Our mission
From reactive, manual malware analysis to defence you can prove.
Security teams should not have to choose between speed and understanding. AETHER automates the slow parts of malware triage (carving, classification, ATT&CK mapping, attribution) and shows its working at every step, so an analyst, an auditor or a customer can follow how each conclusion was reached.
Technology philosophy
Proactive, transparent, efficient
Sustainable compute
Small, specialised models instead of one giant one. The Qwen3-4B ATT&CK mapper was fine-tuned with QLoRA (rank 32 adapters on a 4-bit base, 66 M trainable parameters) on one RTX 5070 in 8 h 24 min, and runs on CPU through llama.cpp. A GPU is optional.
Data stays yours
No telemetry. Samples are analysed in memory and never written to disk by the pipeline. External services (an LLM, OSINT reputation) run only if your organization has consented, and an air-gapped mode cuts all outbound access.
Every verdict is auditable
Each verdict lists the signals that produced it; Deep mode adds SHAP and LIME attributions. Technique mappings cite their evidence, and administrative actions are recorded in an append-only audit log.
Tenants are isolated by design
Each organization’s data is separated at the database layer with row-level security, its analysis queue is fair-shared, and its sensors sign every delivery.
See it on your own traffic
Start with a cloud tenant, or talk to us about on-premises.