Answer first: our stack has three layers — a decision engine that decides what to do, an execution layer that performs the action on a real client, and a telemetry-and-monitoring layer that decides whether the previous two should be allowed to keep working. We will not name vendors, libraries, or internal tools. We will describe what each layer does and what the failure modes are, because that is the part that matters to operators we want to talk to.
The shape of our timing distributions or any concrete parameter
How agent envelopes are generated or refreshed
Any platform-specific specifics, including in private conversations until trust is established
If a vendor publishes those details on a glossy page, assume the publication itself is a tell. Detection teams read sales pages.
What we will discuss
Layered architecture, separation of concerns, supervisor design
Recovery procedures after a detection wave
Reconciliation cadence and tolerance windows
How we structure retraining cycles and what triggers an off-cycle retrain
i
Why we wrote this page
Operators who arrive with a serious problem usually want to know two things: do we understand the layering, and do we have stories about each layer failing. The answer to both is yes, and this page is the polite version of that conversation.
If you would like the impolite version, with specifics, on a private channel: