A tireless junior analyst that shows its work.

For leaders and non-technical readers. No jargon.

The problem

A security team (a "SOC" — Security Operations Center) gets a flood of computer alarms every day — often thousands. Most are false alarms, but a few are real attacks. There are never enough trained people to check them all, so many alarms go unread — and the real threat can hide in the pile. Checking them is slow, repetitive, and exhausting, and good analysts burn out and leave.

What blue-kakapo is

Think of it as a careful junior analyst that never sleeps. For each alarm it gathers the facts, explains what it found in writing with its sources, and gives a clear verdict: "this is harmless, I closed it," or "this looks dangerous — a human should look." It does the boring first pass so your experts spend their time on what actually matters.

It's named after the kākāpō — a rare, nocturnal, remarkably clever New Zealand parrot. Watchful at night, resilient, and one of a kind. That's the idea: a vigilant night-shift guardian for your "blue team" (the defenders).

Why it's different (and safer)

• It shows its work. Every decision keeps a tamper-proof record you can replay — no "the computer said so."
• It asks before doing anything risky. It can recommend shutting a compromised laptop off the network, but a person approves it. It will never automatically disable your most critical systems.
• Your data stays with you. It runs on your own computers — even with no internet — and never phones home.
• It's honest about mistakes. It comes with a built-in "report card" that measures how often it could miss a real threat, so you can judge it instead of trusting a sales number.

How you'd get it

It's free and open-source. A security engineer can start it on a laptop in about a minute, connect it to your existing tools, or run it across the company on your own servers. There's nothing to buy and no per-use meter.

For leaders — talking points

• Lower risk, faster. Faster first-pass triage means threats are caught sooner — and regulators (DORA, NIS2, GDPR, SEC) start their reporting clocks the moment you're aware.
• Do more with the team you have. Automate the repetitive first pass; keep experts on real incidents; reduce burnout and turnover.
• No lock-in, no data exodus. Open-source and self-hosted — critical for regulated, sovereign, or air-gapped environments.
• Trust you can audit. Every action is logged and replayable; risky steps need human sign-off.

What it does not do

It isn't magic and it can still be wrong — which is exactly why a person stays in the loop on anything serious. It doesn't replace your detection tools; it helps make sense of what they report. See the honest, detailed "what it can & cannot do".