Cyber security: learn the normal, act on the departure.

Most defences are lists of known attacks. An attack nobody has written down yet is not on the list. Senua AI works the other way round: it learns how an organisation's own systems normally behave, and treats behaviour that departs from that as the signal.

How it works

The engine learns the causal states of any ordered stream, such as web requests, system calls or log lines, from the organisation's own traffic. One unusual event is not evidence: it judges a source across its events, acts when they agree, and records the events behind every decision so an analyst can read why.

Against the industry standard

Out of the box, having never seen an attack, the engine stopped more attacking sources than the OWASP Core Rule Set (66.9% against 64.7%) and wrongly blocked half as many genuine visitors. Once it had learned from confirmed attacks, it blocked 2.4 times as many attacking requests as the rule set, at the same false-block rate. The full comparison.

The approach also has a measured blind spot, published with the rest: see the results. The showcases put it against real Australian incidents: stopping a web attack, spotting an intruder on a host and an autonomous agent on a government portal.