Use case: Investigate CFC's proactive cyber threat alerts before analyst escalation
Match strength: Moderate | Evidence confidence: Medium
CFC runs a 200+ person in-house cyber and incident-response operation that handles 5,000+ events a year. Its threat analysts use intelligence, hunting, vulnerability scanning and claims data to identify potential threats and alert policyholders, while its responders triage incidents around the clock. CFC Response
Qevlar can receive incidents through an API, investigate and enrich them, then return a documented result to an existing SIEM, SOAR or ticketing workflow. Qevlar FAQ That gives CFC a credible way to test whether a selected stream of its own proactive alerts can be investigated consistently before an analyst decides whether to contact a policyholder or escalate the case.
Make the introduction to CFC's Managing Director, Proactive and Global Cyber Security Services and Global Head of Cyber Incident Response. Start with a small, CFC-controlled pilot on a consented alert stream. The first question is whether CFC can supply enough permitted evidence for Qevlar to reach useful conclusions without accessing a policyholder's internal network.
Why we think this
CFC has the relevant work today. It says its cyber threat analysts work continuously to find potential threats, and its incident responders triage, contain and repair after incidents. Its Response app also produces real-time threat alerts from external scanning, dark-web monitoring and related sources. CFC Response Response App FAQs That is a real service-delivery workflow where better investigation can improve analyst focus and the quality of customer-facing guidance.
Qevlar is designed to take an incoming security incident through triage, enrichment and investigation, with analysts retaining the final decision and response. It supports pushed incidents and integrations across SIEM, EDR/XDR, threat intelligence, SOAR and ticketing. Qevlar FAQ Qevlar integrations It would complement CFC's existing scanning, intelligence, response and claims processes by supplying an investigation result; it would not replace them.
The limit is CFC's data boundary. Its published proactive services focus on external, internet-facing assets, and CFC says the app does not access customer internal networks or data unless provided. Response App FAQs Qevlar usually builds context from the sources a customer connects, including security telemetry and threat intelligence. The pilot should therefore prove that a defined CFC alert type carries enough authorized context, can be handled separately for each policyholder, and improves on CFC's current analyst review before either company considers a wider rollout.
Original supplied ICP
Large enterprises (1000+ employees) with SOC operations, meaning SOC analysts in headcount, or MSSPs, looking to automate secure alert investigation via agentic AI.
Target buyers supplied: CISO, VP Security Operations, Security Operations Managers; for MSSPs, Head of Product, CPO, or CEO.
Supplied validation status: ✓. Supplied customers: Mercedes-Benz, Sodexo, Orange Cyberdefense, ECI, Atos. These are supplied metadata, not independently verified input.
Sources
- CFC Response: current page accessed 12 September 2026; CFC's reported team, event volume, proactive threat-analysis and incident-triage work.
- CFC Response App FAQs: current page accessed 12 September 2026; the external-scanning and customer-data boundaries relevant to a pilot.
- CFC 2025 modern slavery statement: signed 21 May 2026; CFC Group reports over 1,000 global employees, including contractors.
- Qevlar FAQ: current supplier page accessed 12 September 2026; described alert investigation, incident push/pull and controlled data access.
- Qevlar integrations: current supplier page accessed 12 September 2026; published integration categories and products.