Early access · Security investigation
Understand incidents. Explain them clearly.
Verakase helps security teams turn noisy security signals into structured investigations and evidence-backed forensic reports.
CASE-2026-0147
In review
Suspicious login followed by PowerShell execution
Timeline · UTC
- 12 failed logins for j.doe
- Successful login, same account
- winword.exe starts powershell.exe
- PowerShell loads a DLL from a user folder
Direct Plausible Context
Synthetic example
The problem
Alerts tell you something happened. Not what happened.
Understanding an incident means connecting events, checking what supports each conclusion, and writing it up for others.
- Failed login ×12
- New service installed
- powershell.exe -enc
- Outbound connection
- Rule: possible malware
- Successful login
Synthetic example
Local deployment
Runs on your network. Nothing leaves.
Verakase runs entirely on a single machine inside your network, including the language models it uses. Investigation data stays where it is collected.
One machine
Every part of the platform, from investigation to reporting, runs on a single server you control.
Local language models
The language models run on the same machine. Case data is not sent to an external AI service.
Your control
Your team operates it, decides who has access and keeps the investigation record.
Evidence grades
Every connection says how it’s known.
Direct
Linked by a shared identifier in the data.
Plausible
Suggested by the data, but not confirmed.
Context
Useful background, not part of the chain.
Inconclusive
The data can’t settle it either way.
The forensic report
A report people can actually use.
Findings, timeline, evidence and assessment in one readable document.
CASE-2026-0147
Suspicious login followed by PowerShell execution
In review Draft report
Case summary
Within the investigated hour, a Word process started an encoded PowerShell command, which then loaded a DLL from a user folder. The three steps are directly linked in the process data.
Key findings
- Direct Encoded PowerShell launched from an Office document
- Plausible Repeated failed logins followed by success
- Context Outdated Office version on the host
Analyst assessment
The login activity and the PowerShell chain may be part of one incident, but no shared session identifier confirms it. Treated as possible, not established.
Timeline · UTC
- Failed logins begin
- Successful login
- PowerShell from Word
- DLL loaded
Limitations
No process data from 14:07 to 14:12. That gap is reported, not treated as evidence that nothing happened.
Illustrative report · synthetic example data
Trust
Clear evidence. Clear limitations.
Verakase is designed so you can check its work.
Evidence-backed
Findings stay connected to observable security data.
Transparent
Evidence, context and interpretation are kept separate.
Read-only
Investigations don’t modify the systems they examine.
Analyst-controlled
People make the final assessment and decide what to do.
Early access
We’re building Verakase now.
Talk to us about your investigation workflow.