02 The platform
Dovre - sovereign security, end to end
Our services are built on Dovre - a complete, sovereign cybersecurity platform you can own and operate yourself. Dovre is generally available and running in production.
Generally available - demonstrations and proofs of concept on request.
One platform, full control
Dovre brings together what a modern security operation needs in one coherent platform - built in Norway, with no dependency on foreign vendors. Modular, so you adopt what you need. And sovereign, so the data and control stay with you.
Why Dovre
Sovereignty - without compromise
Autonomy & sovereignty
Complete control over your infrastructure and data - without external dependencies or vendor lock-in.
Customisation & control
Shape the platform around your organisation, with full control over what goes in and out.
Built for high-security environments
Designed with national-security requirements in mind - without compromising on performance.
High performance
No compromise on speed, reliability or scale. Built for mission-critical operations.
Cost-efficient
One coherent ecosystem instead of a stack of expensive, overlapping licences.
Platform-agnostic
Run in public or private cloud, hybrid - or fully air-gapped on-premises.
The platform
What Dovre covers
SOC & detection
The operational hub of your security. Alerts flow in, get enriched and prioritised, and turn into action. You own the detection rules, automate the response, and follow every incident from alert to closed case.
- Real-time multi-method detection
- Automated response (SOAR)
- Full incident and case management
- Detection rules you control
Endpoint & network
Purpose-built sensors that see what's actually happening on your endpoints and across your network. They score anomalies and match threat indicators right at the edge - and every finding is explainable, not a black box.
- EDR for Windows, Linux and macOS (coming soon)
- Explainable network anomaly detection
- Real-time IoC matching
- Remote response through firewalls
Threat intelligence
Collect, manage and analyse threat intelligence - indicators, actors and campaigns - and wire it straight into detection so your defences act on what's actually targeting you.
- IoC and campaign management (TLP 2.0)
- Export to STIX 2.1 / MISP
- Wired straight into detection
Crisis management
Vete is coming soon: all-hazards crisis management across the whole lifecycle - planning, preparation, response, recovery and evaluation. With on-call duty, notification, escalation and AI-assisted operations. Named after the signal fires of Norway's historic beacon network - and built to keep working even when everything else is down.
- Full crisis and preparedness lifecycle
- On-call notification and escalation
- Works offline
- Secure cross-organisation sharing
Sovereign AI
AI that works for your analysts on your terms. A range of language models and hosting options - including models hosted locally on your own infrastructure - so each need gets the right fit, alongside a security knowledge graph and orchestrated agents that assist investigation.
- A range of models for different needs
- Hosting options, including fully local
- Knowledge graph for incidents and TTPs
- AI-assisted investigation
Log storage & search
Traditional log storage gets unaffordable fast - so most teams throw data away long before they should. Archive flips that: logs live on low-cost object storage and are queried directly with SQL. Atomic indicators - IP addresses, domains, hashes, user names and the like - are indexed automatically, so pivoting during an investigation answers in milliseconds. Everything else is configurable per table, with full-text and wildcard search where you enable it. Keep years of history and still hunt through it - at a fraction of the cost.
- Years of logs on low-cost object storage
- Indicators indexed automatically - sub-second lookups
- Configurable indexing and full-text search per table
- Query everything directly with SQL
- Full history for hunting and investigation
- Without the SIEM storage bill
Flexible deployment
Deploy anywhere. Choose who to trust.
The same security capabilities whether you run in public or private cloud, hybrid - or fully air-gapped on-premises. A managed Dovre service (SaaS) is also underway.
The spirit of Dovre
United and loyal until Dovre falls
The name comes from the oath at Eidsvoll in 1814. The Dovre mountains stand for unity, permanence and independence - exactly what a sovereign security platform should give you.
See Dovre on your own terms
Dovre is generally available. Ask for a demonstration, or run a proof of concept on your own infrastructure and data.