Is the AI reverse engineer optional?

No. It is part of every analysis. For each sample you get the sandbox report plus the short summary with a verdict and the reasons behind it.

What data does the language model see?

Only features: hashes and file type, signatures, rule hits, observed domains, IP addresses and URLs, command lines, file operations and MITRE techniques. The sample itself, the mail text and the recipients never leave your environment.

Can I run my own model on my own hardware?

Yes. The model can run on your own GPU server. Once that is set up, requests only go there. There is no silent fallback to an outside service.

What is MITRE ATT&CK?

MITRE ATT&CK is a public catalog of attack techniques. Each technique has a number, for example for running commands or for hiding inside other processes. This lets you name and compare findings in the same way.

Back to the Malware Sandbox

AI malware analysis

The AI reverse engineer: findings anyone can read

A sandbox report is long. It lists signatures, processes and connections. Experts find that useful. Everyone else finds it hard to read. The AI reverse engineer turns it into a short report with a clear verdict. It is part of every analysis.

Request a demo

What the AI reverse engineer looks at

Reverse engineering means working out how a piece of software works. For malware, that is usually manual work for experts. The AI reverse engineer does not run anything itself. It takes the sandbox results and puts them in context:

Behavior and signatures: a signature is a rule that spots typical malicious behavior.
Processes: which programs the sample starts, with their command lines.
Files: what it writes, reads or deletes.
Network: which domains, IP addresses and URLs it contacts.
MITRE ATT&CK: which known attack techniques show up.
Indicators: traces such as hashes and addresses that help you spot the attack again.

An example: say an Office file opens a command line in the test and calls a strange server. The report then states in brief what happened and why that is dangerous. Our glossary explains these traces underindicators of compromise.

The result: a verdict with reasons

Four levels from benign to critical

Every sample gets a verdict: benign, suspicious, malicious or critical. The report also says how sure the verdict is. If the model knows the malware family, it names it too.

Summary and report

At the top you get one or two sentences. Below that comes a report of about 25 lines. It explains the verdict and lists the MITRE techniques and indicators. Management sees at a glance what is going on. Your IT team still gets every detail.

Where you see the report

In the Mail Security Gateway, it shows up in the quarantine view. Your security team can also add it to tickets.

Privacy: only features go to the model

The sample itself never leaves your environment. Nor do the mail text and recipients. The language model only gets a list of features, such as hashes, signatures and observed addresses.

Your own model on your own GPU server

If you wish, the model runs on your own GPU server. Requests then only go there. There is no silent fallback to an outside service.

If the model does not answer

If the model is down, the analysis still goes on. The sandbox report stays complete. The report shows why the summary is missing.

To see how the sandbox gathers its findings, readagentless VMI analysis and the postsectepe-vmi. The flow of an automated check is covered inAutomated malware analysis.

FAQ: the AI reverse engineer

Is the AI reverse engineer optional?: No. It is part of every analysis. For each sample you get the sandbox report plus the short summary with a verdict and the reasons behind it.
What data does the language model see?: Only features: hashes and file type, signatures, rule hits, observed domains, IP addresses and URLs, command lines, file operations and MITRE techniques. The sample itself, the mail text and the recipients never leave your environment.
Can I run my own model on my own hardware?: Yes. The model can run on your own GPU server. Once that is set up, requests only go there. There is no silent fallback to an outside service.
What is MITRE ATT&CK?: MITRE ATT&CK is a public catalog of attack techniques. Each technique has a number, for example for running commands or for hiding inside other processes. This lets you name and compare findings in the same way.

Read a real report

We show you an analysis with its verdict and reasons, and we discuss where the model should run for you.

Request a demo

How we work with you

We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.

1. Free initial conversation

We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.

2. Current state review

We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.

3. Delivery with a dedicated lead

An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.

4. Running and reviewing

After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.