The Converged Platform forSecurity & Data Intelligence.
Built in Rust as a single high-performance binary. Indicis collapses SIEM, XDR, SOAR, DSPM, DDR, CIEM, ITDR, and DLP into one unified process — sharing the same data model, identity graph, and causal reasoning engine with cryptographic zero data egress.
Enterprise Security
Divided by Tool Seams.
Enterprise SecOps is paralyzed not by a lack of security software, but by the seams between them. Moving evidence from SIEM to XDR to DSPM to SOAR creates blind spots where breaches hide.
The Fragmented Tool 'Seam Tax'
SIEM, XDR, SOAR, DSPM, and CIEM operate in disconnected silos. Correlating evidence across 6+ discrete vendors is manual, slow, and burns analyst hours.
Blind Spots Between Identity & Data
Traditional ITDR baselines 1D volume rates. A principal reading S3 1,000× and writing IAM 0× looks identical to one writing IAM 1,000×.
Alert Fatigue Without Causal Context
Disjointed detection rules fire in isolation without causal DAG verification, blast-radius Dijkstra scoring, or topological root-cause analysis.
Invisible PII & Secret Movement
Classic DLP inspects static endpoints. It cannot track cross-system byte lineage, API token trickle-exfiltration, or enforce DP-style access budgets.
Blind, Non-Gated Automation
Standard SOAR playbooks trigger unverified remediation scripts that risk breaking production systems without counterfactual policy replay or safety gating.
Cloud Egress & Sovereignty Violations
Forwarding enterprise telemetry, credentials, and sensitive audit records to SaaS security vendors breaches strict air-gap and sovereign regulatory perimeters.
One Binary.
Nine Security Layers Collapsed.
Unlike conventional enterprise security that stitches together disconnected vendors, Indicis operates as a single converged system where detection, reasoning, governance, and response share one canonical event schema and in-memory store.
Single-Process Rust Execution
Real-time log ingestion & correlation
Endpoint, cloud & network telemetry
Policy-orchestrated automated response
Data discovery & sensitive asset posture
Canonical DNF cloud entitlement solver
3D tensor behavioral identity baselines
Byte lineage & 69+ compiled regex families
Attack surface & reachability graph
Engineering Precision from
Wire Tap to Remediation.
Explore how Indicis unifies detection, causal inference, data security posture, and automated response inside a single, zero-allocation runtime.
SIEM · XDR · 16-Shard In-Memory Correlator
AI-Driven Real-Time Threat Correlation
Single-pass linear scan via Aho-Corasick + RegexSet evaluates incoming syslog, cloud audit logs, and wire taps in lock-free threads. Detections auto-correlate into incidents on shared (host, user) tuples in <1ms.
- 16-shard RwLock in-memory correlator with Arc COW snapshots
- Native Sigma AST engine + MITRE ATT&CK technique auto-enrichment
- Sub-2s sequence state machines with automatic key eviction
Pearl g-formula · Dijkstra Blast Radius · Story Cards
Causal Inference & Attack-Path BFS
Moves beyond raw alert lists to formal causal reasoning. Indicis builds typed causal DAGs and traverses identity graphs to compute exact blast radii, isolate root causes, and compile structured narrative story cards.
- Rigorous causal inference engine using standardization g-formula
- Wiz-style toxic combination BFS across Identity × Permissions × Data
- Automated incident story card generation for instantaneous SOC triage
"Change event PR-1492 (IAM policy diff) loosened SCP boundary on S3 finance-vault. 4 minutes later, compromised token svc-analytics triggered anomalous bulk read. Blast radius: 3 downline services, 42,000 sensitive records."
Data Posture · 69+ Regex Families · Leak Prevention
DSPM, Byte Lineage & DP-Style PII Budgets
Continuously classifies sensitive databases, tables, and cloud buckets. Tracks the movement of sensitive byte fingerprints across source → derivation → sink, enforcing per-principal consumption budgets to stop trickle-exfiltration.
- ~69 compiled regex families covering PII, cloud keys, credentials & tokens
- Cross-system byte lineage tracking across base64, URL & percent-encodings
- Adaptive DP-style access budgets: alerts the moment a principal overdraws
Dry-Run Default · Two-Gate Safety · Policy Replay
Autonomous SOAR with Off-Policy Learning
Automates incident remediation with safety guarantees. Actions are dry-run by default, requiring policy allow-listing and explicit approval tokens. Evaluates runbook policies off-policy using counterfactual IPS/SNIPS estimation.
- Strict double-gated execution: policy allowlist + cryptographic approval token
- Counterfactual CIEM & IAM policy replay: verifies 'will this break production?'
- Offline reinforcement learning (IPS/SNIPS) avoids dangerous live A/B tests
Fragmented Suite vs.
Converged Platform.
