Clone Systems Moves Managed SOC + SIEM to Private, Self-Hosted AI
Clone Systems has rebuilt its Managed SOC + SIEM, a 24/7 managed detection and response (MDR) service, to run on its own private, self-hosted AI. According to the company, customer logs are never sent to an outside AI provider or used to train public models.
- Clone Systems rebuilt its 24/7 Managed SOC + SIEM to run on private, self-hosted AI.
- According to the company, customer logs are never sent to an outside AI provider or used to train public models.
- Pricing is per endpoint with a 50-endpoint minimum and no log-ingestion fees; the SIEM is included.
- Dedicated instances can be hosted in Philadelphia, Athens or Limassol, or in the customer's own environment.
- The service is available now to organizations worldwide.
What the rebuilt service includes
Clone Systems, a managed security and compliance provider based in Philadelphia, says the SIEM is part of the service rather than sold as an add-on. Analysts in the United States and the EU monitor, investigate and respond around the clock, with sub-minute response to critical alerts, according to the company. Detection rules run every minute.
The SIEM collects and correlates logs from endpoints, servers, firewalls, cloud and SaaS in one console. Clone Systems lists more than 100 integrations, including CrowdStrike, SentinelOne, Microsoft 365, Okta, AWS, Microsoft Azure, Google Cloud, Proofpoint and Mimecast.
The Clone Systems AI Assistant investigates alerts and drafts response steps inside the company's own infrastructure. An analyst approves every action. Integrated endpoint detection and response (EDR) and managed intrusion prevention let analysts contain threats at the endpoint.
Data residency and reporting
Each customer gets a dedicated instance. It is hosted in Clone Systems data centers in Philadelphia, Athens or Limassol, or deployed in the customer's own environment so that logs never leave it.
For audits, the service offers twelve standard reports, including a monthly executive report and a compliance evidence pack. Alerts are mapped to PCI DSS, HIPAA, GDPR, NIST 800-53 and SOC 2, and the service provides 12-month log retention for PCI DSS.
The company points to pressure from auditors, cyber insurers and boards to prove continuous monitoring. It notes that PCI DSS v4.0.1 has required automated review of audit logs since March 31, 2025 under Requirement 10.
Pricing and the company's pitch
Managed SOC + SIEM is priced per endpoint with a 50-endpoint minimum. The SIEM, the AI and 24/7 analyst coverage are included, with no log-ingestion fees. Onboarding from first call to full coverage takes a few weeks, according to Clone Systems.
Clone Systems argues that many organizations told to buy MDR find the SIEM, log ingestion and AI features priced separately, or learn that AI-assisted triage means sending sensitive logs to a third-party model. "Every security leader we talk to wants AI working their alerts, and very few want their logs leaving the building to do it," said Jorja Mandy, Director of Strategic Development at Clone Systems.
Mandy added that because the SIEM is included, the quoted price does not climb as log volume grows. Elyse Hamilton, Vice President of Business Development, said buyers should not have to piece together a SIEM license, an ingestion plan and a monitoring contract to meet one requirement.
What it means for buyers
The service is available now to organizations worldwide. For companies under compliance or insurance pressure to adopt MDR, the offer targets two concerns named in the announcement: unpredictable costs tied to log volume, and the exposure of sensitive logs to third-party AI models.
Clone Systems also sells PCI ASV scanning, vulnerability scanning and penetration testing, each separately, so an organization can cover logging (Requirement 10), scanning (11.3) and penetration testing (11.4) with one provider. The company was founded in 1998 and has been a PCI Security Standards Council Approved Scanning Vendor since 2007.
