Tenlayers,oneatatime.

The architecture page is the system view. This is the index: each layer with what arrives, what leaves, the rules it holds to, and where it is honestly weak.

L0Prototyped

Ingress and passive fingerprinting

Accept inbound traffic, read weak pre-handshake signals, set a prior, and never reject on the prior alone.

2 invariants

L1Prototyped

Universal sandboxing

Put every inbound session in its own container, before anything is known about it.

3 invariants

L2In build

Continuous behavioural scoring

Watch the session, accumulate weighted evidence, decay it over time, and check each request synchronously.

3 invariants

L3Designed

Case assembly

Cluster loose signals into one coherent session case with an evidence chain and a timeline.

2 invariants

L4In build

In-place deception conversion

At threshold, swap the reachable world beneath a live session without touching the session.

5 invariants

L5Designed

Intelligence collection

Record what the attacker actually did, in enough fidelity to replay and to extract from.

2 invariants

L6Designed

Extraction and narrative

Map the record to ATT&CK, IoCs and signature candidates deterministically, then make exactly one LLM call for the prose.

3 invariants

L7Designed

Cross-session correlation

Cluster related sessions by fingerprint similarity and TTP-sequence distance. Not attribution.

2 invariants

L8Designed

Feedback gate and rule governance

Shadow-test candidate rules against recorded benign traffic, then require a human before anything enforces.

3 invariants

L9In build

Console

Show live sessions, the attack story, replay, the environment transition, and the intelligence that came out.

3 invariants