Six layers, and a seventh that guards the other six.
Mature open foundations at the bottom — Zeek, Suricata, Wazuh, Sigma, YARA. Our value is concentrated in the four layers above them: knowledge, reasoning, agents and compliance. This page is written for the person who will actually evaluate it.
- 1
Sensing & ingestion
open foundationsTurns the raw world into one event stream — network traffic, endpoints, cloud logs, identity. The normalizer is the single point where every source becomes the same shape.
Zeek · Suricata · Wazuh · Go connectors · Kafka - 2
Detection
open foundationsRules as code plus behavioural models, with a dedicated ransomware early-kill path and privacy-preserving user analytics.
Sigma · YARA · UEBA · ML scoring - 3
Knowledge & data fabric
CYRKIL valueScattered signals become context. A cyber knowledge graph answers the question that matters: is there a path from this compromised host to something critical?
Neo4j / Memgraph · four-memory engine · TI fusion - 4
Reasoning & cognition
CYRKIL valueAssembles signals into a causal incident story, infers the attacker’s intent and current stage, and predicts the next move.
incident model · attack-stage inference - 5
Agentic response
CYRKIL valueCollaborating agents that decide and execute containment under an explicit contract, with human-in-the-loop gates on anything destructive.
agent contract · SOAR · 3 modes - 6
Compliance
CYRKIL valueTurns the incident into the regulatory artefact — NIS2 24h and 72h, GDPR, DORA — as a draft for a named human to file.
YAML rule model · evidence vault - ×
Platform self-defence
cross-cuttingA security platform is a high-value target. This layer secures AEGIS itself — tenant isolation validated continuously, dangerous agent actions gated, and every decision logged immutably.
mTLS · per-tenant keys · signed detections · immutable audit
One event schema, enforced once
Every source — network, endpoint, cloud, identity — is normalised to OCSF at a single enforcement point, carrying tenant_id and compliance_tags. Everything above depends on that being the only door in.
Three response modes
Monitor, human approval, full auto — chosen per action type, not per platform. Destructive actions stay gated regardless of mode, which is a governance decision rather than a configuration one.
Explainable before clever
Behavioural detection starts with models an analyst can interrogate. Under the AI Act, a security decision you cannot explain is a liability — so explainability is a design constraint, not a feature.
