Edge AI
Local behavior detection — live
- YAML rules plus EWMA/z-score behavior baselining at the Edge.
- Runs even when the link to Core is down.
- Lab run: 0 false incidents over a 22.4-hour baseline.
Services · AI Security Services
AI-assisted correlation today. A copilot on the roadmap — labeled honestly.
Edge behavior detection and cascading kill-chain correlation run in production. AI Copilot chat and UEBA are roadmap items — we would rather lose a deal than oversell a capability.
Live today
Edge behavior detection and correlation — shipping, not slideware.
Correlation windows
Cascading windows do the correlating — no manual stitching.
Kill-chain correlation
Cascading windows — live
- W15 / W60 / W24 windows assemble the full intrusion story automatically.
- Explicit Enterprise→OT pivot signaling, not manual stitching.
- MITRE ATT&CK + ICS tactic coverage.
Roadmap — labeled honestly
AI Copilot chat and UEBA are not shipped yet.
Live, partial, and roadmap are published on this site on purpose. These two are roadmap — not "coming soon" marketing filler.
AI Copilot & UEBA
Roadmap — labeled honestly
- AI Copilot chat: analyst-facing assistant grounded in tenant evidence — roadmap.
- UEBA: behavior analytics for operator and service accounts — roadmap.
- We would rather lose a deal than oversell a capability.
Shipping alongside it
What's already live or hardening on the same Core.
FAQ
Frequently asked questions.
Is CyberDragon's AI a chatbot?
Not today. The current AI-assisted capability is statistical behavior detection (EWMA/z-score) at the Edge and cascading correlation logic in Core — not a conversational assistant. AI Copilot chat is roadmap.
What does Edge behavior detection actually do?
It baselines normal OT traffic locally and flags statistical deviations even when the Edge collector is offline from Core, using YAML rules plus EWMA/z-score behavior analysis.
Why publish roadmap items instead of hiding them?
Honest maturity labeling is a stated company value. We would rather lose a deal than oversell a capability.
See kill-chain correlation run on your own traffic.
A dedicated CyberDragon tenant on your own traffic — not a slide deck. See kill-chain cyber defense on your network.