New bugs now get exploited within hours, and attackers chain small gaps across tools that don’t talk to each other. Circuit joins up what your security tools already know, so your team can cut the path with one approved change and prove it’s gone.
Circuit is in development. It runs end to end in our lab, and we’re looking for design partners to shape it with us.
Black Hat India 2026 · Bengaluru, 27–30 Oct · let’s meetAn illustration. The systems are made up.
Patching is still the answer. But this October showed how little time teams get, and how often the fix can’t go in tonight.
Two flaws in PHP let an attacker run code on a web server without logging in. Word leaked on 20 October and attacks began within the hour, before the fixes came out the next day. React2Shell went the same way last December.
A flaw in the Brotli decompressor inside Node.js can let crafted data run code on a server. Current versions got fixes; versions past end of life, such as Node.js 20, won’t. Those teams need another way to cut the risk.
AI tools helped find both of October’s bugs, and attackers have the same tools. The AI agents your teams are rolling out are new identities too, with access of their own.
CERT-In expects many incidents reported within 6 hours of noticing them. Boards and auditors want to know what was done and whether it worked, not just that a ticket was closed.
Most teams can find more problems than they can fix. The hard part is closing the few that lead somewhere, quickly, and showing it’s done.
A serious breach rarely lives in one product. It shows up when a compromised device, a powerful account, a reachable server, a known weakness and important data line up, across systems that never see each other end to end.
Your endpoint, identity, cloud and vulnerability tools each hold part of the story. The path only shows up when someone joins them, usually by hand.
Turning a finding into a change means tickets, hand-offs and change windows. Meanwhile the path stays open.
A tool accepting a change doesn’t mean the risk is gone. Unless someone checks at the source, it’s only assumed.
We’re not asking you to replace anything. Circuit joins up what your tools see, decides with written rules, and acts through those same tools, with your people in charge.
Reads the facts it needs from the tools you already run, and joins them into one map.
A written policy decides whether a real path exists. A missing fact counts as unknown, never as true.
Circuit suggests the best place to cut. A named person approves the exact change with a security key.
Your own executor makes the change through your existing tools, from inside your account.
Circuit checks at the source that the path is gone, and only then calls it done.
Evidence at every step. Each outcome is sealed in a log signed with your key. And when the alert is finally resolved, undoing the cut goes through the same steps.
Security teams are right to be wary of anything that can change production. So the design keeps people, evidence and keys on your side.
Circuit is designed to work through the EDR, identity provider and cloud controls you already run. There’s nothing to rip out.
A path is real only when every link holds on fresh evidence. AI can help find facts, but it never makes the call.
Every change is approved by a named person with a security key, and whoever asks for a change can’t approve it.
Write access to your tools, the key that signs your evidence, and a copy of the evidence all stay in your account.
A change only counts once Circuit sees, in the tool and on the network, that the path is gone.
Circuit’s agents investigate, recommend and explain. They can’t change anything, and every run is recorded.
CERT-In wants many cyber incidents reported within 6 hours of noticing them. Circuit is built to have the draft ready when the path is confirmed, from the same sealed record.
Cyberplane isn’t affiliated with CERT-In. Circuit’s reading of CERT-In’s guidance is for your counsel to confirm.
No dates yet. The order will come from what we hear from security teams, and from the design partners we’re looking for.
An infected laptop, the person signed in on it, a server and customer data. Confirmed, cut with approval, checked, sealed and drafted for CERT-In, then released once the alert is resolved. On a made-up company.
Paths that run through people’s and machines’ access, cut by ending sessions, removing access, reducing privilege or disabling credentials. And more of your tools to read from and act through.
AI agents mapped as identities, with their tools and data. And a gateway that can stop a risky tool call before it runs.
A dedicated cell for one organization, regions beyond India, and later Circuit in your own cloud or data center.
Acting without a person isn’t offered. If customers ever want it for small changes that can be undone, it’ll be their choice, one kind of action at a time.
We don’t have customers yet, and we won’t pretend otherwise. We’re looking for a few security teams who want to work on this with us from the start.
Tell us, and we’ll show you how Circuit would cut it and prove it. Or just write to hello@cyberplane.ai.