Azerbaijan unveils homegrown Sangar platform to hunt cyber threats

Azerbaijan has put a domestically built threat-detection platform at the center of its cyberdefense pitch, with the state body responsible for incident response presenting the system, called Sangar, at the ADEX 2026 defense exhibition in Baku.

Murad Balayev, head of the Computer Incident Response Center at the State Service of Special Communication and Information Security, said the center had used Sangar as the base for a managed detection and response capability rather than buying one off the shelf. "Based on the Sangar platform, we managed to implement a Managed Detection and Response (MDR) class solution that fully combines a situational center module, network monitoring, SIEM-SOAR functionality, as well as data on vulnerabilities (CVE), exploits, and threat intelligence," Balayev said.

That list describes a consolidated security operations stack: a watch floor, live network telemetry, the log-analysis and automated-response layer the industry labels SIEM-SOAR, and feeds on known vulnerabilities and working exploits. Balayev said work on Sangar is continuing, and he tied the design directly to the way attacks are changing.

"Since cyberattacks are actively evolving through the use of artificial intelligence, the application of AI solutions in threat detection is inevitable," he said, adding that the center already uses AI-based tools and wanted to draw attention to its own development.

Resilience over prevention

A second speaker at the exhibition pushed the argument further, suggesting that prevention is no longer the right benchmark. Tural Naghiyev, a project manager at Information Technology and Data Management Center LLC under Azerbaijan’s Ministry of Economy, said businesses should be judged on how they recover rather than on whether they are breached.

"No matter how many measures are taken, new risks, attacks and technologies will emerge," Naghiyev said, framing his own objective as ensuring "the resilience of that business after such an attack." He said that with the development of artificial intelligence, "it is becoming impossible to prevent cyberattacks," and called for academic research into current practice. He also flagged genetic information and biological data as high-value targets, noting that state security requirements extend to strict data sanitization protocols.

The two presentations came at the sixth Azerbaijan International Defense Exhibition in Baku, where the cyber segment now sits alongside hardware. Azerbaijan has been building out the physical layer that national monitoring systems depend on: Baku has pitched its grid capacity to the artificial intelligence build-out and drawn international investors toward data center projects. A homegrown detection platform is the software counterpart to that pitch.

The regional threat picture gives the argument urgency. European intelligence services have warned that hybrid operations against European targets are set to widen, and the South Caucasus carries energy, telecom and transit infrastructure whose operators are exposed to the same methods. Neither Balayev nor Naghiyev named a specific adversary or attack, and no incident figures were released at the panel.

What it means. Building the detection stack in-house is a sovereignty decision as much as a technical one. A state that routes gas, cables and freight for other countries has a strong incentive not to hand visibility of its own networks to a foreign vendor, and Sangar lets Baku say the watch floor is its own. The caveat is that national platforms live or die on threat intelligence, which is inherently cross-border: a sovereign tool still needs other people’s data to be useful. The resilience framing voiced at the exhibition is the honest read of that trade-off, and it shifts the question from whether Azerbaijani networks will be hit to how fast they come back.