Special offerFree guided installation and your price locked for 24 months. Limited spots.See plans
A Security Operations Center run by AI agents, for small businesses
Enterprise-grade protection, tailored to your team.
One sensor watches your whole network, AI agents investigate every threat around the clock and explain what's happening in plain English. You approve the response from your phone.
Watch an attack, step by stepHigh
Break-in attempt on the file server
412 passwords tried in 39 s from 203.0.113.9
Approved by you · blocked at the firewall
Built on the technology the most demanding security centers rely on
What it is and why you need it
It is often called a SOC. Banks and large corporations have one: a team that watches the network around the clock, spots break-in attempts early and says what to do before the damage is done. Until now, a small business could not afford one.
It reviews everything that enters, leaves and moves inside your network, day and night, weekends and holidays.
It separates normal from dangerous and tells you in plain words what is happening and how serious it is.
It proposes the concrete action to stop the attack. With Kuntur, you approve it from your phone.
Kuntur gives you that complete security center, run by AI agents with someone from your company making the calls, for a fraction of what building one costs.
The problem
They happen overnight, on holidays, when nobody is watching. The difference between a scare and a business that grinds to a halt is minutes.
Days out of business.
One message on your phone.
88%
of data breaches at small businesses involved ransomware.
241 days
is the average time to identify and contain a breach.
$1.9M
less is what a breach costs organizations that use security AI and automation extensively.
Step by step
This is how Kuntur works when someone tries to get into your network. Tap each step or let it play.
02:37:01 · Watcher
Suricata and Zeek analyze the traffic copy. In 39 seconds, 412 password attempts hit the file server.
02:37:01 suricata ET SCAN SSH brute force 203.0.113.9 → 10.0.0.12:2202:37:39 zeek ssh auth_success=F ×412 in 39 s02:37:40 zeek no successful logins
02:37:40 · Analyst
It checks the address against reputation lists, looks for successful logins and compares with what's normal on your network.
02:37:52 · Analyst
No cryptic codes: what happened, how serious it is and why it matters.
“Someone on the internet is trying passwords against your file server. They're not in yet, but if they guess right they'd have access to the whole company's documents.”
02:37:53 · Responder
One concrete, temporary, reversible action, with what it affects and what it doesn't.
Block 203.0.113.9 at the firewall for 24 hours
02:41:03 · You
The alert reaches Slack, Teams, email or PagerDuty. Your IT lead reviews it on their phone and taps Approve.
Kuntur· 02:41
High · Break-in attempt on the file server. Block 203.0.113.9 for 24 h?
Approved by M. Rivas
02:41:06 · Sensor
The sensor applies the rule on your firewall in seconds and keeps the evidence ready for an audit.
4 min 5 s from the first attempt to the block, with nobody staring at a screen.
Illustrative scenario with sample data.
Services
What a large company gets from its security operations center, done by AI agents with a person at your company making the calls.
A sensor analyzes all the traffic on your network, day and night, with Suricata and Zeek.
All plansAI agents review every alert, filter out the noise and explain what's real in plain language.
All plansIntrusions, malware talking to attackers, spreading ransomware, scans and data theft, mapped to MITRE ATT&CK.
All plansUp-to-date IP and domain reputation and indicators of compromise to recognize known attackers.
All plansDiscovers every device and service on your network, including the ones nobody remembered.
All plansFinds software with known flaws (CVEs and the CISA KEV catalog) and tells you what to fix first.
All plansChecks from the outside which of your services, ports and certificates an attacker can see.
Business and upCollects logs from your firewalls and servers, correlates them with network traffic and retains them.
All plansContainment with your approval: temporary, reversible blocks on your firewall, with step-by-step guidance.
All plansIf nobody handles a serious alert in time, Kuntur notifies the next person on the list.
Business and upThe agents look for signs of hidden attackers that haven't triggered an alert yet.
Business and upReconstructs what happened, where it came from and which devices it touched, with a timeline and evidence.
Business and upA risk score and a summary for management in business language.
All plansEvidence and control mapping for ISO 27001, PCI DSS and NIST CSF.
Business and upConnect Kuntur to your SIEM, your help desk or your own workflows through signed webhooks.
EnterpriseA team that helps you with installation, alerts and questions.
All plansWhy Kuntur
Watching around the clock
Kunturyes
Sees traffic between devices on your network
Kunturyes
Finds vulnerabilities across the network
Kunturyes
Explains every alert without jargon
Kunturyes
Responds in minutes, with your approval
Kunturyes
Published price, no lock-in
Kunturyes
Up and running in an afternoon
Kunturyes
Kuntur doesn't replace your antivirus or your firewall: it complements them and uses your firewall to respond.
