Bullhost · bullhost.techCybersecurity Services Provider (MSSP)

From 45 minutes to under 10 seconds

Bull-Eye: custom-built platform for Bullhost. Combines AI and SOAR on sovereign European infrastructure, reduces MTTD from 45 minutes to under 10 seconds, and is owned and operated by Bullhost.

Talk to the team Live portal

AI
SOAR
SOC
EU Sovereignty

Live·Real-time detection

The bottleneck

Before Bull-Eye, the SOC team spent hours on manual, repetitive work. Mean time to detect hovered around 45 minutes and clients had no real-time visibility into their security.

Mean time to detect

~45 min

Every minute in this queue is a minute without response.

Manual work queue

Manual threat analysis
+6 min
Manual notification drafting
+10 min
Manual report generation
+14 min
No real-time visibility for clients
+18 min
Detection confirmed, ~45 minutes later.

The platform

The Bull-Eye platform

Software engineering and a bespoke AI layer joined in a single stream: signal enters on the left and leaves as automated response and live portals on the right.

Signal flow, left to right

Ingest

Signal & telemetry

SOC alerts and telemetry stream into the platform continuously.

AI layer

AI triage

Fine-tuned Ollama models analyse and contextualise each threat, draft alert notifications and generate per-service reports — on sovereign European infrastructure.

Automation

SOAR response

Orchestration playbooks automate response and cut MTTR on par with MTTD.

Output

Real-time portals

Client portal with live security status and internal SOC portal with incident management and KPIs.

How Bull-Eye was built

A phased build, from the correlation and automation engine to the live client portal.

Phase 1 — Bull-Eye design
Project kick-off in 2024: platform architecture, Ollama model selection and design of the sovereign deployment on European infrastructure.
2024
Phase 2 — Development and AI
Platform build, model fine-tuning and automation of threat analysis, AI-contextualised alert notification and per-service report generation.
Ongoing
Phase 3 — SOAR and portals
SOAR orchestration to cut response times, real-time client portal (portal.bullhost.tech) and internal SOC portal with incident management and KPIs.
Ongoing
Phase 4 — Operation and maintenance
The platform runs 24/7 with live KPIs. Bullhost maintains operations and manages improvements and evolution of the AI models according to its own roadmap.
In production

Measured results

Measured

Figures confirmed by the client, not projections.

MTTD

before45min

now<10s

A category change

radical reduction of mean time to detect

SOARAutomated

MTTR equivalently reduced thanks to orchestration

And not just faster

100% EU

fine-tuned Ollama models on sovereign European infrastructure

Real time

portal with live security status for every client

How we measured these results

Methodology

We haven't commissioned an external audit of these figures. Instead, for every metric published above: the starting point (baseline) and how the final figure was obtained.

MTTD45min → <10s: Baseline: 45 minutes, Bullhost's SOC average MTTD operating manually, logged by the team itself before the deployment. Measurement: automated detection time recorded in production by the Bull-Eye platform after deploying the AI models.
SOARAutomated: Baseline: manual response to each alert, with no automated orchestration, prior to the deployment. Measurement: qualitative — active SOAR playbooks executing the response with no manual intervention on already-detected alerts, with MTTR reduced under the same measurement criterion as MTTD.
infrastructure100% EU: This isn't a before/after improvement but an architecture decision in place since the project's design: Bull-Eye's fine-tuned Ollama models run on European infrastructure, verifiable from the declared deployment location.
client visibilityReal time: Baseline: no portal; clients received reports on request or manually before Bull-Eye. Measurement: the portal's availability and operation in production (portal.bullhost.tech), verifiable by accessing it directly.

Where the data lives

100% European infrastructure

Bull-Eye's AI models run on sovereign European infrastructure. Client data never leaves the EU.

EU region

See it for yourself

The product is live. Go and look.

Not a recorded demo or a mockup: it is the real surface where every client sees, in real time, the status of their services and their security posture.

What the portal exposes

Real-time service status
Live visibility of security posture
AI-contextualised alert notifications
Per-service reports

The same portal doubles as an operational tool for Bullhost's own teams.

