Key facts
| API compatibility | OpenAI-compatible /v1/chat/completions; drop-in base URL change |
| Models | 30+ models behind one API; open-weight options for private deployment |
| Typical patterns | Alert summaries, detection drafts, CTI digests, phishing triage |
| Integration path | Connects to SIEM, SOAR and ticketing platforms through controlled middleware |
| Pricing model | Flat monthly self-serve plans with unlimited fair-use usage; no per-token billing — see the live pricing page |
| Free tier | plugsky-micro and plugsky-lite on the free plan, no card required |
| Deployment | Plugsky cloud, your VPC, on-prem and air-gapped options |
| Live endpoints | Chat, streaming, JSON mode, function calling, embeddings, RAG and agents |
TL;DR
- Summarise and draft; keep response actions human-approved.
- Assume prompt injection and sandbox all tools and scopes.
- Use per-workflow keys so compromise stays contained.
- Verify summaries against source telemetry before acting.
- Start free with plugsky-micro and plugsky-lite, no card required.
How it works, step by step
- Pick a read-only workflow such as alert summarisation or phishing triage.
- Define what the model may see and what it may never do.
- Add prompt-injection and data-exfiltration cases to your evaluation set.
- Build against the OpenAI-compatible endpoint with per-workflow keys.
- Deploy private or region-locked if telemetry is sensitive.
- Measure analyst time and triage quality, then expand to drafting workflows.
Try it yourself
Open the AI API key security checklist →
Where an AI API fits in cybersecurity
Security operations are drowning in text, which makes them a strong fit for summarisation and drafting — provided the model is never trusted as an autonomous responder:
- Alert summarisation: condense raw alerts and telemetry into a timeline an analyst can verify quickly.
- Detection rule drafts: translate an analyst's intent into a Sigma or query draft for testing in a lab.
- Threat intelligence digests: summarise reports and advisories into indicators and actions for triage.
- Phishing report triage: extract headers, URLs and intent from user-reported messages into a queue.
- Playbook drafting: turn incident retrospectives into structured response steps for review.
Security, privacy and data handling
The model reads hostile text, so the security model must assume the input is trying to manipulate it:
- Never grant the model direct execution or write access; propose actions for humans or orchestration to run.
- Sanitise and delimit untrusted content, and test for prompt-injection resistance in your evals.
- Keep scopes minimal per key so a compromised workflow cannot query unrelated telemetry.
- Deploy private or region-locked when telemetry and incident data are sensitive.
Deployment options and model choice
Telemetry usually stays inside your environment, so treat VPC, on-prem or region-locked deployment as the default for SOC workflows. Plugsky exposes the same OpenAI-compatible endpoint whether the workload runs in shared cloud, your VPC, on-prem or air-gapped, and region-locked planes keep processing where your policy requires. Teams route to 30+ models through one API, with open-weight options when a site has no external connectivity, and port code with a base URL change. Chat, streaming, JSON mode, function calling, embeddings, RAG and agents are live; audio, images, moderation, files, batch, fine-tuning, assistants and the responses API are coming soon. plugsky-micro and plugsky-lite are free with no card, a 14-day full-access trial covers paid tiers, and the live pricing page lists current plans.
From pilot to production
Security teams are the harshest reviewers of their own tooling, and rightly so. Common failures:
- Giving the model tool access that can change systems without human approval.
- Treating summaries as evidence without verifying the underlying logs.
- Feeding attacker-controlled text into an agent with broad scopes.
- Skipping injection tests because the use case 'is only summarisation'.
- Leaving one shared key across SOC, IR and vulnerability workflows.
Start with summarisation and drafting where a human already reviews the output, add injection tests to your evaluation set, and keep every model action advisory. Measure analyst time and false-positive triage load before expanding scope.
Honest comparison
| Capability | Plugsky | Typical per-token API | Building in-house |
|---|---|---|---|
| API compatibility | OpenAI-compatible chat, embeddings and tools | Usually compatible | Full rewrite |
| Deployment | Cloud, VPC, on-prem and air-gapped | Mostly cloud-only | You operate GPUs and serving |
| Data residency | Region selection and sovereign options | Limited regions | You control fully |
| Pricing | Flat monthly self-serve, fair-use usage | Per-token, harder to forecast | GPU plus operations cost |
| Model choice | 30+ models behind one API | Varies by provider | You host every model |
| Industry fit | Alert summaries, detection drafts, CTI digests, phishing triage | Generic API, you adapt it | You build every workflow |
Frequently asked questions
Can we keep our existing OpenAI SDK code?
Yes. Plugsky exposes an OpenAI-compatible API, so you change the base URL and model name and keep your integration and prompts.
Is there a free plan?
Yes. The free plan includes two free models, plugsky-micro and plugsky-lite, and does not require a credit card.
Can the model take response actions automatically?
Do not give it that authority. Use the API for summarisation, drafting and proposals, and keep execution behind human approval or your orchestration layer.
How do we defend against prompt injection?
Treat all telemetry as untrusted, sandbox tools, minimise scopes, delimit content, and include injection attempts in your evaluation set before production.
How does pricing work?
Self-serve plans are flat monthly with unlimited fair-use usage; enterprise agreements cover private deployment and residency. See the live pricing page for current plans.
Which endpoints are live today?
Chat completions, streaming, JSON mode, function calling, embeddings, RAG and agents are live. Audio, images, moderation, files, batch, fine-tuning, assistants and the responses API are coming soon.
Can we deploy privately?
Yes. Plugsky supports a private endpoint in your VPC, on-prem and air-gapped deployment for enterprise setups, with audit export to your SIEM.