Sweet Security

Their team's background is clear immediately... they have that Palo Alto, Aqua, Wiz-level expertise, and it shows in how quickly the product has evolved since we joined early. Two things stick out: the EDR-like telemetry lets us convert raw behavioral data into a working detection rule with just a couple of clicks, and there's no separate workflow for writing rules unless you want one. And their AI incident triage is among the best I've used—it doesn't just flag alerts and leave you guessing, it explains the context in clear language. If someone isn't well-versed in cloud attack tactics, they aren't left trying to figure out what a technique means or why it's relevant; the triage walks them through it. That's crucial when you want your whole team, not just the most experienced person, moving quickly on the right priorities. What really convinced me was seeing their SweetAttack red teaming live. When it discovers an RCE, it patches the vulnerability without disrupting the app, then adds a network block to prevent reuse. And if a crypto miner slipped in during that window, it kills the process automatically—no manual cleanup or waiting for someone to notice CPU spikes. It's a work of art. It doesn't consume noticeable resources. At all. Any security professional will tell you how great it is to not have the infrastructure team blaming their tools for performance problems. I'm glad it's invisible in that way. That's something they should be proud of, because many vendors can't say the same. I've also been doing my own AI red teaming on the side with different agent setups—single-agent tool loops, orchestrator-worker models, layered subagent delegation, peer-to-peer agent swarms, you name it, I've tried it. So I have a real basis for comparison, and I can say with confidence: many tools in this space show a plausible attack path. Sweet actually executes the exploit and proves it's real. That's a fundamentally different approach from Wiz/Upwind style tools that mostly show static theoretical paths. The UI is easy to navigate, not a maze where you get lost looking for something. It's user-friendly and even has dark mode. On integrations, we've had it working with our GreyMatter/ReliaQuest pipeline and Azure environment in parallel, covering both cloud and on-prem, so it's not just a point tool that only talks to itself. Support has been excellent—they're quick to jump on a call, walk through troubleshooting patiently, and they bring their technical lead into demos when questions get detailed instead of leaving you with someone who says they'll get back to you. It's done right the first time. There are still a few rough edges you'd expect from a fast-growing company; some integration docs needed extra clarification with support, and one lower-severity alert type could use better default tuning to keep triage time low before customization. But they took that feedback and fixed it. I'm mentioning it for transparency. My one bigger wish is that the offering felt more unified rather than split into separate modules/add-ons, but once I thought about it, it makes sense given how they likely meter token usage for the AI components. If you're pricing based on tokens, breaking it out is the logical approach. We're using it for cloud and runtime detection and response across our environment, and it's catching real things, not just noise. It flags credential access attempts on domain controllers, anomalous IMDS connections, and directory traversal attempts in near real time with enough context that my team doesn't have to pause to figure out what an alert means. Before this, we were using a patchwork of tools that each saw a slice of the picture and didn't communicate well with each other. The API logging is a great feature, especially when documentation is lacking or Swagger files are outdated. Real-time vulnerability context is probably the most important piece for prioritizing fixes. This can get out of hand quickly, but just because a library is present doesn't mean it's vulnerable, especially if it's not even being called. Sweet can take a vulnerability rated 9 and tell us it's actually more like a 3 or 4, so we're not wasting time on meaningless work. It directly impacts our real-time risk and exposure. The non-human identities are all in one neat place instead of scattered across 15 dashboards. Together, the behavior-to-detection workflow and AI triage mean my team and I spend less time drowning in alerts and more time responding to what matters. Because we got in early, we've had a say in what they're building, which is rare for a vendor this size to actually act on instead of just nodding along.

The main reason I'd endorse Sweet is their support crew. They really pay attention to what we say and are dedicated to delivering a solution that matches our requirements. Their feature additions are also advancing at an impressive pace. The AI-based scoring that prioritizes issues has cut down our false positives dramatically. Their toolkit slots right into our stack, and the protection it gives us across our whole infrastructure gives us confidence. The mapping of connection paths between systems is also useful for seeing how everything links together. The interface is intuitive, and they even offer dark mode, which should be standard but isn't. Since they're a newer company, their feature set might be smaller than others, but that's not necessarily a downside because they can build in the direction their clients want, and that's exactly what we're experiencing. We were missing visibility into identity security and excessive permissions, and had almost no insight into non-human identities. Now we have a much better picture of our actual risks. Their new AI insights also let us spot risks and misconfigurations in our agents, see what's talking to them, and confirm they're set up correctly.