The Devo-born platform Strike48 runs AI agents across existing SIEM and IT tools. For DACH, Strike48 offers on-premises appliances and relies on distributors, system integrators and MSSPs.
Strike48 is bringing its agentic approach to security operations to the DACH region. The Boston-based company, a product brand of Devo Technology, positions its platform as a vendor-neutral layer that lets AI agents work across existing SIEM, log and IT tools. In a conversation with Security Storage und Channel Germany, Senior Director Abdeslam Afras explained how Strike48 intends to build its business in Germany, Austria and Switzerland.
Strike48 emerged from the Devo SIEM business. According to Afras, the platform is agnostic with regard to both SIEM and large language model (LLM) and supports hybrid setups; customers can also bring their own LLM. The security operations center (SOC) is the foundation, but the offering extends into penetration testing, red teaming and process optimization. Penetration testing, Afras said, has become a door opener that comes up far more often in customer conversations.
The platform combines pre-built agents modelled on a modern SOC with a no-code builder for custom agents, according to the company. Via the Model Context Protocol (MCP), agents reach more than 300 connected tools and query logs where they are stored instead of copying them. Afras pointed to US reference cases with ticket figures of up to 70 percent. The company website cites a customer who reports that AI alone closed more than 75 percent of security cases within a month. These are vendor-reported figures.
Control is the second pillar. Strike48 says every agent action is traceable, and customers define which actions agents may take on their own and where a human must approve. A new release adds multi-tenancy and token governance for each workflow, so customers can set limits, manage tokens and keep agents within bounds. New integrations with Palo Alto Networks and CrowdStrike have been added. The roadmap includes further token and reporting optimization, more languages and OEM models.
In a blog post dated October 27, 2026, Strike48 argues that access control for MCP-connected agents must be enforced by the platform, not the protocol. Each agent should hold only the tools its job requires, adding a connector should not widen any existing agent’s permissions, and actions such as endpoint isolation should wait for human approval. The post cites a company survey in which 84 percent of 100 security leaders said their tools cannot access all of their log data.
Data sovereignty is central to the DACH pitch. On September 23, 2026, the company announced an agentic security operations appliance for on-premises and fully air-gapped use, with AI models loaded directly onto the appliance. Strike48 now supports four deployment models: cloud, private cloud, on-premises and air-gapped. Local inference, the company says, allows scaling to billions of tokens at a fraction of the cost of SaaS deployments. Afras added that talks on sovereignty are under way with Schwarz Digits, that a German data center is planned with a partner, and that discussions with eWerk and Telekom are also taking place.
Cost is the other argument. Strike48 offers its own, very low-priced data lake, Afras said, so the SIEM can shrink to an archive while Strike48 supplies the analytical layer. Against Splunk, he sees an advantage in license costs, which are in some cases up to 50 percent lower. The company adds that searching data in place avoids paying twice for the same telemetry and allows older data to move from costly hot storage to cheaper cloud storage such as S3. Independent verification of these claims is still pending.
The go-to-market is channel-led. TD Synnex serves as global distributor, and in DACH the company is talking to Datagroup and Bechtle and, for the MSP segment, to Computacenter. Traditional MSSP business remains a target group; Maidar Secure is already a partner. Banks, Afras said, have been asking for a dialogue for more than a year and are running projects to take up the topic and optimize their SOC. The partner work, he indicated, is only beginning. A partner event in Germany is planned, and after Switzerland, France is next.
Strike48 employs around 200 people worldwide, including developers in the US and India; twelve work in EMEA. Backing comes from Devo’s funding and investor Insight Partners. Deployment is quick, according to the company: about 24 hours for the SaaS version and under two weeks on-premises. To address the skills gap, Strike48 launched a University SOC Program on October 15, 2026, offering eligible universities complimentary platform access. It cites the CyberEdge 2026 Cyberthreat Defense Report, according to which nearly 97 percent of IT security organizations look for at least one AI-related skill in new hires.
For DACH customers, the decisive questions will be local references, hosting options and how quickly the partner network takes shape. The German data center is so far only planned, the partner talks are at an early stage, and the cost and efficiency figures come from the vendor itself. Vendor neutrality and the on-premises option address real concerns of regulated organizations, but the ambition is clear.
Dr. Jakob Jung is Editor-in-Chief of Security Storage and Channel Germany. He has been working in IT journalism for more than 20 years. His career includes Computer Reseller News, Heise Resale, Informationweek, Techtarget (storage and data center) and ChannelBiz. He also freelances for numerous IT publications, including Computerwoche, Channelpartner, IT-Business, Storage-Insider and ZDnet. His main topics are channel, storage, security, data center, ERP and CRM.
Contact via Mail: jakob.jung@security-storage-und-channel-germany.de