Autonomous SOC platformAutonomous cybersecurity. Already here.
Where traditional tools wait to recognise an already-catalogued threat, BALLA learns each machine's normal behaviour, detects the slightest deviation, known or entirely new, contextualises it against global threat intelligence, then executes a proportionate, fully traceable response. All within milliseconds, and with no human in the loop for standard cases.
Known and unknown attacks · Every decision explained · Sovereign data · Sovereign deployment
Building the intelligence of the future.
A real product, not a promise
60,000+
lines of code
680+
automated tests
3
operating systems
~150 ms
decision latency (p99)
The principle
Detect. Understand. Act.
Three promises, kept in a continuous loop, machine by machine, with no day off. It is this sequence, detect, then understand, then act, that separates genuine autonomous cybersecurity from just another alerting tool.
01
Detect
Signatures only catch what's already known. BALLA learns each endpoint's normal, programs, hours, networks, sequences, and flags the slightest deviation, including the targeted, never-seen attacks that do the most damage.
02
Understand
An anomaly score is not a decision. Every threat is cross-referenced with CVE, MITRE ATT&CK and malware intelligence, then explained in plain language. From score to verdict.
03
Act
Understanding without acting is arriving too late. BALLA blocks, isolates, kills or quarantines in a fraction of a second, faster than any human team, with human sign-off on the calls that matter.
Who it's for
Built for those who cannot afford a breach
Sectors where an intrusion costs millions, trust, or lives. BALLA learns each one's own behaviour and adapts to it.
Banking & finance
Fraud, exfiltration, ransomware: catch the abnormal before it reaches the accounts.
Telecoms
Sprawling networks, millions of subscribers: a vast attack surface, covered continuously.
Government & public sector
Sensitive citizen data and sovereignty: protection you control, hostable locally.
Healthcare
Patient records and connected devices: availability and confidentiality, no compromise.
Growing SMBs
Enterprise-grade security, at a fraction of the cost and with no dedicated SOC team.
Industry & infrastructure
Endpoints, servers and, tomorrow, industrial systems: coverage that grows with you.
The pipeline
From sensor to counter-move, in five steps
Every event follows exactly the same fully decoupled path: no layer calls the next one directly, everything flows through a message bus. This architecture guarantees three things at once, resilience (an isolated failure doesn't bring down the chain), end-to-end traceability (every decision links back to its source event), and controlled latency around 150 ms at the 99th percentile.
C1
Collect
A lightweight agent watches 28+ event families on each endpoint, cryptographically signed, and buffers locally, encrypted, if the network drops.
C2
Transport
A decoupled Apache Kafka bus moves events resiliently, tens of thousands per second, keeping every machine's events in order.
C3
Detect
The BALLA brain tells normal from abnormal without knowing the threat in advance, catching real attacks without drowning teams in false alarms.
C4
Enrich
Every alert is qualified by threat intelligence: CVE, malware family, MITRE ATT&CK technique, reputation, cross-machine correlation. A score becomes a diagnosis.
C7
Act
The decision becomes a signed action (Ed25519), reversible and fully audited, with human sign-off for the most sensitive calls.
End-to-end latency< 200 msp99 · C1 → C7
Under the hood
Not one model. Defence in depth.
Most solutions rely on a single model, and that model either misses too many threats or raises too many false alarms. BALLA takes the opposite stance: a stack of specialised, complementary layers, where each has one responsibility, defined interfaces, and covers the others' blind spots. It is this depth of defence that simultaneously reduces missed threats and false alarms.
BALLA's detection capabilities
01
Real-time anomaly
HalfSpaceTreesOnline, signature-free learning that spots statistical deviation the instant it happens. The first line of defence against the unknown.
02
Contextual analysis
Contextual Z-ScoreCompares each activity to the machine's and role's own profile, calibrated over 14 days. A server's normal is not a designer's.
03
Action sequences
Markov chainsReads the chain of actions and catches the abuse of trusted tools, like Word spawning PowerShell to download a payload.