Open the live portal

portal.bullhost.tech

System statusBull-Eye client portal

Live

Perimeter monitoringOperational
Endpoint telemetryOperational
Threat intelligenceOperational
SOAR playbooksOperational
AI-contextualised alertSummary and next step drafted automatically

Illustrative rendering by Hodeitek — not real client data.

In their words

Iñaki Aldama, CEO · Bullhost — Iñaki AldamaCEO · Bullhost

Services and solutions used

Services

SOCaaS / MDR — Security Operations Center

Software & AI Development for Cybersecurity

Want a platform like this for your SOC?

We build AI- and SOAR-driven detection and response platforms on sovereign EU infrastructure: proprietary correlation, automated response and a live portal for your clients. Let's talk about how to take your SOC there.

Talk to the team

Go deeper

Case study

GeneralSOC / Red Team

Cybersecurity Services Provider (MSSP) · Leioa, Bizkaia

Strategic SOC consultancy since late 2023: from services not yet formalised into a catalogue to a proceduralised MSSP, with workflow automation, a catalogue structured into Blue, Purple and Red teams and a European data-sovereignty focus.

Strategic SOC consultancy since late 2023: from services not yet formalised into a catalogue to a proceduralised MSSP, with workflow automation, a catalogue structured into Blue, Purple and Red teams and a European data-sovereignty focus.

Apr 10, 2026Cybersecurity Services Provider (MSSP) · Leioa, BizkaiaEstablished MSSP, Basque Country

SOC MSSP Consultancy

Go deeper

Article

AdvancedSOC / Red Team

How AI Is Transforming Threat Detection in the SOC

AI does not replace the SOC analyst: it cuts noise, accelerates threat hunting, and demands governance under the AI Act and the ENS.

Feb 28, 202613 min2026-02-28

AI & Security SOC threat detection

Go deeper

Case study

GeneralSOC / Red Team

Branding & digital marketing agency · Basque Country

End-to-end securing of AZK Taldea, a branding and digital marketing agency: from an environment with no EDR, no firewall and no security culture to enterprise-grade defence across three layers —technical, human and the chain of their clients' websites—, with the SPRI cybersecurity grant managed by Hodeitek.

End-to-end securing of AZK Taldea, a branding and digital marketing agency: from an environment with no EDR, no firewall and no security culture to enterprise-grade defence across three layers —technical, human and the chain of their clients' websites—, with the SPRI cybersecurity grant managed by Hodeitek.

Mar 5, 2026Branding & digital marketing agency · Basque CountryAgency · 20+ people

EDR/MDR Palo Alto Bitdefender

In their words

Related resources

Go deeper

Case study

GeneralSOC / Red Team

Cybersecurity Services Provider (MSSP) · Leioa, Bizkaia

Strategic SOC consultancy since late 2023: from services not yet formalised into a catalogue to a proceduralised MSSP, with workflow automation, a catalogue structured into Blue, Purple and Red teams and a European data-sovereignty focus.

Apr 10, 2026Cybersecurity Services Provider (MSSP) · Leioa, BizkaiaEstablished MSSP, Basque Country

SOC MSSP Consultancy

Go deeper

Article

AdvancedSOC / Red Team

How AI Is Transforming Threat Detection in the SOC

AI does not replace the SOC analyst: it cuts noise, accelerates threat hunting, and demands governance under the AI Act and the ENS.

Feb 28, 202613 min2026-02-28

AI & Security SOC threat detection

Go deeper

Case study

GeneralSOC / Red Team

Branding & digital marketing agency · Basque Country

End-to-end securing of AZK Taldea, a branding and digital marketing agency: from an environment with no EDR, no firewall and no security culture to enterprise-grade defence across three layers —technical, human and the chain of their clients' websites—, with the SPRI cybersecurity grant managed by Hodeitek.

Mar 5, 2026Branding & digital marketing agency · Basque CountryAgency · 20+ people

EDR/MDR Palo Alto Bitdefender

From 45 minutes to under 10 seconds