GREYCORTEX Mendel 5.0 Released: Risk Score and AI Assistant

GREYCORTEX Mendel 5.0 gives SOC analysts a single Risk Score per device, a host-centric Traffic Flow Map, and an AI Assistant that translates network events into plain language.

Security teams operating modern OT and IT networks face a growing signal-to-noise problem. Analysts see thousands of alerts every day but rarely know which host to investigate first, and even less often can they explain to management why a given event actually matters. GREYCORTEX Mendel 5.0 addresses this by shifting the investigation model from event-centric to host-centric, so every device carries a single, trended risk indicator and an explanation that non-specialists can read.

What was announced

GREYCORTEX has released Mendel 5.0, a major update of its Network Detection and Response (NDR) platform. In the new version, every device on the network carries a single Risk Score that is calculated from its behavior over time. Analysts start their day with a prioritized list of hosts rather than an unranked feed of alerts.

The release also introduces the Traffic Flow Map, which visualizes a selected device together with its most significant network connections in one view, and an AI Assistant that describes devices, IP addresses, and security events in plain language, including whether an event is a real threat and what to do next.

Why this matters

For CIOs, CISOs, IT directors, and procurement leaders, Mendel 5.0 targets three long-standing pain points: alert fatigue in the SOC, slow triage of unknown devices, and the communication gap between analysts and business stakeholders. A per-host Risk Score with history and trend visualization makes it easier to justify investigations, prove improvement over time, and demonstrate measurable value from the NDR investment.

The AI Assistant lowers the seniority required to perform first-line triage, which is critical in a market where experienced analysts are scarce and expensive. Inactive and lost host detection also helps asset owners keep the CMDB accurate and identify shadow devices that quietly disappear from the network.

Technical details

• New Risk Score: per-device score with history and trend visualization
• Traffic Flow Map: host-centric investigation view of a device and its key connections
• AI Assistant: plain-language explanations of devices, IP addresses, and security events, including verdict and next steps
• Redesigned Host Dialog: updated interface for host-level analysis
• Tag history with time reference: full timeline of how tags evolved on each entity
• Inactive and lost host detection: automatic flagging of devices that stop appearing on the network

Softprom and Greycortex

Softprom is the official distributor of Greycortex. Our team supports customers and partners with licensing, technical enablement, proof of concept, and implementation projects for the Mendel NDR platform.

This content was prepared as part of the Softprom DistriFlow project — an automated system for monitoring and adapting vendor news. Original source: original article.