The point of Indicis is not to be a marginally cheaper vendor. It is that the seams between axes — the human, ticket, and latency cost of moving evidence from one tool to another — disappear when every axis shares one schema, one store, and one correlator.
| Capability Axis | Conventional Security Stack | Indicis Converged Architecture |
|---|---|---|
| Unified Runtime | Stack of 6–10 discrete vendors, disparate databases & APIs | Single-binary Rust implementation (~86k LoC across 337 files) |
| Cross-Domain Correlation | Manual correlation by SOC analysts across tickets after the fact | 16-shard in-memory correlator joins logs, cloud, & identity in <1ms |
| Causal Inference | Absent; alerts fire without causal lineage or root-cause DAG | Pearl g-formula DAG + Dijkstra blast radius attribution |
| Data Security (DSPM & DLP) | Periodic scanner looking only at static storage containers | Real-time wire classifier + byte lineage across source → sink |
| Identity Threat (ITDR) | 1D rate-of-action tracking unable to distinguish intent | 3D tensor baselines: (principal, action_class, resource_class) |
| Cloud Entitlements (CIEM) | Statement-by-statement text hashing prone to false drift alerts | Canonical DNF policy solver + counterfactual replay analyzer |
| SOAR Automation | Blind script execution risking production outages | Dry-run by default, two-gate authorization, offline IPS/SNIPS learning |
| Data Sovereignty | Raw telemetry forwarded to multi-tenant US/EU cloud backends | 100% on-premises / in-enclave sovereign, post-quantum encrypted |
Stack of 6–10 discrete vendors, disparate databases & APIs
Single-binary Rust implementation (~86k LoC across 337 files)
Manual correlation by SOC analysts across tickets after the fact
16-shard in-memory correlator joins logs, cloud, & identity in <1ms
Absent; alerts fire without causal lineage or root-cause DAG
Pearl g-formula DAG + Dijkstra blast radius attribution
Periodic scanner looking only at static storage containers
Real-time wire classifier + byte lineage across source → sink
1D rate-of-action tracking unable to distinguish intent
3D tensor baselines: (principal, action_class, resource_class)
Statement-by-statement text hashing prone to false drift alerts
Canonical DNF policy solver + counterfactual replay analyzer
Blind script execution risking production outages
Dry-run by default, two-gate authorization, offline IPS/SNIPS learning
Raw telemetry forwarded to multi-tenant US/EU cloud backends
100% on-premises / in-enclave sovereign, post-quantum encrypted
Built for Highly Regulated &
Air-Gapped Environments.
Every event, detection, and remediation decision in Indicis is backed by formal coverage proofs, in-enclave sandboxing, and post-quantum cryptographic verification.
PCI-DSS 4.0
Automated cardholder data tracking, access logging & continuous network segmentation audit.
HIPAA Security
ePHI discovery, patient record byte lineage, and differential-privacy access limits.
SOC 2 Type II
Continuous evidence generation for security, confidentiality, and processing integrity.
MITRE ATT&CK
Formal coverage prover verifies technique defense; embeds full tactic catalogue.
GDPR & Privacy
Purpose registry, automated DSAR orchestration, and tamper-evident deletion ledgers.
PQC Key Vault
Post-quantum Kyber (KEM) & Dilithium signatures protecting agent communications.
Powered by Mentis OS™
Indicis leverages Mentis OS — Genovation's sovereign multi-agent execution kernel. Every detection, attack-path BFS, and SOAR containment action is governed, audited, and cryptographically proven within your air-gapped security perimeter.
Explore the Mentis OS PlatformCoordinated Multi-Agent DAG
Autonomous agents specialize in log parsing, causal inference, DSPM classification, and SOAR execution without resource contention.
JUDGE Audit & Verification
Every automated containment action, remediation suggestion, and detection rule is cryptographically signed and provenance-tracked.
Real-Time Telemetry Tracing
Lock-free observability across the entire ingest pipeline, correlator shards, and storage bus with microsecond accuracy.
Zero-Egress Memory Enclave
Incident embeddings and federated memory utilize DP Laplace noise, preventing sensitive identifier leakage across tenants.
Converged Security.
Zero Tool Seams.
Stop losing critical investigation hours to the seams between SIEM, XDR, and DSPM products. Deploy Indicis inside your sovereign perimeter and run unified detection, causal reasoning, and response.
Single-Binary Rust Runtime
~86,000 lines, 337 files, 138k events/s hot path with lock-free correlator shards.
Causal Attack-Path Reasoning
Rigorous Pearl g-formula DAG attribution and Dijkstra blast-radius computation.
Gated SOAR & Byte Lineage
Dry-run execution by default, policy allowlists, and sensitive byte tracking.
"A single process, one canonical event schema, one identity model, and one intelligence layer."