What Qorionix does, and what it does not

Qorionix is a security platform for companies that do not have a security team. It watches your identities, your privileged accounts, your logs and your endpoints from one place, and it does a large amount of the routine work that would otherwise need a specialist you cannot afford to hire.

This article is deliberately unflattering in places. You are about to trust software with the ability to change how people sign in to your business, and you should know exactly where its judgement ends.

The honest claim

A small company cannot run enterprise-grade security without a specialised team. It can run substantially better-than-nothing security without one.

The best public benchmarks of AI security analysts put a frontier model at roughly 61–67% of a full investigation completed correctly, a purpose-built agent at about 72%, and a strong human analyst at 73–85%. Our own target sits in that band: on known attack patterns, expect Qorionix to catch something in the region of 60–75% of what a competent analyst would catch — and to do it continuously, with an audit trail, at a fraction of the cost of the person.

What it covers

Four capabilities that are normally four separate products, plus the assessment that ties them together.

Posture assessment

One consent to Microsoft 365 produces a report naming your actual administrators, applications, devices and risky sign-ins, plus a set of changes grouped by whether we can safely make them ourselves. This is the fastest thing in the product and the best place to start. See Connect Microsoft 365.

Identity and access (IAM)

Single sign-on, passkeys, adaptive multi-factor authentication that asks for a second factor when a sign-in looks wrong, network zones, and a policy engine that shows you which rule decided and why.

Privileged access (PAM)

Administrator credentials held in a vault and injected into a session, so the person doing the work never sees the password. Sessions are recorded and searchable. Credentials rotate on a schedule.

Log collection and detection (SIEM)

Your Microsoft 365, Entra ID, cloud and Windows logs collected in one place, normalised, and matched against a first-party detection library mapped to MITRE ATT&CK. Detections carry false-positive guidance, because a rule you switch off in week two is worth nothing.

Endpoint detection and response (XDR)

A sensor on Windows, Linux and macOS that reports process activity, reconstructs what a suspicious process actually did, and can quarantine a file or isolate a machine — reversibly.

What it automates, and how far

Sentinel-Q is the part of the platform that decides things. Its permission to act is set by an autonomy tier that you control, and the tier is enforced by the server, not by asking the model to behave.

Three rules hold at every tier, and they are structural rather than advisory:

• Granting privileged access is never automated. Not at any tier, not at any confidence. The capability is not exposed to the model at all, so it cannot be requested by a cleverly worded prompt.
• Ungrounded means unauthorised. Every claim in a decision is checked back against the evidence the platform actually holds. A verdict whose citations do not verify cannot trigger an automated action, however confident it sounds.
• Anything irreversible needs a human. If we cannot record a way to undo an action, we will not take it without you.

There is a fourth rung above these — software that rewrites its own detection rules and adjusts its own limits. We have not built it. Rule-writing autonomy without versioning and rollback is how a system quietly degrades its own coverage, and you would not find out until something got through.

What it cannot do

The list below is the one worth reading twice. None of it is a roadmap item we are being coy about; these are properties of the problem.

• It does not catch a skilled attacker who is targeting you specifically. Detection works on known patterns. A patient adversary who studies your business and uses no recognisable technique is outside what any product at this price detects, and we will not claim otherwise.
• It cannot see what your Microsoft licence does not emit. Some sign-in detail requires Entra ID P1. Where the data is unavailable, the affected checks are reported as skipped, never as passed — a licence limitation must not become a false all-clear.
• Behavioural detection needs time. Learning what is normal for your business takes five to fourteen days of your real traffic. That is a property of the data, not of the software, and nobody can compress it.
• It cannot decide your business trade-offs. Turning off a legacy sign-in protocol is a large security win that will break a printer and one laptop. We will tell you which ones. We will not decide for you.
• It does not deploy itself onto your endpoints. The sensor needs to be installed. If you cannot roll out software to your machines, the endpoint half of the product cannot help you.
• It is not a 24/7 human security operations centre. Some vendors sell people. We sell software. When something needs a human specialist, the platform's job is to say so clearly and hand over a usable summary — not to pretend it has it covered.

Who it is for

Qorionix is built for organisations between roughly ten and a thousand people, in the EU, running Microsoft 365, with no dedicated security staff — or with one overloaded IT generalist who has security added to their job description.

It is a poor fit if you already run a security operations centre with tuned detection content and analysts on rotation. You would be paying for automation you have staff for, and you would find the autonomy limits frustrating rather than reassuring.

Where your data lives

Your organisation is bound to a home region and requests carrying a token from another region are refused outright rather than silently served. For EU customers that region is in the EU.

What to do next

Connect Microsoft 365 and read the report. It takes about ten minutes of your attention and produces something about your own business you almost certainly did not know.

1. Connect Microsoft 365 — one consent, read-only to begin with.
2. Read your posture report — start with the critical findings; they name real people.
3. Work through the first-week checklist — the short list that removes the most risk for the least disruption.