Clone Systems Adds Private AI to Its 24/7 Managed SOC + SIEM, Keeping Customer Logs Out of Public AI Models

The rebuilt managed detection and response (MDR) service includes the SIEM, round-the-clock analysts in the US and EU, US or EU data hosting, and per-endpoint pricing with no log-ingestion fees, from a PCI Approved Scanning Vendor since 2007.

Clone Systems, Inc., a managed security and compliance provider and a PCI Security Standards Council Approved Scanning Vendor (ASV) since 2007, announced its rebuilt Managed SOC + SIEM, a 24/7 managed detection and response (MDR) service that now runs on Clone Systems’ own private, self-hosted AI. The SIEM is included in the service rather than sold on top, and customer logs are never sent to an outside AI provider or used to train public models.

24/7 Managed SOC + SIEM with private, self-hosted AI: SIEM included, US and EU analysts, no log-ingestion fees.

Security leaders are under pressure from auditors, cyber insurers and boards to prove continuous monitoring. PCI DSS v4.0.1 has required automated review of audit logs since March 31, 2025 under Requirement 10, and many organizations told to “get MDR” discover that the SIEM, log ingestion and AI features are priced separately, or that AI-assisted triage means sending sensitive logs to a third-party model. Clone Systems built its service to remove both problems.

The rebuilt Managed SOC + SIEM includes:

• 24/7 monitoring and response. Clone Systems analysts in the United States and the EU monitor, investigate and respond around the clock, with sub-minute response to critical alerts. Detection rules run every minute.
• The SIEM, included. Logs from endpoints, servers, firewalls, cloud and SaaS are collected and correlated in one console, with more than 100 integrations including CrowdStrike, SentinelOne, Microsoft 365, Okta, AWS, Microsoft Azure, Google Cloud, Proofpoint and Mimecast.
• Private AI Alert Triage. The Clone Systems AI Assistant investigates alerts and drafts response steps inside Clone Systems’ own infrastructure. An analyst approves every action.
• Containment, not just alerts. Integrated endpoint detection and response (EDR) and managed intrusion prevention let analysts contain threats at the endpoint.
• Data residency by design. Each customer gets a dedicated instance, hosted in Clone Systems data centers in Philadelphia, Athens or Limassol, or deployed in the customer’s own environment so logs never leave it.
• Audit-ready reporting. Twelve standard reports, including a monthly executive report and a compliance evidence pack, with alerts mapped to PCI DSS, HIPAA, GDPR, NIST 800-53 and SOC 2, and 12-month log retention for PCI DSS.

Also Read: CIO Influence Interview with John Elliott, Cybersecurity Author Fellow at Pluralsight

“Every security leader we talk to wants AI working their alerts, and very few want their logs leaving the building to do it,” said Jorja Mandy, Director of Strategic Development at Clone Systems. “We built our AI ourselves and run it in our own data centers, next to the analysts who use it. Customers get faster investigations without handing their most sensitive data to a third party, and because the SIEM is included, the price they are quoted does not climb as their log volume grows.”

Managed SOC + SIEM is priced per endpoint with a 50-endpoint minimum. The SIEM, the AI and 24/7 analyst coverage are included, with no log-ingestion fees. Onboarding, from first call to full coverage, takes a few weeks.

“If your auditor, insurer or board has told you to buy MDR, this is that service,” said Elyse Hamilton, Vice President of Business Development at Clone Systems. “Buyers should not have to piece together a SIEM license, an ingestion plan and a monitoring contract to meet one requirement. We give them one service, one console and one team, from a company that has been helping organizations meet PCI DSS requirements since 2007.”

The same company provides PCI ASV scanning, vulnerability scanning and penetration testing, each sold separately, so organizations can cover logging (PCI DSS Requirement 10), scanning (11.3) and penetration testing (11.4) with one provider. For buyers comparing options, Clone Systems explains how SIEM, SOC, EDR, MDR and XDR differ.