v3.0 Hypothesis Engine is live

Predict the attacker's
next move.

The world runs on data, and it is used to improve our decisions. Attackers know this. So do we. SecureMinds turns defensive telemetry into tested hypotheses, and tested hypotheses into configuration your team can ship the same afternoon.

4.2B events / day
1,900+ hypotheses / week
11 days lead time
hypothesis-engine ยท prod live
Ranked hypotheses Confidence
crit Pivot to ADFS token signing after MFA fatigue 0.94
high Stage payload in %LOCALAPPDATA% via signed helper 0.88
med Enumerate shares over SMB2 before lateral hop 0.71
low Beacon egress on 443 with jittered sleep 0.42
Model agreement 92%
Lead time
11d +3d
Shipped configs
318 +24
# emitted 04:12 UTC, ready to ship
rule  adfs_signing_cert_export
sev   critical
via   edr,sysmon,entra
fp    0.3% (90d replay)

The platform

We conduct data experiments that may or may not seriously break the universe.

Kidding. Mostly. Here is what actually happens.

01 / COLLECT

Telemetry, sanitized

We ingest defensive telemetry from every layer a defender already owns, strip it of anything that identifies your estate, and normalize it into a single schema. Nothing leaves the enclave in a form that maps back to you.

02 / HYPOTHESIZE

Experiments, not opinions

Sanitized data is experimented on using AI-generated hypotheses that attempt to predict the attacker's next move. Every hypothesis is scored, replayed against held-out history, and then either survives or is thrown away.

03 / SHIP

Configs, not PDFs

Hypotheses that clear our statistical bar are turned into actionable configuration that defenders can implement immediately. Detection logic, hardening baselines, policy. No slideware, no forty-page appendix.

4.2B

Events processed each day

1,900+

Hypotheses tested per week

11d

Median lead time on a new technique

0.3%

False positive rate at ship time

Approach

Hacking is the very nature of science.

Form a hypothesis. Try to kill it. Publish what survives. We run defense the same way a lab runs a study, because guessing is not a methodology.

Falsifiable or it does not ship

Every hypothesis states what would prove it wrong before it is ever tested.

Replayed against held-out history

Ninety days of data the model has never seen decides whether it survives.

Measured where it lands

We track the false positive rate in your environment, not in our demo tenant.

Careers

Get shady with science.

Hacking is the very nature of science. Think you have what it takes? Drop us a line and introduce yourself. We read everything, and we answer the interesting ones first.

Detection Engineer Data Scientist, Adversary Modelling Threat Researcher Platform / Pipeline Founding Designer

Contact

Questions or comments?

We have not made our big splash yet, but it is coming soon. In the meantime we would love to hear from you.

We reply from a real person, usually within two business days.