The team at Sweet is the biggest reason I’d recommend working with them. They’re very receptive to feedback and genuinely want to make sure you have a tool that fits your needs. The speed at which they’re expanding their suite of tools is also impressive. The AI-powered issue ranking feature that adjusts scores has saved us from dealing with a lot of false positives. The toolset integrates easily with our environments, and we feel protected by the coverage it provides across our infrastructure. The connection path tracking between systems is also great for a clean overview of how everything ties together. The site is easy to use, and while it feels like something every tool should offer, they also have dark mode.

The team's pedigree shows immediately... Palo Alto / Aqua / Wiz caliber DNA and it comes through in how fast the product has matured since we got in early. Two things stand out most: the EDR like telemetry lets us take raw behavioral data and turn it into an actual detection rule in a couple of clicks, no separate workflow for writing rules bolted on but it's there if that's your thing. And their AI driven incident triage is some of the best I've used... it doesn't just flag an alert and leave you to figure out what it means, it explains the context behind it in plain terms. If someone on the team isn't deep in cloud attack TTPs, they're not left guessing what a given technique actually is or why it matters, the triage walks you through it. That matters a lot when you're trying to get a whole team, not just your most senior person, moving fast on the right things. What really sold me was watching their SweetAttack red teaming live in a demo. If it finds an RCE, it patches the exploit in place without breaking the underlying app, then layers a network block on top so it can't be reused. And if there's the all too common crypto miner that snuck in during that window, it kills the process automatically, no manual cleanup, no waiting for someone to notice CPU spiking. They've designed a thing of beauty. It's not noticeable in terms of resource consumption. Like, at all.Any security guy will tell you what a joy it is to not hear a peep from the infrastructure side of the house blaming their tools for all their problems. It's great to forget it's even there. That's a point of pride I hope they take, because a lot of vendors in this space cannot say the same. I've been doing my own AI red teaming work on the side across a range of agent architectures and role setups... single agent tool calling loops, orchestrator and worker patterns, layered sub agent delegation, peer to peer agent swarms, you name it, I've tried the combo. So I've got a real basis for comparison, and I can say confidently: a lot of tools in this space show you a plausible looking attack path. Sweet actually runs the exploit and proves it's real. That's a meaningfully different posture than the Wiz/Upwind style tools, which mostly show static theoretical paths. The UI itself is easy to navigate, not a black hole you get lost in trying to find where something is. It's fun and friendly to use, and yes, it has dark mode. On integrations, we've had it working across our GreyMatter/ReliaQuest pipeline and Azure environment side by side, cloud and on prem both covered, so it's not just a point tool that only talks to itself. And the support side has been genuinely good, the team is quick to hop on a call, and patiently go through troubleshooting, and they bring their technical lead into demos when the questions get specific instead of leaving you with a someone who is just "going to get back to you". Its done properly the first time around.