sample sizes, date ranges, and definitions behind each claim so that CISO and SecOps buyers can verify, reproduce, or challenge the numbers. Where a figure depends on a specific deployment, the customer is named. Where it depends on an aggregate, the denominator is stated.

← Back to the platform overview

Principles

Three rules every number on /platform obeys

Named, not anonymous

Customer proof points name the customer (with their written consent) and cite the deployment scope. No composite customers, no hypothetical examples.

Falsifiable, not marketing

Every metric states a denominator, a sample window, and a measurement definition. If you ran the same query against your own environment, you would get a comparable answer.

Updated quarterly

Numbers roll forward on a published cadence. Old values are archived so you can see how the fabric has performed over time.

Per-metric detail

Every number on the platform page, traceable

Each card below maps to a claim on /platform. Links on the platform page deep-link to the matching card here.

92.5%Agent cases completed end-to-end

Denominator: All cases raised across all production customer environments during the measurement window
Date range: Rolling 30-day window, updated quarterly
Sample size: Aggregate across all production customer environments. Individual enterprise environments (including Fortune 500 deployments) exceed this figure.
Methodology: A case is counted as 'completed end-to-end' when Resolve closes the incident autonomously with full decision-trace evidence, without a human analyst taking over the investigation or response action. Cases escalated to the 24/7 managed-response team are excluded from the numerator but remain in the denominator. The 92.5% is the blended conservative floor across the full customer base.

Caveats

The figure is an aggregate across all deployed customers — not a single environment or sampled cohort.
Cases that required human judgment by design (e.g. policy exceptions) are classified as escalations, not failures.
When Resolve escalates to a human analyst, no credits are consumed for that case.

~40%Data reduction at the edge

Denominator: Raw telemetry volume entering the Edge Processing pipeline, measured in bytes before enrichment and deduplication
Date range: Rolling 30-day window, aggregate across production tenants
Sample size: Aggregate across all production tenants
Methodology: Calculated as (1 − egress_bytes / ingress_bytes) across the Edge Processing pipeline, built on Fluent Bit (CNCF graduated) and OpenTelemetry. Reduction driven by deduplication, field pruning of irrelevant telemetry, and intelligent aggregation of high-cardinality log sources. For industry context: Chronosphere (corporate steward of Fluent Bit) reports 60–84% data reduction across their observability customers; Cribl reports ~41% in published case studies. SenseOn's ~40% is a conservative aggregate across security-specific telemetry, which compresses less than pure observability data.

Caveats

Reduction varies by source mix and log cardinality — endpoints compress less than verbose network or cloud audit logs. Customer-specific figures available on request.
The '~' prefix reflects variance across the tenant population; individual customers see a range.
Industry benchmarks from Chronosphere and Cribl demonstrate that Fluent Bit-based edge processing routinely delivers 40–80%+ reduction depending on source type.

Unlimited — configured per pipelineSecurity Data Lakehouse retention

Denominator: Not a sampled measurement — this is a product configuration capability
Date range: Current as of Q2 2026
Sample size: Product capability (not a sampled measurement)
Methodology: 30 days hot storage is included in the detection and response pipeline cost. Beyond that, compressed cold-tier retention is unlimited — priced per pipeline via Flex Intelligence Credits. Customers set retention to match compliance obligations (NYDFS 7 years, DORA 5 years, NIS2, SOC 2 Type II evidence retention). Cold-tier data remains queryable via standard APIs throughout the retention window.

Caveats

Default minimum: 30 days hot storage included in the base detection and response pipeline.
Retention beyond 30 days is priced on a per-pipeline basis via the FIC credit model.
No hard upper limit — retention period is customer-configured based on compliance requirements.

0.68%True-positive density across investigated cases

Denominator: Total cases investigated by Resolve across all customer environments — including alerts from SenseOn analytics and integration partner sources (CrowdStrike, Splunk, Defender, etc.)
Date range: Rolling 12-month window, updated quarterly. Last confirmed: April 2026
Sample size: 30 million+ cases
Methodology: Of 30M+ cases investigated by Resolve, 0.68% were confirmed true positives requiring action. The inverse (99.32%) represents cases correctly identified as non-threats. This metric illustrates the fundamental signal-to-noise challenge: as data volumes grow exponentially, the true-threat rate shrinks — requiring compounding AI compute to find increasingly subtle signals within noise.

Caveats

The sample has grown beyond 30M since the January 2026 snapshot. Updated figures roll forward quarterly.
True-positive density varies by customer environment, industry vertical, and integration source mix.

<20 minutesMean time to detect and respond

Denominator: Aggregate across managed-service customer environments
Date range: Rolling 30-day window
Sample size: Aggregate across managed-service customers
Methodology: SenseOn's case management system tracks Mean Time to Acknowledge (MTTA), Mean Time to Investigate (MTTI), and Mean Time to Respond (MTTR) for every customer environment in real time. Customers with the SenseOn managed service see these metrics in their dashboard — week on week, month on month. The <20 minute figure is the aggregate across managed-service customers. Every customer can verify their own MTTA/MTTI/MTTR against their live data.

Caveats

Individual customer metrics vary based on environment complexity, case severity distribution, and service tier.
Per-customer MTTA, MTTI, and MTTR are visible in the SenseOn dashboard in real time — this is a platform capability, not a static benchmark.

