Products/Viyuh

05Viyuh

AI-native unified cyber defence

One agent, one intelligence engine, sovereign on-prem protection.

Viyuh is a unified cyber-defence fabric that brings endpoint detection, response, data-loss prevention and threat intelligence under local customer custody — the full lifecycle on one agent, with no cloud egress.

01

Capabilities

Viyuh is a unified cyber-defence fabric that brings endpoint detection, response, data-loss prevention and threat intelligence under local customer custody — the full lifecycle on one agent, with no cloud egress.

01 · Sensor

Unified sensor agent

A lightweight single-agent telemetry fabric across ETW, WFP, WDM and filesystem minifilters.

02 · Stack

Full defensive stack

EDR, BDR, CDR, DLP and SOAR playbooks integrated, not bolted together.

03 · Local AI

Local AI correlation

On-prem models for anomaly detection, MITRE ATT&CK mapping and risk scoring — no cloud egress.

04 · Lifecycle

End-to-end lifecycle

Discover → Identify → Protect → Respond → Improve, on one pane under local custody.

No cloud egressMITRE ATT&CKLocal AI modelsSingle agent
02

Lifecycle

  1. 01Discover

    See the estate

    The unified agent builds a live inventory of endpoints, data and activity across the environment.

  2. 02Identify

    Correlate locally

    On-prem AI maps telemetry to MITRE ATT&CK, scores risk and flags anomalies without leaving the perimeter.

  3. 03Protect

    EDR · BDR · CDR · DLP

    Prevention, backup and recovery, content disarm and data-loss prevention run from one agent.

  4. 04Respond

    SOAR playbooks

    Automated playbooks contain and remediate, with analysts in the loop where it counts.

  5. 05Improve

    Close the loop

    Every incident feeds detection and posture back into the fabric to harden the next day.

03

Telemetry & alerts

Telemetry stream & alert timelineIllustrative
Telemetry stream
Alert timeline · ATT&CK
T1059Script execution
T1021Lateral movement
T1048Egress attempt
T1055Process injection
Illustrative — live telemetry and a scored alert timeline.
04

Where it is used

Sovereign SOC

Run detection and response on-prem with no telemetry leaving the perimeter.

Regulated estates

Keep endpoint, DLP and intelligence data under local custody for compliance.

Air-gapped networks

Operate the full defensive stack where cloud is not an option.

Consolidation

Replace a stack of point tools with one agent and one engine.

DeploymentFully on-prem

Authorised, sovereign, under your control.