Intrusion detection (NDR/IDS)
Behavioural network monitoring mapped to MITRE ATT&CK — lateral movement, privilege escalation, C2, exfiltration.
a product of CYRKIL Shield · cyrguard.fr
AEGIS SOVEREIGN CYBER DEFENCE PLATFORM
Cognitive autonomous cyber defence
It does not raise an alert. It understands the attack.
AEGIS assembles scattered signals into one causal story, works out the attacker’s intent and next move, decides the response, executes it, and then writes the regulatory report inside the deadline the law gives you. Built in France. Data never leaves the EU.
Four threat classes, one engine
01
Intrusion & APT
Lateral movement, privilege escalation, command and control.
02
Malware & zero-day
Behavioural detection and a sovereign sandbox, including fileless.
03
Ransomware
Isolated before encryption completes, not after.
04
Insider threat
Behaviour analytics that respect the employee’s privacy by design.
Insider detection is pseudonymised with four-eyes consent, designed against GDPR and European labour law.
Exclusive to AEGIS
The incident becomes the filing.
Every other platform hands you an incident and leaves the regulatory work to you, at the worst possible moment. AEGIS turns each incident into a drafted NIS2 24h and 72h notification, a GDPR breach record and a DORA report — for a human to review and file.
- T+0sSignals correlated into one incident storyagent
- T+11sHost isolated before encryption completesapproved
- T+40sBackup integrity verified, blast radius mappedagent
- T+4mNIS2 24-hour early warning draftedagent
- T+22mAnalyst reviews, edits and files ithuman
What the customer receives
Fourteen capabilities, one console.
Malware detection (EDR/XDR)
Behavioural detection plus a sovereign sandbox, and integration with the EDR you already own.
Ransomware early-kill
Pre-encryption detection, automatic isolation within seconds, and backup-integrity verification.
Insider threat (UEBA)
User-behaviour analytics with pseudonymisation and four-eyes consent, built for GDPR and labour law.
AI investigator
An agent that reconstructs the full attack story and writes the incident report in Arabic, French or English.
Autonomous response (SOAR)
Isolate a host, disable an account, block an address — in monitor, approval or full-auto mode.
Automated compliance reporting
Every incident becomes a drafted NIS2, GDPR and DORA report. No other platform does this.
Attack-path detection
A knowledge graph that reveals the road to your critical assets before anyone walks it.
Risk prediction
The riskiest host and user, the vulnerability most likely to be exploited, the probability of ransomware next.
Threat intelligence
ENISA, CERT-EU, CVE, CISA-KEV and MISP fused and correlated with your own environment.
Digital evidence vault
An immutable log with chain of custody — the forensic and legal foundation.
Deception
Honeypots and tokens as high-precision early warning with almost no false positives.
Sovereign deployment
EU cloud, on-premise, or air-gapped for classified environments.
MSP/MSSP management
A multi-tenant console to operate dozens of customers from one place.
EU cloud
Sovereign European infrastructure, named region, sub-processors published. No CLOUD Act exposure.
On-premise
Your hardware, your network, your control. Same console, same detections, same reporting.
Air-gapped
Isolated environments for classified and critical-infrastructure operators, with offline intelligence updates.
SUPERVISION & ARCHITECTURE
Bring us a real attack and watch it get written up.
Forty-five minutes on your own telemetry, or ours. You will see the story assembled, the response chosen, and the notification drafted.
