A Socratic AI examiner that makes analysts defend their methodology on real cases — not another video course or range. You own the floor. SOLAR is the guide that will not accept “I'd check the logs.”
No sales call · Cancel anytime · First month back if you do not get a usable readiness read on your analysts.
Product demo — examiner, not a customer quote
{
"timestamp": "2026-03-20T14:32:01Z",
"event_type": "Process Creation",
"host": "WIN-SRV-FIN-01",
"user": "NT AUTHORITY\\SYSTEM",
"process": {
"name": "powershell.exe",
"command_line": "powershell -nop -w hidden -enc JABzAD0ATg...",
"parent": "services.exe"
},
"network": {
"destination_ip": "185.22.41.9",
"port": 443
}
}I'd check the logs. The command line has -enc so it's probably malicious.
"I'd check the logs" is not a method. Which log, which field, and which query would prove this parent-child is anomalous — and what legitimate admin tool could look the same?
The problem
The external problem is passive training. Typical cert and video seats often run into the thousands of dollars per person. They teach people how to pass a multiple-choice test, not how to hunt.
The internal problem is yours: you have sat that shift. You cannot tell who will freeze when the ticket is real.
Training that only checks a box is a tax, not readiness. The villain is the checkbox — not a named competitor.
The guide
We have sat that shift. Authority here is the method, not a customer count we do not have: the examiner demands the log, the field, and the query. After a correct step it teaches a real-world beat, then asks the next harder question. It never dumps the answer.
Three steps. No sales call.
Phishing-to-identity, impossible travel, and inbox-rule BEC. The examiner will not accept a label — it wants the log, the field, and the query.
Each completed investigation leaves a personal readiness read. You will know who can defend a method and who guessed.
Night Shift Ready opens the rest of the library, the manager dashboard, and seats for the people who take the night shift.
A miscategorized ticket. A burnt-out Tier 3 woken for work a trained investigator should have closed. That is what checkbox training buys you.
Not a certificate. A readiness read from investigations they actually had to defend.
Alternatives without SOLAR: video and cert courses, cyber ranges, or “shadow a senior.” The unique attribute is a live Socratic examiner that will not accept a slogan. Value is methodology under pressure in 15–30 minutes, plus a manager readiness read on Night Shift Ready.
| AI SOC examiner | Ranges | Video / certs | |
|---|---|---|---|
| What you practice | Methodology on a case file | Tool-specific labs | Memorization |
| Time | 15–30 minutes | Often hours | Passive |
| Feedback | Live examiner: log, field, query | Pass / fail at the end | Quiz score |
| Typical spend | $99/analyst/month | Higher, longer seats | Often thousands per seat |
If an analyst says “I'd check the logs”, the examiner asks which log, which field, and which query. After a correct step it teaches why that check matters on a live floor, then continues. Twists and red herrings stay in the case file.
The manager dashboard (Pro) shows completed investigations, AI grades, and a generated readiness report from drill evaluations. It does not export a compliance pack. The screenshot below is a product mock, not a customer.
Demo data
Night Shift Ready
That is the dream outcome. What you actually get is the stack below, billed at $99/analyst/month. We do not invent dollar values for each line.
$99/analyst/month
First month back if you do not get a usable readiness read on your analysts.
Start the first investigationThe seeded library has 20 scenarios. The first three free investigations are phishing-to-identity, impossible travel, and inbox-rule BEC — full case files, not a quiz. Harder identity and lateral-movement cases sit behind Night Shift Ready. We do not claim a larger library than the seed.
The attraction offer answers “can this person investigate?” Night Shift Ready answers “I need this for the whole floor.”
Good · attraction
Can this person investigate?
Three completed investigations. No card.
Fence: no manager floor, no team invites, no rest of the library after the third complete.
Start the first investigationBetter · the offer we sell
The floor, not one analyst.
Billed monthly · First month back if you do not get a usable readiness read on your analysts.
Cancel anytime. Same Stripe Pro seat as today.
Best · fence
Custom scenarios, volume, invoicing.
Then decide if the floor needs Night Shift Ready.
Start the first investigation