Aether for cybersecurity.
AI for defenders, at the speed of attackers.
Security is a long-horizon analytical workload against a live adversary — and unlike a pure-language model, Aether can forward-roll a digital twin of your attack surface and emulate the adversary in simulation before it reaches you. Twelve specialist agents — vulnerability research, CVE-aware review, incident response, threat intelligence, detection engineering and adversary emulation — under one model, capability-gated and audited, and built so the same capabilities cannot be turned offensive.
- Agents
- 12
- Path
- Signal → Confirmed fix
- Posture
- Defensive · capability-gated
- Tiers
- Static → Dataflow → Sim → Analyst
Signal to remediation, under one model.
The incumbent security stack is a dozen point tools, a SIEM, a SOAR and a pile of hand-written rules that never get tested. Aether for cybersecurity is one model and one investigation state — built so the review that finds the flaw, the twin that confirms it, and the playbook that contains it all share the same memory.
Attack-surface digital twin
SimOS forward-rolls a model of your network, identities and services — so the adversary can be emulated in simulation, against a copy, before the real environment is ever touched. The capability no pure-language security model has.
Vulnerability research
Code-base analysis with CVE indexing, exploit-pattern recognition and fix recommendation. The agent flags issues and proposes patches; it does not autonomously weaponise a finding — that path is refused, not gated.
CVE-aware code review
Every diff reviewed against the CVE corpus and your own historical incidents — taint and dataflow analysis, dependency and supply-chain risk, with a fix and a rationale, not just a flag.
Incident response
Long-horizon investigation state — alerts, indicators, host and identity data, evidence chain — provenance-tracked so the postmortem assembles itself and chain-of-custody holds.
Threat intelligence
Long-horizon analytical work over OSINT, indicator feeds and customer telemetry, with multi-year campaign memory that tracks an actor across dwell, re-tooling and re-emergence.
Detection engineering
Detection-as-code: hypothesis → rule (Sigma / YARA / KQL) → validation against the digital twin → coverage and false-positive estimate before a single rule reaches production.
Adversary emulation
ATT&CK-mapped scenarios played out against the digital twin — purple-team exercises that measure detection and response coverage in sim, where a failed control costs nothing.
SOAR automation
Playbook execution under capability gating. The agent can drain traffic, isolate a host and rotate credentials — but exfiltration, lateral movement and destructive actions are outside its capability envelope by construction.
Malware & artifact analysis
Static and sandboxed dynamic analysis of suspicious artifacts, behaviour extraction and family attribution — run in an isolated boundary, never on the live environment.
Identity & access analysis
Privilege-graph reasoning, lateral-movement path discovery and blast-radius estimation — finding the attack paths a defender should close, expressed as the shortest fixes.
Compliance & policy
Control mapping, compliance-evidence assembly and audit-readiness (SOC 2 / ISO 27001 / NIST CSF), with memory provenance that answers “why” cleanly for an auditor.
Guardrail & refusal layer
A red-team-verified refusal corpus and capability gating sit under every agent. Offensive pivots, weaponisation and exfiltration are refused; every privileged action is logged to an audit-grade trace.
Every finding knows how confirmed it is.
The governing principle: a screening signature is never presented as a confirmed exploit, and a simulated reachability is never presented as a live compromise. The four-tier evidence ladder makes that structural — and the offensive pivot is refused, not merely discouraged.
Static & signature
CVE indexing, signature and pattern matching, IOC lookup. Milliseconds. High-recall triage that is always labelled as screening, never as a confirmed finding.
Dataflow & graph analysis
Taint tracking, dependency and privilege-graph reasoning, behavioural correlation across hosts and identities. The tier most investigations live in.
Simulated reachability
Exploit reachability and adversary emulation run against the digital twin — a sandboxed copy, never the live environment. Confirms whether a flagged path is actually exploitable.
Analyst escalation
Capability-gated, human-in-the-loop deep analysis. A conclusion the model cannot establish with evidence returns “unconfirmed — needs an analyst”, never a confident guess.
Six security domains, one investigation state.
Not six disconnected tools — one model whose memory carries from a code review to the incident it prevents.
CVE-aware review, taint analysis and supply-chain risk in the SDLC — findings shipped as fixes with a rationale, wired to the same model your engineers code against.
Long-horizon investigation, alert triage, evidence chain and provenance-tracked postmortems — the analyst's memory that doesn't reset between shifts.
Multi-year campaign tracking over OSINT and telemetry, actor attribution and re-tooling detection, with sources cited rather than asserted.
Detection-as-code validated in the digital twin and ATT&CK-mapped adversary emulation that measures real coverage — not a tabletop estimate.
Privilege-graph and lateral-movement analysis across cloud and on-prem identity, blast-radius estimation and the shortest set of fixes to close the path.
Control mapping, evidence assembly and audit-readiness with provenance an auditor can follow — the paperwork pipeline collapsed into one model.
Defensive by construction.
The guardrails are the product as much as the analysis is. We report what the model does — and, as deliberately, what it refuses to do.
Adversary emulation against a sandboxed copy
Static → dataflow → reachability → analyst
Offensive pivots and exfiltration refused, not gated
Every privileged action logged
Findings shipped as fixes with rationale
Capabilities a defender needs, bounded by construction
One model for the whole SOC.
A dozen point tools, playbooks and rule sets collapse into one agent, one contract, one audited trace.
endpoint-protection suites cycles, compressed.
What compounds is mean-time-to-remediation, not any single query being faster.
From the digital twin to the refusal layer — each emitting results under one integrity contract, with every privileged action logged.
Test defenses and emulate adversaries against a forward-rolled copy of your estate — the capability a pure-language security model cannot offer.
Defensive capabilities are bounded by an envelope and a red-team-verified refusal corpus — not a policy promise that can be prompted around.
An AI analyst, not a dashboard.
It reads the estate, picks methods, confirms in simulation, writes the fix, and refuses the offensive pivot — for an expert audience.
- 01
Reads the estate
Ingests the code, the identities, the cloud posture and the telemetry, and builds a typed model of the attack surface before any analysis runs.
- 02
Picks the right tier
Knows when a signature match is enough, when to run dataflow and privilege-graph analysis, and when to confirm reachability in the digital twin — by the evidence the conclusion needs.
- 03
Confirms in simulation
A flagged path is emulated against a sandboxed copy of the environment, never the live one. Exploitability is demonstrated, not assumed — and the live estate is never touched to prove a point.
- 04
Validates against ground truth
Cross-checks findings against your historical incidents and the CVE corpus; out-of-distribution signals are surfaced for an analyst rather than silently scored.
- 05
Writes the fix and the rationale
Each finding ships with the shortest remediation, the blast radius it closes, the residual risk, and the evidence trail — with the model-version hash.
- 06
Refuses the offensive pivot
Weaponisation, exfiltration and lateral movement are outside the capability envelope and refused by a red-team-verified corpus — the same analysis that helps a defender cannot be turned on a target.
Defense that improves with every incident.
Each resolved incident returns into the threat model and the detection suite, so the model that caught one campaign gets better at catching the next — and the refusal corpus is re-verified against the red-team set on every release.
“It proved the path was exploitable against a copy of our network — then handed us the fix, not an exploit.”
Put a defender's AI on your estate.
Aether forward-rolls a digital twin of your attack surface, finds the reachable flaws, and ships the fix — capability-gated and audited end to end. Request access to deploy it behind your firewall, or see how it couples to the rest of the platform.
Cybersecurity sits on the same foundation as the rest of Aether — one model, every discipline.