How It Works

Traditional security looks for "what happened." We ask "is the system becoming structurally unsafe?"

The Five Core Metrics

Every network topology can be described using five fundamental measurements. Attacks necessarily alter these metrics in predictable ways.

1. Relationship Density (RD)

Rate of increase in edges per node over time.

Detects: Lateral movement, ransomware spread, correlation spikes

2. Fan-Out Asymmetry (FOA)

Disproportionate outbound connectivity from a single node.

Detects: OAuth app abuse, identity compromise, power concentration

3. Dependency Chain Depth (DCD)

Maximum path length of trust or control inheritance.

Detects: Privilege escalation, role chaining, supply chain attacks

4. Entropy Shift (ES)

Change in diversity of nodes or edges accessed by an actor.

Detects: Reconnaissance, scope expansion, unusual system access

5. Structural Fragility Index (SFI)

Rate of removal or degradation of redundancy edges.

Detects: Backup deletion, logging disabled, destructive attacks

The Three Universal Topologies

90% of enterprise networks exhibit three fundamental structural patterns. Understanding these patterns enables zero-configuration deployment.

Star (Habitual)

High-centrality hub connecting to spokes. Normal user accessing standard applications.

✓ SAFE

🌳

Tree (Operational)

Sequential flow from root to leaf. Supply chains, deployment pipelines, admin hierarchies.

✓ SAFE

🕸️

Mesh (Adversarial)

Peer-to-peer saturation. Lateral movement, worm propagation, collusion networks.

⚠ HIGH ALERT

Edge-First Architecture

Edge Sensor (Your Infrastructure)

  • Ingests raw logs locally
  • Builds in-memory graph (last 24-48 hours)
  • Calculates metrics in real-time
  • Anonymises entity identities
  • Sends 50-byte vector to cloud

Raw data never leaves your environment. Docker container. Single deployment.

Cloud Nucleus (Our SaaS)

  • Receives anonymous vectors
  • Compares against universal baseline
  • Returns verdict (SAFE / DANGER)
  • Auto-calibrates global baseline
  • Broadcasts threat signatures

Stateless detection. No historical storage. Herd immunity without individual exposure.

Why Attackers Can't Evade This

The Latency Penalty

To evade structural detection, an attacker must move at human velocity. This creates an impossible trade-off:

Be Fast (Effective)

  • → Structural spike
  • → Detected immediately
  • → Attack fails

Be Slow (Invisible)

  • → 1 file every 10 seconds
  • → 31,000 years to encrypt 1TB
  • → Attack irrelevant

The topology of an attack is inextricably linked to its intent. You cannot traverse a network without creating a path.