Does your security actually do what you assume it does? We build the instruments that answer that — with a measured number, not an opinion.
Run Wazuh? Rule Doctor Lite is free: one read-only Python file that lists the custom rules that never fired, and why — including the ones Wazuh drops at load.
This is a real measurement, not an illustration. Read the full report — method, every technique, and what the number does not mean.
All research → — six measurements, method and limits in the body, raw data published.
ATK New Technology One Member Company Limited, Hanoi · Tax ID 0110935486
Every measurement is published with its method and limits; the research reports include the raw data
PayPal or bank transfer, ATK invoice, written refund policy
Including the ones Wazuh throws away while loading them — the config check exits 0, the manager starts, and the rule is gone. Lite is free, read-only, one Python file; a written review is USD 49; a fix is USD 490, paid after it works.
$ python3 rule-doctor-lite.py --ossec-dir tests/fixture… 910001 level 5 0300-custom.xml SHADOW-CANDIDATE 910003 level 8 0300-custom.xml SHADOW-CANDIDATE 910006 level 7 0300-custom.xml SHADOW-CANDIDATE 910010 level 10 0094-early.xml DROPPED-AT-LOAD 910011 level 6 0400-typo.xml DROPPED-AT-LOAD 910012 level 10 0500-chain.xml DROPPED-AT-LOAD 910013 level 12 0500-chain.xml DROPPED-AT-LOAD totals: DROPPED-AT-LOAD=4, SHADOW-CANDIDATE=3
Security spending is justified with artefacts that describe intent. A rule exists. A control is enabled. A policy is signed. None of those are evidence that anything fired when it mattered.
is not a rule that fires. Detection content is written once and then inherited, edited and quietly broken. The only honest way to know is to replay the technique and time the alert.
is not an inventory of what crossed the wire. Certificates, key exchanges and cipher suites live in traffic and configuration drift, not in a spreadsheet someone maintained last year.
is not a closed incident. Anything that ends in a queue nobody drains at 3am is a metric about your process, not about your attacker.
Assumed is not measured. Everything we build exists to close that gap for one specific question.
Does your SOC actually detect? A digital twin of the customer stack, real attack techniques replayed against it, and the detection timed on the SIEM you already run.
What cryptography are you actually running? An on-the-wire inventory of keys, certificates and handshakes, scored for harvest-now-decrypt-later exposure and delivered as a CBOM.
Who responds when nobody is watching? An autonomous SOC for companies with no security team: agents collect, rules decide, confirmed attackers get blocked, and the uncertain cases wait for a human.
Every number we sell on is one we ran ourselves. Method, sample and limits are in the body of each report rather than in a footnote, and the raw output is published rather than available on request — so anyone can recompute a figure, or contradict it.
Detection Evidence Map — 84 ATT&CK techniques. Our library declares evidence for 84 techniques. An endpoint-only bench can witness 18 of them. Both columns published, per technique, with the reason 66 stay unknown.
03 Sep 2026Position paper, IETF post-quantum authentication workshop. One handshake against 40 front doors: 31 negotiated hybrid post-quantum key exchange, none presented a post-quantum signature, which is expected, since no public CA can issue one yet. The control group had already moved its key exchange.
01 Sep 2026Crypto Reality Index Vol.1. We offered hybrid post-quantum key exchange to 45 public endpoints. 20 declined it. Includes a published correction.
08 Aug 2026Detection Reality Index Vol.3 — the between-audit gap. Zero of 51,937 Emerging Threats rules fired on an ordinary port scan.
08 Aug 2026Detection Reality Index Vol.2 — IBM QRadar. The same technique set replayed against a second SIEM, with measured time to alert.
08 Aug 2026Detection Reality Index Vol.1. 24 ATT&CK techniques replayed against a default SIEM install. Three raised an alert. Not three percent — three techniques.
Every line below is a capability we built and can demonstrate today, not a roadmap item. The numbers come from our own bench and telemetry.
The same technique, replayed once, timed natively on Wazuh, Splunk and IBM QRadar. Most breach-simulation tools integrate deeply with one platform and estimate the rest — which makes the comparison worthless precisely when a buyer needs it.
We ship an estimating mode as well, for stacks we are not connected to yet. So we measured it against our own lab on 21 September 2026: across 34 techniques, each one actually executed, the estimating mode made exactly one positive claim — and that claim was wrong, while the live SIEM detected 14. Estimated figures are labelled in the product, carry no detection time, and are never called a measurement. We publish that number because a vendor who cannot state the error of its own instrument is not measuring anything.
0–2 s · ~4 s · 4–8 sBrute force, lateral movement, ransomware behaviour and command-and-control run for real against a twin of the stack. Nothing is injected into a log pipeline, so a rule that only matches a hand-written test event is exposed rather than flattered.
84 techniques · 75 scenarios · 84 Sigma rulesHosts, identities, zones and trust relationships are held in a property graph, so we can rank choke points by blast radius. Remediation follows the paths an attacker can actually walk, not the order a scanner happened to print.
Attack-path ranking on a live twinIn VRadar, 99.2% of response decisions are taken by rules that produce the same answer every time and cost nothing per decision. A language model handles the 0.8% remainder. Autonomy you cannot reproduce is not autonomy, it is a demo.
99.2% deterministic · $0 per decision226 incidents were closed automatically only after verifying the originating condition was gone — 42 uncertain cases were held for a human instead. Against prompt injection, provenance-bound gating on the actuator took successful hijacks from 3 in 8 to 0 in 8.
226 auto-closed · 42 held · 0/8 hijackedHandshakes parsed from capture, trust hierarchies rebuilt root to leaf, and harvest-now-decrypt-later risk scored as vulnerability × sensitivity × retention × exposure. Ranking migration impact across a PKI tree is the step most of the post-quantum market has skipped.
V × S × R × E · CBOM CycloneDX 1.7The mark is three strokes, each rising past the last — one for every instrument we build. We publish figures that can be reproduced, state the status of each product plainly, and say what it does not do. A claim that ages badly costs more than the deal it wins.
VRadar runs in production with paying users. VCyber Twin and VPQ Audit are in pilot, and their pages say so. Every figure on this site comes from our own bench or our own telemetry — we do not borrow a customer's logo we are not allowed to name, and we do not quote an analyst who has never run our software. If something here cannot be reproduced, write to us and it comes down.
ATK New Technology One Member Company Limited · Xuân Đỉnh, Hanoi, Vietnam · Tax ID 0110935486
Asynchronously, by design. Everything we sell can be scoped, evaluated and delivered over email — nothing to sit through first, no procurement theatre. You should be able to judge the work by the artefact rather than by how well someone presents it.
Managed security providers and consultancies who have to prove their service is worth more than the stack it runs on; banks, government and critical infrastructure who have to prove the same thing to a regulator.
There is no sales team to route you through. It goes straight to the founder, and the reply comes back with the technical detail already in it — usually within a working day.