Evaluation pack

Questions, objections, or due-diligence requests

CISOs and SecOps leads running formal evaluations can request the underlying query definitions, audit logs, and customer references. Contact your SenseOn account team or reach us via the platform enquiry form.

Request the evaluation pack

How we measure the Intelligence Fabric

Three rules every number on /platform obeys

Named, not anonymous

Customer proof points name the customer (with their written consent) and cite the deployment scope. No composite customers, no hypothetical examples.

Falsifiable, not marketing

Every metric states a denominator, a sample window, and a measurement definition. If you ran the same query against your own environment, you would get a comparable answer.

Updated quarterly

Numbers roll forward on a published cadence. Old values are archived so you can see how the fabric has performed over time.

Every number on the platform page, traceable

Each card below maps to a claim on /platform. Links on the platform page deep-link to the matching card here.

92.5%Agent cases completed end-to-end

Denominator: All cases raised across all production customer environments during the measurement window
Date range: Rolling 30-day window, updated quarterly
Sample size: Aggregate across all production customer environments. Individual enterprise environments (including Fortune 500 deployments) exceed this figure.
Methodology: A case is counted as 'completed end-to-end' when Resolve closes the incident autonomously with full decision-trace evidence, without a human analyst taking over the investigation or response action. Cases escalated to the 24/7 managed-response team are excluded from the numerator but remain in the denominator. The 92.5% is the blended conservative floor across the full customer base.

Caveats

The figure is an aggregate across all deployed customers — not a single environment or sampled cohort.
Cases that required human judgment by design (e.g. policy exceptions) are classified as escalations, not failures.
When Resolve escalates to a human analyst, no credits are consumed for that case.

~40%Data reduction at the edge

Denominator: Raw telemetry volume entering the Edge Processing pipeline, measured in bytes before enrichment and deduplication
Date range: Rolling 30-day window, aggregate across production tenants
Sample size: Aggregate across all production tenants
Methodology: Calculated as (1 − egress_bytes / ingress_bytes) across the Edge Processing pipeline, built on Fluent Bit (CNCF graduated) and OpenTelemetry. Reduction driven by deduplication, field pruning of irrelevant telemetry, and intelligent aggregation of high-cardinality log sources. For industry context: Chronosphere (corporate steward of Fluent Bit) reports 60–84% data reduction across their observability customers; Cribl reports ~41% in published case studies. SenseOn's ~40% is a conservative aggregate across security-specific telemetry, which compresses less than pure observability data.

Caveats

Reduction varies by source mix and log cardinality — endpoints compress less than verbose network or cloud audit logs. Customer-specific figures available on request.
The '~' prefix reflects variance across the tenant population; individual customers see a range.
Industry benchmarks from Chronosphere and Cribl demonstrate that Fluent Bit-based edge processing routinely delivers 40–80%+ reduction depending on source type.

Unlimited — configured per pipelineSecurity Data Lakehouse retention

Denominator: Not a sampled measurement — this is a product configuration capability
Date range: Current as of Q2 2026
Sample size: Product capability (not a sampled measurement)
Methodology: 30 days hot storage is included in the detection and response pipeline cost. Beyond that, compressed cold-tier retention is unlimited — priced per pipeline via Flex Intelligence Credits. Customers set retention to match compliance obligations (NYDFS 7 years, DORA 5 years, NIS2, SOC 2 Type II evidence retention). Cold-tier data remains queryable via standard APIs throughout the retention window.

Caveats

Default minimum: 30 days hot storage included in the base detection and response pipeline.
Retention beyond 30 days is priced on a per-pipeline basis via the FIC credit model.
No hard upper limit — retention period is customer-configured based on compliance requirements.

0.68%True-positive density across investigated cases

Denominator: Total cases investigated by Resolve across all customer environments — including alerts from SenseOn analytics and integration partner sources (CrowdStrike, Splunk, Defender, etc.)
Date range: Rolling 12-month window, updated quarterly. Last confirmed: April 2026
Sample size: 30 million+ cases
Methodology: Of 30M+ cases investigated by Resolve, 0.68% were confirmed true positives requiring action. The inverse (99.32%) represents cases correctly identified as non-threats. This metric illustrates the fundamental signal-to-noise challenge: as data volumes grow exponentially, the true-threat rate shrinks — requiring compounding AI compute to find increasingly subtle signals within noise.

Caveats

The sample has grown beyond 30M since the January 2026 snapshot. Updated figures roll forward quarterly.
True-positive density varies by customer environment, industry vertical, and integration source mix.

<20 minutesMean time to detect and respond

Denominator: Aggregate across managed-service customer environments
Date range: Rolling 30-day window
Sample size: Aggregate across managed-service customers
Methodology: SenseOn's case management system tracks Mean Time to Acknowledge (MTTA), Mean Time to Investigate (MTTI), and Mean Time to Respond (MTTR) for every customer environment in real time. Customers with the SenseOn managed service see these metrics in their dashboard — week on week, month on month. The <20 minute figure is the aggregate across managed-service customers. Every customer can verify their own MTTA/MTTI/MTTR against their live data.

Caveats

Individual customer metrics vary based on environment complexity, case severity distribution, and service tier.
Per-customer MTTA, MTTI, and MTTR are visible in the SenseOn dashboard in real time — this is a platform capability, not a static benchmark.