Kyberen watches your servers, workstations and network, turns what matters into clear cases, and uses AI to sort them, while a person stays in charge of every important decision.
The dashboard, as it runs today. Demo data.
No pile of raw logs to read. Kyberen does the sorting and shows you what happened, in plain terms.
Each case tells you which machine, what ran, and what the system already did about it. Here, a remote shell opened a connection out of the company, then created a hidden administrator account.
You read the story, not the logs.
The AI proposes a verdict for every case, with how sure it is. The least certain ones come first, so your time goes where it matters.
When you correct it, it learns from you. It never closes a critical case on its own.
An administrator sets how much the AI may do on its own, and can switch it back to supervised mode with one click.
Detection, AI triage and access control, recorded on the working product.
Recorded on the pre-release build, under the working name Mini SOAR. Showcase parts use demo data only.
Founder
Small companies face the same attacks as large ones, without a team to watch for them. I'm building the tool I wanted for them: one that does the watching and explains itself, while a person keeps the final word.
Final-year engineering student at Epitech Paris, entrepreneurship certificate at ESCP Business School, and IT security assistant in a French SME.
Free during the pilot. In exchange, we ask for honest feedback.
auditd, Windows EVTX, syslog, PCAP, Snort, CSV, Elastic/ECS, mail.
Sigma-style rules, MITRE ATT&CK mapping, process lineage, automated response playbooks.
Deterministic classifier, admin-set autonomy ceiling, severity floor on auto-close, kill switch, human-validated training only.
Role-based access, TOTP and WebAuthn/FIDO2, four-eyes approval, authenticated encryption at rest, verified backups, hash-locked dependencies.
Runs on your own server or workstation. Web interface, plus a desktop app.
JSON exports today; OCSF export planned.
Watch what AI agents do inside a company: tool calls, injection attempts, data leaving. Mapped to OWASP LLM Top 10 and MITRE ATLAS.
Crypto-agility, hybrid ML-KEM once the stack supports it, and an inventory of the cryptography found on your network.
One attack, one incident: related cases linked by machine, time and process.
Reports for NIS2 and ISO/IEC 27001 logging and incident controls.