Sekoia launches self-hosted SOC platform for government and defence

Sekoia has introduced a self-hosted deployment model for its security operations centre platform, targeting government agencies, defence organisations, critical infrastructure operators and heavily regulated enterprises that cannot route security telemetry through public-cloud services. The Paris-based company says the new offering brings the full Sekoia SOC stack, including detection, threat intelligence, investigation, response and agentic AI workflows, into environments the customer controls entirely.

The product is positioned by the company as a response to a genuine operational gap. Many existing self-managed security platforms struggle to push timely detection-content updates into air-gapped or restricted networks, leaving security teams working from stale rules and growing triage backlogs. Sekoia says its self-hosted model addresses this through signed, predictable software updates and continuously refreshed detection logic, while maintaining clear boundaries between what the vendor manages and what the customer owns.

The deployment model

Chief executive Freddy Milesi framed the announcement in direct terms: "Cloud is a deployment choice, not a definition of modern security. Many of the organisations that matter most to national and societal resilience cannot always send their security data to a public cloud, and they should not have to accept a weaker security model because of it."

The platform is built around five stated design principles: secure deployment, signed and predictable update delivery, regularly refreshed detection content, defined operational ownership, and transparent release communication. Sekoia's chief technology and product officer, Georges Bossert, said the engineering challenge was not only making agentic AI and evolving threat detection available in constrained networks, but ensuring those capabilities remain straightforward to deploy and maintain under strict connectivity and security requirements.

The release does not disclose pricing, supported architecture specifications, minimum infrastructure requirements, or named customers. Sekoia says final capabilities and supported configurations will depend on validated release scope and individual customer deployment conditions.

Market context and competitive landscape

The market for sovereign and on-premises SOC tooling is expanding as digital sovereignty regulations tighten. In the European Union, NIS2 has broadened the definition of essential and important entities required to demonstrate robust incident-detection and response capabilities. Separately, the EU AI Act introduces obligations for AI systems used in high-risk contexts, a category that plausibly captures agentic threat-detection logic operating within critical infrastructure.

Several established SIEM and SOAR vendors, including Splunk, IBM QRadar and Microsoft Sentinel, already offer on-premises or hybrid deployment options. The competitive differentiation Sekoia is claiming centres on the combination of continuously updated threat intelligence and agentic AI workflows in a self-contained package, rather than a static, customer-maintained ruleset. A number of well-funded European security startups are pursuing adjacent approaches in sovereign cloud and private SOC tooling, making this a crowded pitch to a buyer segment that tends toward long procurement cycles and extensive certification requirements.

Regulatory read-across

For defence and government buyers in particular, the self-hosted model must clear procurement hurdles that go beyond product capability. In France, ANSSI accreditation carries significant weight with central-government and defence buyers. Across NATO member states, suppliers targeting classified or restricted network environments typically face additional security-assurance assessments before deployment. Sekoia has not stated which accreditations or certifications the self-hosted platform carries or is pursuing, which is likely to be an early question from procurement teams in its target segments.

The company's broader platform strategy, centred on what it describes as Autonomous Defensive Intelligence, positions Sekoia as a European-native alternative to US-headquartered hyperscaler security tooling at a time when digital sovereignty concerns are influencing public-sector procurement across the continent. Whether the self-hosted model can deliver the same cadence of threat-intelligence updates that cloud-native deployments benefit from will be the key operational question buyers will put to reference customers.