Research

The research behind a security AI that decides

A security AI that decides must be understood before it is trusted. Here are the fronts we research, and what we publish.

Research areas

Detection

Unlabelled anomaly

Online learning to spot the unknown without a signature database.

Decision

Reinforcement learning

An RL (PPO) agent trained on a cyber-range to pick the best response, under strict guardrails.

Explainability

XAI / SHAP

Make every automated decision auditable and GDPR-compliant.

Cognition

BALLA-LLM

A natural-language reasoning layer for complex cases, research.

Publications

Detecting sophisticated phishing: from the mirage of perfect scores to an honest benchmark

We applied to phishing detection the same uncompromising protocol we use for network anomalies: measure without leakage, on hard cases held strictly out of training. A public F1 of 0.99 turned out to be a mirage; a model trained on sovereign, diverse data reaches strong performance on our internal benchmark, which we label honestly for what it is.

Rethinking unsupervised network anomaly detection: when a rigorous protocol brings perfect scores down to earth

We evaluated the Autoencoder + Isolation Forest architecture on CICIDS2017 under a leakage-free protocol. The result: modest real performance, a non-linear reduction that does not beat PCA, and a drift in benign traffic that invalidates any fixed threshold.

No black boxes: why every BALLA decision is explainable

An AI that decides without being able to justify itself has no place in cybersecurity. Here's how BALLA makes every alert readable, and why that's non-negotiable.

Detecting the unknown: anomaly over signature

Antivirus recognises what it already knows. To stop never-seen attacks, you must learn normal behaviour, and measure the deviation.

Our work and benchmarks will be published progressively. Reach out to collaborate.