Anthropic showed the map. monsys.ai is the store.
Anthropic published this week how their own Detection team uses Claude for alert triage and investigation. The numbers are striking, and confirm what we've been building since day one.
What Anthropic published
Jackie Bow's team built CLUE, Claude Looks Up Evidence, on top of Claude Code, with integration into Slack, their data warehouse, and internal logs. What they reported over 30 days of work:
- False-positive rate on alert triage dropped from about 33% to 7%.
- 12,000 automated queries and 27,000 tool calls executed.
- An estimated 1,870 hours saved: equivalent to 234 person-days.
- Average investigation time down to 3-4 minutes, where it used to be hours or days.
Source: Anthropic blog, May 2026. How Anthropic uses Claude for cybersecurity ↗
What that means for an EU SMB
Anthropic has a Detection Engineering team of professionals who can build that in-house. That's the exception. An average Belgian SMB with 5-50 servers has one IT lead, or an MSP that bills by the hour. For them, 'build your own CLUE' is not an option.
What is available to them: a production-ready SOC platform with the same workflow, EU-hosted, with output an auditor will accept. That's what we're here for.
What we deliver
Our stack delivers the same three ingredients as CLUE: alert enrichment, natural-language log investigation, and autonomy over playbook rigidity, plus three things their internal tool doesn't need to cover:
- EU residency: all infra in the EU, GoTrust BV as the legal entity. No US export of customer data.
- Audit-grade evidence: every period or incident produces an Ed25519-signed tarball your auditor verifies offline with an open-source Python script.
- Compliance engine: automatic mapping to ISO27001, NIS2, BE-CyFun and CIS, no manual spreadsheets.
What we DON'T do
We don't copy Anthropic's autonomy model one-to-one. Our alert evaluation stays rule-based (threshold + z-score, no LLM judgement on the hot path). Our AI Explain runs locally on the host via Ollama, opt-in. Reason: an auditor doesn't accept 'the LLM thought this was suspicious', they accept a repeatable rule and a signed proof. With us, AI is a layer on top of the deterministic core, not in front of it.
Want this workflow in your own environment? Five agents free, then €3 a month. No credit card. EU-hosted.
All numbers and quotes come from Anthropic's own blog post, linked above. monsys.ai is not a partner of or affiliated with Anthropic: we use public information to illustrate our positioning.