ROI
Adjust the assumptions to your market. The math is simple and in plain sight.
Fully loaded salary; adjust it to your market.
168 hours a week in shifts, with vacations and absences.
Estimated yearly savings
USD 415,412
44.3× times less than an in-house team
Compares staff cost with Kuntur's annual list price. Excludes tools, training and the cost of a breach.
Trust
We designed Kuntur so connecting it is an easy call for your IT lead.
Special offer
Sign up now and our team installs the sensor with you over video call, at no cost. Plus, your price stays locked for 24 months. Limited spots.
The sensor receives a copy of the traffic from the mirror port. If it goes down, your network keeps working exactly the same.
It keeps metadata and alerts, never the content of emails, documents or web pages.
Every block is approved by a person, is temporary, undoes with one click and is audited.
Each sensor has its own certificate and connects to the AWS cloud over mutual TLS.
Setup
15 min
A Linux server or virtual machine plugged into your switch's mirror port. We walk you through it on a video call.
1 hour
It discovers your devices and services and starts learning what's normal.
Same day
Vulnerabilities, exposed services and alerts, explained and ranked by urgency.
Pricing
No lock-in. Annual billing includes two months free.
To start seeing what's going on
USD 149per month
To respond fast, with on-call
USD 799per month
For mid-size companies, 151 to 999 devices
USD 1,490per month
For compliance and audits
USD 2,500per month
Rather try first? Start a 14-day free trial, no card
| Service | Starter | Business | Corporate | Enterprise |
|---|---|---|---|---|
| 24/7 network monitoring | Yes | Yes | Yes | Yes |
| AI triage and investigation | First-pass AI | Advanced triage AI | Advanced triage AI | + cross-incident correlation |
| Threat detection | Yes | Yes | Yes | Yes |
| Threat intelligence | Yes | Yes | Yes | + your own feeds (STIX/TAXII) |
| Asset inventory | Yes | Yes | Yes | Yes |
| Vulnerability management | Monthly scan | Weekly scan | Weekly scan | Daily scan |
| External attack surface | — | Monthly | Every 2 weeks | Weekly |
| Log management (SIEM) | 90-day archive | 30-day search · 1-year archive | 30-day search · 1-year archive | 90-day search · 2-year archive |
| Incident response | Step-by-step guidance | Approved blocking, 1 firewall | Approved blocking, 1 firewall | Multiple firewalls and dual approval |
| Escalation and on-call | — | Yes | Yes | + PagerDuty |
| Proactive threat hunting | — | Monthly | Every 2 weeks | Weekly |
| Forensics and root cause | — | Report per critical incident | Report per critical incident | Full, with exportable evidence |
| Reports and security posture | Monthly | Weekly | Weekly | Weekly + board presentation |
| Compliance and audits | — | Control mapping | Control mapping | Audit-ready reports |
| Integrations | — | — | — | SIEM and webhooks |
| Human support | Email, 2 business days | Email and chat, 8 hours | Email and chat, 4 hours | Technical manager, 1 hour for critical |
Buy
Pick a plan, pay by card right here and get your access by email, without leaving this page.
By card, right here on this page, through Stripe. Pay monthly, or annually with two months free, and get your invoice by email. Enterprise is signed as an annual agreement.
You create your account with no card, install the sensor following the guide and see your first findings the same day. For 14 days you get every Starter or Business feature with up to 10 sensors. If you don't buy, the account simply deactivates; nothing is charged.
No. Kuntur is built for companies without a security team. You just need someone to receive the alerts and approve the responses; the AI agents do the investigation.
No. It receives a copy of the traffic and isn't in the data path. If it goes down or fails, your network keeps working exactly the same.
That's why nothing runs without a person's approval. Every alert shows the evidence, blocks are temporary and undo with one click, and your critical devices are never blocked.
Blocking with approval works with pfSense, OPNsense, FortiGate and MikroTik. With other firewalls, Kuntur tells you exactly what to block and you apply it.
Connection metadata, alerts and the inventory of devices and services. Never the content of emails, documents or web pages.
A Linux server or virtual machine (4 cores, 8 GB of RAM and two network cards) and a switch with a mirror port, which almost every managed switch has.
No. Pay monthly, or annually with two months free, and cancel whenever you want from the dashboard.
Free trial
Every Starter or Business feature, no credit card. We'll email you a temporary password and guide you through connecting your first sensor.