04
Anti false-positive
Gradient BoostingTrained on analyst corrections, it separates true threats from unusual-but-legitimate behaviour, and sharpens with every use.
05
Action decision
Reinforcement learningPicks the best response under strict guardrails, never on critical systems without sign-off. Driven by reinforcement learning, it improves with every incident.
Every decision explained
Unlike an impossible-to-understand black box, BALLA justifies every decision: the XAI / SHAP method shows exactly which factors weighed in, and by how much. This transparency matters on two counts, team trust, since they see why an alert was raised, and GDPR compliance (Article 22) on automated decisions.
process_word_to_powershell
encoded_args_detected
anomalous_hour_03h
role_deviation
Performance
Decide in milliseconds
In cybersecurity, speed isn't a luxury: it's the difference between blocking an attack and suffering it. Here are the production targets we aim for and measure continuously, from decision time to false-alarm rate.
0ms
p50 latency
median decision time
0ms
p95 latency
under concurrent load
0ms
p99 latency
worst case under control
100k+ev/s
Throughput
events processed per second
< 2%
False positives
production target
0%
Availability
critical services
Defence in depth
BALLA's own security matters as much as the security it delivers
A tool that protects others cannot be a weakness itself. That is why we hold BALLA to the same standard we sell: every communication is encrypted and mutually authenticated, every command is cryptographically signed, every sensitive action is written to a tamper-proof log. Protection is organised into three criticality tiers, P0, P1, P2, to prioritise without ever neglecting.
P0
Critical core
- Binary integrity & HMAC-SHA256 signing
- Local buffer encryption (AES-256-GCM)
- Tampering and restart detection
- End-to-end Ed25519-signed commands
P1
Extended monitoring
- USB & removable media
- Suspicious authentication events
- Critical file integrity (FIM)
- DNS-tunnel exfiltration · certificate pinning
P2
Advanced threats
- ARP spoofing detection
- NTP monitoring
- Injection protection (libinjection)
- Rootkit detection
Email protection: three-tier phishing detection
Phishing remains the number-one entry point for attacks. Our dedicated service analyses every message with an escalation logic: the more ambiguous a signal, the more it is handed up to an intelligent layer. Detection is natively bilingual French + English, a product requirement for multilingual environments. And it is privacy-first: no email body is stored, learning relies on public datasets and opt-in, and the service runs offline.
01
Tier 1Deterministic rules
The first line rests on verifiable, explainable signals: spelling mistakes, lookalike domains via typosquatting, URL features (ephemeral tunnels, dynamic DNS), SPF / DKIM / DMARC authentication, business-email-compromise (BEC) patterns and dangerous attachments. Fast, transparent, and effective on the majority of cases.
02
Tier 2Semantic ML
For subtler messages, a fine-tuned multilingual transformer (mDeBERTa / XLM-R) analyses the meaning of the text, not just its form. A lightweight lexical backend stays as a permanent fallback: the service is therefore always available, including offline or in air-gapped environments.
03
Tier 3BALLA-LLM
For the most complex or novel cases, the BALLA-LLM cognitive layer produces a natural-language explanation of why a message is deemed dangerous, zero-shot, with no prior example. The analyst understands, decides, and saves time.
Attack reconstruction
BALLA connects the dots, and names the technique
An attack is almost never an isolated event, but a sequence. BALLA reconstructs it end-to-end and, with BALLA-LLM, reveals in plain language the MITRE ATT&CK techniques used.
A reconstructed chain
- T1566PhishingInitial access
- T1059.001Encoded PowerShellExecution
- T1003Credential dumpingCredential access
- T1021.002SMB admin shareLateral movement
- T1071C2 beaconCommand & control
- T1486Encryption (ransomware)Impact
How BALLA links events
- Process lineage
Which program launched which other, the causal root of the chain.
- Shared & cross-machine IoCs
Same file, same address, same fingerprint across several endpoints.
- MITRE progression
Consistency with the logical flow of an attack per ATT&CK.
