Introducing Sazabi Security: Security Monitoring That Investigates Before It Alerts

Today we're excited to announce Sazabi Security.

Sazabi already watches your production system for bugs, outages, and reliability problems, surfacing them to you at the right moment with the context you need to take action. Starting today, Sazabi does the same for cyberattacks. Connect your identity, cloud, and network logs, and Sazabi watches them for suspicious activity, investigates anything it finds, and opens a security issue when something is actually wrong.

Sazabi Security is designed for startup engineering teams without dedicated security resources, and for security teams that want to spend less time writing static rules and triaging alerts. It's available today for every Sazabi customer. Sign up at www.sazabi.com to get started.

Why Sazabi Security? Why Now?

October was a tough month for security. The largest incident was at Binance, where attackers stole $6.34 billion on October 29th. It was the largest crypto theft ever, and arguably the most successful hack of all time.

Engineering teams have been quick to respond, and so have vendors. In recent weeks, Vercel, CodeRabbit, Cognition, and GitHub have all launched AI reviewers that check every pull request for vulnerabilities, scan the codebase, and propose fixes. Sazabi launched cve.now, a free, real-time feed of CVEs and security advisories that developers can use to patch their systems quickly.

These tools are valuable, and we recommend using them. But they all have one thing in common: they look for weaknesses in your code before it reaches production. That's an important part of security, but it isn't the whole picture.

The Binance hack is a good example. According to Binance's postmortem, the attackers did not exploit a weakness in Binance's code. Instead, the hack began with a fake job interview that installed malware on an employee's laptop. Over the following weeks, the attackers pivoted to other engineers' machines, obtained a deployment token, and used it to reach an internal service responsible for signing transactions. That's how they were able to move the funds.

Attacks like this aren't caught by code scanning. They're caught by monitoring and detection: watching what happens in production and spotting suspicious activity early, before it becomes a problem. We believe this is the part of security most teams are missing today.

What's New

Sazabi Security extends our existing automatic issue detection to security. It has five parts.

1. Security Log Sources

Sazabi now ingests logs from more than 20 security tools, including Okta, Auth0, WorkOS, AWS CloudTrail, Google Cloud audit logs, GitHub audit logs, Cloudflare, and AWS WAF. AWS, Google Cloud, and Cloudflare connect directly from your account, with no special instrumentation required.

Security logs live alongside the application logs you already send us, in the same log search, so you can search across all of them at once. A single investigation can follow an attacker from their first sign-in to their most recent request.

2. Security Detection

Once your logs are connected, Sazabi watches them for security signals. There are no rules to write or thresholds to set. Sazabi automatically detects dozens of security-relevant signals, including:

• Authentication anomalies
• Privilege changes
• Unusual data egress
• Attack payloads
• Exploit attempts
• Bots and scraping
• Secrets, PII, and sensitive data in logs

And more.

3. Security Investigations

When a signal is surfaced, Sazabi begins investigating it immediately, pulling related activity from all of your sources, including your codebase and database if they're connected. It checks whether the behavior is normal for your company and tracks down the root cause. If the activity is a legitimate concern, Sazabi surfaces it to you. Otherwise, you don't hear about it.

With Sazabi Security, the agent also gains access to security tools teams already rely on, through new MCP connectors for Wiz, VirusTotal, GitGuardian, Google Security Operations, Socket, Semgrep, and more. The agent can check IP addresses against VirusTotal, look up a cloud resource in Wiz, or check whether GitGuardian has already flagged a leaked key. Every project gets the cve.now and Have I Been Pwned MCPs enabled by default.

4. Security Issues

In the worst case, Sazabi opens a security issue explaining what happened, which accounts, keys, and services were compromised, and what you should do next, such as terminating sessions or rotating keys. Any secrets included in security issues are masked by default.

Security issues arrive in real time, and you can route them to a private Slack channel or a separate on-call rotation instead of a channel your whole company can read.

5. Vulnerability Checks, Powered by cve.now

More than 20,000 CVEs were published in October, a monthly record. Most of them don't affect you, but a few do, and it's hard to know which ones. That's why we built cve.now.

Sazabi Security brings a deeper integration with cve.now. Before, Sazabi used cve.now only to check your dependencies against newly published vulnerabilities. Now it also checks your production logs. When a serious vulnerability affects a package or runtime version you use, Sazabi asks:

• Is that version actually running?
• Is the vulnerable endpoint receiving traffic?
• Is anyone trying to exploit it?

If the investigation turns up something important, Sazabi raises a security issue so your team can take action.

For Startups and Security Teams

We built Sazabi Security for two types of teams.

Startups. Most startups don't have a security team, so security falls on the CTO or whichever engineer happens to be on call. With AI agents, attacks now reach companies of every size, so being small is no longer protection. With Sazabi, startup teams get turnkey security monitoring with no learning curve or overhead. If you already send us your logs, Sazabi is already watching them for attack payloads, leaked secrets, and personal data.

Security teams. Most already run a SIEM, which finds threats based on handwritten rules and places the burden of alert triage on human operators. SIEMs also miss application logs, which are necessary for detecting attacks and understanding their impact. Sazabi Security runs alongside your SIEM, so there's nothing to replace, and it detects security issues automatically across both application and security logs. Alerts arrive pre-investigated and can be routed to Slack, PagerDuty, incident.io, Rootly, Jira, Linear, or a webhook.

For both, the same guarantees apply. Your data is never used to train models, stays in the US or EU region you choose, and can stay in your own cloud with Sazabi BYOC. Sazabi is SOC 2 Type II and ISO 27001 certified.

What We've Already Caught

We enabled Sazabi Security for a limited set of customers weeks ago, and it has already caught some notable security issues (anonymized):

• A botnet attack that got past the firewall. One customer was hit by a low-volume, distributed attack routed through the Tor network. It stayed under the thresholds of the customer's firewall and existing alerts. Sazabi flagged it as it happened and identified it as a botnet, and the team blocked it before any of their users were affected.
• SQL injection against an internal tool. Another customer was self-hosting an open-source tool for internal use. Attackers probed the tool, attempting to exploit a CVE. Using cve.now, Sazabi matched the traffic to two published vulnerabilities in the customer's exact version, and provided the version to upgrade to and a rule to block the traffic.
• Live user session tokens in the logs. A third customer was logging more than 700 user session tokens every half hour because redaction wasn't implemented properly. Anyone with access to the logs could have taken over those sessions. Sazabi detected it, surfaced it, and helped the team remediate it.

Notably, none of these issues produced an error log line that would have caught anyone's attention. Sazabi detected them only through Sazabi Security signals.

Pricing and How to Get Started

Sazabi Security is available today and enabled by default for all Sazabi customers. There's nothing separate to buy. Security logs and issues count toward your plan like any others, and you can reject an incorrect finding within 24 hours so it isn't billed.

If you already send your logs to Sazabi, it's already watching them. Sazabi can only see what's in the logs you send, so to get the most out of it:

1. Connect your identity provider and cloud audit logs, such as Okta and CloudTrail.
2. Connect your edge logs, such as AWS WAF.
3. Choose where security issues go.

If you're new to Sazabi, sign up at www.sazabi.com. Setup takes less than ten minutes.

We're excited to help you see what's happening in production, including the things attackers would rather you didn't!

Sherwood Callaway
CEO & Founder
sherwood@sazabi.ai