Your body notices what does not belong and answers in proportion, without a meeting. The Ansvar Immune System does the same for your infrastructure, reasoning over a living map of your systems before it acts.
Your firewall and intrusion sensors already know many attacks by shape. The Immune System reads them as its first line and never needs write access to the systems they guard.
Your existing sensors feed it: a web application firewall, a runtime intrusion detector, flow logs. It reads logs. It never needs write access to the systems it watches.
Every cell in your body carries a marker that says “self”. The Immune System learns the equivalent from your own traffic, then flags what deviates, with no signature needed.
Two kinds of signal. Known-bad patterns from the sensors. Deviation from the normal it learned on your own traffic. Signals from one source fold into one case, so a scan and the exploit that follows it are read together.
Detection and containment exist in most security products. What they lack is a model of what they protect. Living Architecture is the map of your systems, what connects to what, which data sits where, and what may be done to each. Every decision the Immune System makes is read off that map.
The case is read against your map: what sits behind the target, which data it holds, what the containment contract allows for that system. The response comes from a short list, and the smallest one that works wins. The map is governed: every change to it is a proposal a person approves.
A fever is not an amputation. The response comes from a short list, graded by what it touches: block one source for a while, isolate one service, hold until a person releases it. The map says how far it may go for each system, and which systems are never touched.
In the pilot, a named person approves every action. Each action is reversible, leaves a receipt, and holds until someone releases it. Nothing in the pilot acts on its own.
A contained attack becomes a remembered response, proposed to your map's owner like any other change and expiring when the systems it depends on change.
A contained attack becomes a remembered response, proposed to your map's owner like any other change, and it expires when the systems it depends on change. Designed; not yet built.
Your Living Architecture already has a change-control mode: Strict, Balanced or Open. The Immune System reads the same dial. You never set a second one.
On our own lab, real attacks against a real web application were flagged by a real web application firewall. The system isolated the application through a network policy, we confirmed traffic was blocked, and it restored the application afterwards. Every step was recorded and can be replayed.
The pilot runs on a mirror of your key systems that we build and run. The advisor that proposes a response is rule-based. Your baselines are provisional after two weeks. A named person approves every action.
Remembered responses under change control. An investigating agent for novel cases, off the hot path. Responses carried out through your own tools, bound by your team, with the dial arming them.
You describe your systems. We build the map and a mirror of three systems you choose, attack the mirror, and defend it live with you in the room.
Architecture documents, a list of the software you run, two one-hour sessions with the person who owns the systems, and the three systems you care about most. No access of any kind.
Two servers we operate for the pilot only: one holds your documents and your map, the other holds the mirror we attack. Torn down at the end, with the deletion recorded.
Your map, exported to you. A readout of what the attack-and-defend sessions showed. A plan naming which of your tools would replace each stand-in.
Over two weeks. The shape is a proposal and we confirm it with you before we start.
Who approved, what changed, when it was reverted. The record you hand an auditor or a regulator after an incident.
One place to stop every response. Nothing else can override it.
The parts that reason have no open internet. They act only through a short list of approved actions, each bound by your team to a credential you control.
It begins by observing and proposing. Autonomy is widened one response type at a time, and only where its record earns it.
Every response has a known way back, and containment holds until a person releases it.
One conversation about the systems you care about most. We take it from there.
