Configuration Is Attack Surface
Every configuration option is a potential misconfiguration. Every YAML key that can be set wrong is a security hole waiting to happen. The more knobs your security tool has, the more ways it can be deployed in a broken state.
A security tool can start successfully while still lacking the events, permissions or response policies needed to protect a particular application. Check those prerequisites during deployment instead of treating a successful startup as proof of coverage.
What Production-Ready Defaults Look Like
Running 1sec up starts the engine and its enabled modules with default settings. Useful detection still depends on supported collectors or application events reaching those modules. Tune thresholds against representative traffic and verify both suspicious and legitimate cases before relying on alerts.
Automatic response is a separate deployment decision. Enable suitable enforcement policies, confirm the chosen actions are supported on your platform, and grant only the permissions they need. An alert from a completed request does not retroactively block it. We do not claim a measured false-positive rate or universal out-of-the-box application protection.
Configurable When You Need It
Use the YAML configuration to select your telemetry and response settings. Your application can also send canonical events using an engine API key; no website login is required. Follow the integration guide, then test the expected alerts and response actions in your own environment.
Less Configuration, More Security
The most secure system is the one that works correctly with the least amount of human intervention. Every manual configuration step is an opportunity for human error. Every environment variable that needs to be set is a variable that might not be set in production.
1-SEC embeds its event bus and provides defaults to reduce setup work. The operator still owns integration, key handling and response validation. For pre-execution blocking, connect the application or tool runner to an enforcement gate before it performs the operation. See response requirements and limits.