Bullhost · bullhost.techCybersecurity Services Provider (MSSP)

From 45 minutes to under 10 seconds

Bull-Eye: custom-built platform for Bullhost. Combines AI and SOAR on sovereign European infrastructure, reduces MTTD from 45 minutes to under 10 seconds, and is owned and operated by Bullhost.

  • AI
  • SOAR
  • SOC
  • EU Sovereignty
Live·Real-time detection

Mean time to detect drops from 45 minutes to under 10 seconds with Bull-Eye.

The bottleneck

Before Bull-Eye, the SOC team spent hours on manual, repetitive work. Mean time to detect hovered around 45 minutes and clients had no real-time visibility into their security.

Mean time to detect

~45 min

Every minute in this queue is a minute without response.

Manual work queue

  1. Manual threat analysis

    +6 min

  2. Manual notification drafting

    +10 min

  3. Manual report generation

    +14 min

  4. No real-time visibility for clients

    +18 min

  5. Detection confirmed, ~45 minutes later.

The platform

The Bull-Eye platform

Software engineering and a bespoke AI layer joined in a single stream: signal enters on the left and leaves as automated response and live portals on the right.

Signal flow, left to right

Ingest

Signal & telemetry

SOC alerts and telemetry stream into the platform continuously.

AI layer

AI triage

Fine-tuned Ollama models analyse and contextualise each threat, draft alert notifications and generate per-service reports — on sovereign European infrastructure.

Automation

SOAR response

Orchestration playbooks automate response and cut MTTR on par with MTTD.

Output

Real-time portals

Client portal with live security status and internal SOC portal with incident management and KPIs.

How Bull-Eye was built

A phased build, from the correlation and automation engine to the live client portal.

  1. Phase 1 — Bull-Eye design

    Project kick-off in 2024: platform architecture, Ollama model selection and design of the sovereign deployment on European infrastructure.

    2024

  2. Phase 2 — Development and AI

    Platform build, model fine-tuning and automation of threat analysis, AI-contextualised alert notification and per-service report generation.

    Ongoing

  3. Phase 3 — SOAR and portals

    SOAR orchestration to cut response times, real-time client portal (portal.bullhost.tech) and internal SOC portal with incident management and KPIs.

    Ongoing

  4. Phase 4 — Operation and maintenance

    The platform runs 24/7 with live KPIs. Bullhost maintains operations and manages improvements and evolution of the AI models according to its own roadmap.

    In production

Measured results

Measured

Figures confirmed by the client, not projections.

MTTD
before45min
now<10s
A category change

radical reduction of mean time to detect

SOARAutomated

MTTR equivalently reduced thanks to orchestration

And not just faster

100% EU

fine-tuned Ollama models on sovereign European infrastructure

Real time

portal with live security status for every client

How we measured these results

Methodology

We haven't commissioned an external audit of these figures. Instead, for every metric published above: the starting point (baseline) and how the final figure was obtained.

MTTD45min → <10s
Baseline: 45 minutes, Bullhost's SOC average MTTD operating manually, logged by the team itself before the deployment. Measurement: automated detection time recorded in production by the Bull-Eye platform after deploying the AI models.
SOARAutomated
Baseline: manual response to each alert, with no automated orchestration, prior to the deployment. Measurement: qualitative — active SOAR playbooks executing the response with no manual intervention on already-detected alerts, with MTTR reduced under the same measurement criterion as MTTD.
infrastructure100% EU
This isn't a before/after improvement but an architecture decision in place since the project's design: Bull-Eye's fine-tuned Ollama models run on European infrastructure, verifiable from the declared deployment location.
client visibilityReal time
Baseline: no portal; clients received reports on request or manually before Bull-Eye. Measurement: the portal's availability and operation in production (portal.bullhost.tech), verifiable by accessing it directly.

Where the data lives

100% European infrastructure

Bull-Eye's AI models run on sovereign European infrastructure. Client data never leaves the EU.

EU region

See it for yourself

The product is live. Go and look.

Not a recorded demo or a mockup: it is the real surface where every client sees, in real time, the status of their services and their security posture.

What the portal exposes

  • Real-time service status
  • Live visibility of security posture
  • AI-contextualised alert notifications
  • Per-service reports

The same portal doubles as an operational tool for Bullhost's own teams.

Open the live portal

portal.bullhost.tech

portal.bullhost.tech
System statusBull-Eye client portal
Live
  • Perimeter monitoringOperational
  • Endpoint telemetryOperational
  • Threat intelligenceOperational
  • SOAR playbooksOperational
  • AI-contextualised alertSummary and next step drafted automatically

Illustrative rendering by Hodeitek — not real client data.

In their words

“Going from 45 minutes to under 10 seconds in MTTD is not an optimisation — it is a category change. Bull-Eye lets us operate with a fraction of the manual workload and gives our clients something almost nobody offers: real-time visibility on 100% European infrastructure.”

Iñaki Aldama, CEO · Bullhost
Iñaki AldamaCEO · Bullhost
Bullhost

Services and solutions used

Let's talk about your SOC

Want a platform like this for your SOC?

We build AI- and SOAR-driven detection and response platforms on sovereign EU infrastructure: proprietary correlation, automated response and a live portal for your clients. Let's talk about how to take your SOC there.

Talk to the team

Related resources

Go deeper
Case study
GeneralSOC / Red Team
Cybersecurity Services Provider (MSSP) · Leioa, Bizkaia

Strategic SOC consultancy since late 2023: from services not yet formalised into a catalogue to a proceduralised MSSP, with workflow automation, a catalogue structured into Blue, Purple and Red teams and a European data-sovereignty focus.

Strategic SOC consultancy since late 2023: from services not yet formalised into a catalogue to a proceduralised MSSP, with workflow automation, a catalogue structured into Blue, Purple and Red teams and a European data-sovereignty focus.

Cybersecurity Services Provider (MSSP) · Leioa, BizkaiaEstablished MSSP, Basque Country
SOCMSSPConsultancy
Read more
Go deeper
Article
AdvancedSOC / Red Team
IA

How AI Is Transforming Threat Detection in the SOC

AI does not replace the SOC analyst: it cuts noise, accelerates threat hunting, and demands governance under the AI Act and the ENS.

13 min2026-02-28
AI & SecuritySOCthreat detection
Read more
Go deeper
Case study
GeneralSOC / Red Team
Branding & digital marketing agency · Basque Country

End-to-end securing of AZK Taldea, a branding and digital marketing agency: from an environment with no EDR, no firewall and no security culture to enterprise-grade defence across three layers —technical, human and the chain of their clients' websites—, with the SPRI cybersecurity grant managed by Hodeitek.

End-to-end securing of AZK Taldea, a branding and digital marketing agency: from an environment with no EDR, no firewall and no security culture to enterprise-grade defence across three layers —technical, human and the chain of their clients' websites—, with the SPRI cybersecurity grant managed by Hodeitek.

Branding & digital marketing agency · Basque CountryAgency · 20+ people
EDR/MDRPalo AltoBitdefender
Read more