For the Security Analyst · SOC
Bolt is the AI SuperAgent for work. Every indicator that lands in your queue (a URL, an IP, a hash, a token) is one keystroke from safe, identified, and ready to ticket. No CyberChef tab. No defang website. No paste into a model you don’t trust.
On this page
An alert fires. You paste the indicator. Bolt already knows what it is (hash, CVE, IP, JWT), defangs it, decodes it, identifies it on-device, and the background watches you set up are already running. One keystroke instead of six tabs.
The shift
Triage today
With Bolt
Make an indicator safe to paste
Drop a live malicious URL or IP and Bolt hands you the defanged form (no auto-clicking, no accidental detonation), ready to paste into the incident ticket or the email to the team. Need it back? =refang reverses it.
Name a digest on sight
A bare hex blob in a log line is named on sight (Bolt recognizes it as MD5, SHA-1, SHA-256 or SHA-512 by length, no sigil needed), and the “Read as” switcher lets you flip a 32-hex value between MD5 and a compact UUID when you’re not sure which it is. Need it explicit? =hashid spells out the candidate types.
Decode a token without trusting a website
Paste a JSON Web Token from a captured request (no sigil, Bolt recognizes the shape), and it decodes the header and claims right in front of you, so you can read the alg and subject without pasting a credential into jwt.io or any other site.
Deobfuscate a payload on sight
A base64 or hex blob from a phishing lure or a script is recognized on sight (no sigil) and decodes in place, revealing the URL or command hiding inside. Chain it: decode, then =defang the result before it goes in the ticket. No CyberChef round-trip.
Recognize a vulnerability ID
A CVE id in an alert or a vendor email is recognized instantly as a vulnerability reference (typed bare, no sigil), and Tab opens the advisory page, so you stop copying it into a search bar just to find out what it is.
Read network indicators on sight
Every network shape that lands in your queue (an IPv4 or IPv6, a CIDR range, an ASN, a MAC address) is recognized and classified on sight, typed bare with no sigil. Private vs public, how many hosts a block covers, whose AS it is. The cheat sheet you used to keep is built in.
Catch a leaked secret
Run =secret over a blob from a leaked config or a pastebin and Bolt names the secret it contains (Stripe key, AWS key, token) and flags it sensitive so you can hand off a masked, shareable version instead of the live credential. =pem inspects a leaked certificate or key the same way.
Background coverage, for free
Set a watch once with the `:` sigil and a native checker runs it in the background: TLS cert expiry (:cert), CISA KEV additions (:kev), new certificates in the transparency log (:crt), breach exposure (:hibp), domain expiry (:domain), file changes (:file). They surface in Bolt when something moves, so the slow-burn signals stop slipping through.
Ask, with receipts
When you do need to reach out, =ask runs a real web search and gives you a short answer with numbered [1][2] citations you can open, so you can sanity-check a claim or get context on a fresh threat without leaving Bolt, and without taking the answer on faith.
What changes on your shift
Why this is safe to live in
Defang, decode, hash-ID and secret detection run locally, with zero network and zero tokens. The indicator you’re triaging never leaves your machine just to be understood. The watches (:cert:kev:crt:hibp) query their sources on your behalf, from your machine, never through Sparcle.
Governed AI
Use AI on real work without leaking the identifiers in it. Emails, card and account numbers, SSNs, phone numbers and keys are masked before anything reaches the model and restored in the reply, and when you point it at your own LLM, the rest stays inside your boundary too.
Triage, not exposure
Indicators, hostnames and user identifiers are masked before the model call, and the retrievals, tool calls and model calls land in a chain you can verify offline.
New: the governed browser
Most AI exposure happens in a browser tab. Bolt ships its own, so what a person types or pastes into a page is screened on the machine before it is allowed to leave it.
A normal browser
Bolt's browser
The ask
Bolt is free to roll out across the team: defang, decode, hash-ID, CVE recognition and the native watches all work on day one. Every IOC you escalate to AI is masked before it ever reaches a model.
Every other seat
Each role page makes the case in that role's own language, and links back here.
Bolt runs inside your perimeter, on the LLM you choose.