Aegis Pivot: Graph AI Powered Detection of SSH Lateral Movement

Imagine you leave for vacation and someone breaks into your house. But instead of grabbing everything and running, they move in. They sleep in you rooms. They copy your keys. They learn your schedule. And by the time you notice anything is wrong, they've already taken everything that matters. That's exactly what happens when a company gets hacked today.

Attackers don't just break-in, steal and runaway.  They move quietly through the network — from one computer to another — until they reach your customer data. Your financial records. Your intellectual property.

Most security tools treat each alert as an isolated event. On average, companies don't even realize this is happening.  According to IBM's 2024 Cost of a Data Breach Report, organizations take an average of 168 days to identify and 51 days to contain a breach significant period of time - 6+ months! with an average breach costs in millions

We built AEGIS Pivot to catch that silent movement — before it reaches anything critical.

Our system watches your cloud network in real time. Every connection, every login, every hop between machines. When something looks like an attacker moving through your system, we flag it — and we alert your security team — in under 30 minutes, not 194 days.

We model your network as a graph — a map of how machines talked to each other — and we look for the pattern of movement, not just individual suspicious moments. Our model produces a 3.7 times score separation between normal traffic and attack windows — meaning it genuinely sees the difference, it's not guessing.

We've tested it against real attack scenarios on live AWS infrastructure — analyzing 1.56 million VPC flow records and reconstructing & tracing attacker paths up to 5 hops deep.

Our model achieves an F1 score of 0.868 with 100% target IP detection rate. That last number is the one your security team cares about — when we flag something, we're right. Almost zero wasted analyst time chasing noise.

Cloud security market is a $45 billion industry and every company running on the cloud is susceptible to this problem.

We have the technology, proven results, and a working MVP. Already operating on AWS, we're now ready to scale — what we need is the momentum to onboard customers and expand to additional cloud platforms.