BALLA-LLM
BALLA-LLM's narration
“A phishing email delivered an encoded PowerShell script that dumped credentials, spread over SMB to 3 endpoints, opened a command-and-control beacon, then triggered encryption. A typical human-operated ransomware pattern.”
Progression along MITRE ATT&CK
ReconnaissanceInitial accessExecutionPersistenceLateral movementCommand & controlExfiltration / Impact
Most frequently observed attack techniques
BALLA-LLM highlights the ATT&CK techniques that recur most across incidents, to anticipate the likely next move.
T1059.001PowerShell
92%Execution
T1566Phishing
88%Initial access
T1003Credential dumping
74%Credential access
T1486Encryption (ransomware)
69%Impact
T1021.002SMB admin share
63%Lateral movement
T1071C2 protocol
58%Command & control
T1055Process injection
47%Defense evasion
T1195.002Supply chain
34%Initial access
Why BALLA
Power, without the compromise
We bring together what classic approaches keep apart: accessibility, personalisation, transparency and full control over your data. Here, criterion by criterion, is the difference.
Cost
Classic approach
Reserved for big budgets
BALLAUp to 10× more accessible
Detection
Classic approach
Signatures, already-known threats
BALLAAnomaly, never-seen threats
Response
Classic approach
Alerts a human who arrives late
BALLAAutonomous, in milliseconds
Personalisation
Classic approach
One-size-fits-all protection
BALLAA unique profile per endpoint
Transparency
Classic approach
Black box, opaque decisions
BALLAEvery decision explained
Sovereignty
Classic approach
Your data out of your control
BALLAYou keep control, wherever you choose
Pricing
A plan for every scale
Our model is simple and proven by the greatest tech successes: a free, open base that builds trust and adoption, then revenue on advanced features, autonomous response and support. From the open-source community to the sovereign institution, everyone finds the level that fits their stakes and their means.
Open Core
Free
The endpoint agent and core detection layers, open and auditable. Built for the community, research, small organisations and anyone who wants to verify for themselves that there is no backdoor and no hidden data collection.
- Multi-OS endpoint agent
- Behavioural anomaly detection
- Auditable code
- Community support
Most chosen
Enterprise
On request
The full platform: all AI layers, the real-time SOC cockpit, threat enrichment, response and remediation, with standard to 24/7 support. For banks, telecoms, administrations and SMBs that want genuine autonomous cybersecurity.
- All AI layers + XAI
- SOC cockpit & real-time alerts
- Full threat enrichment
- Response & remediation
- Standard to 24/7 support
Sovereign
On request
For governments, defence and critical infrastructure: mandatory 100% local hosting, full source-code audit, completely disconnected air-gapped mode, dedicated SLA and support. Digital sovereignty with no compromise.
- 100% local hosting
- Air-gapped mode
- Source-code audit
- Dedicated SLA & support
Indicative pricing for SMBs and large enterprises is shared on request, in FCFA or euros.
FAQ
The questions we hear most
Answers to what comes up before getting started.
How is this different from an antivirus?
An antivirus recognises what it already knows. BALLA learns each endpoint's normal behaviour and detects the anomaly, meaning the new or targeted attack that no signature covers.
Does the AI really act on its own?
It detects, decides and can execute proportionate responses, under strict guardrails. The most sensitive decisions and critical systems always keep a human in the loop.
Does my data leave my infrastructure?
Not if you don't want it to. BALLA can be deployed fully on your side, down to a completely disconnected air-gapped mode. You keep control, wherever you choose.
How long before it's effective?
BALLA learns an endpoint's normal behaviour in about two weeks. Reference profiles avoid cold start and make detection useful from day one.
Is it compatible with my fleet?
Windows, macOS and Linux, via a lightweight agent that installs in minutes per endpoint, without disrupting the user.
Will it drown my team in false alarms?
That is exactly what the multi-level architecture and supervised filtering are built to avoid. The goal is clear: fewer false alarms, never more.
Security that decides. Watch it work.
Twenty minutes is all it takes to grasp what changes when an AI learns, decides and acts, with your data staying under your control.