Cybersecurity Calibration: Design Partner Invitation

Why production calibration matters

KAIROS Cyber is a structural early-warning instrument for defended network zones. Operating alongside existing SIEM, EDR, and XDR pipelines, it continuously weighs incoming attack pressure against remaining defensive control depth per zone. Two analysts replaying the same incident trace arrive at the identical stability reading.

The adapter ships with a v1 synthetic baseline calibrated against public security literature (Verizon DBIR, NIST SP 800-53 and 800-207, CIS Controls v8, OCSF, LANL, and DARPA). The methodology is detailed in our published debrief: Calibrating the Cybersecurity Adapter.

Extending that baseline to production environments requires calibration against live operational traffic across design partner deployments.

Eligible environments

Four defended-zone archetypes map directly to standard enterprise telemetry surfaces:

• Identity plane: Organizations with directory, SSO, and IdP telemetry (Okta, Microsoft Entra ID, Auth0, Active Directory) capturing authentication and privilege-grant events at scale.
• Edge device: Organizations with fleet-wide EDR telemetry (CrowdStrike, SentinelOne, Microsoft Defender) capturing consistent endpoint posture and process events.
• Internal segment: Organizations with east-west network visibility (NetFlow, IPFIX, Zeek, Suricata) monitoring lateral traffic and segmentation enforcement.
• Data plane: Organizations with cloud audit and object-store access logging (AWS CloudTrail, GCP Audit Logs, Azure Activity Logs) covering sensitive data repositories.

Environments with at least 30 days of telemetry depth in one or more zones and an existing SOC triage workflow that distinguishes investigated-clean windows from confirmed incidents match the pilot profile. Financial services, critical infrastructure, healthcare, and cloud-native SaaS operators are the primary cohorts.

Contribution scope

A pilot contribution consists of a 30-to-90-day telemetry window from one or two defended-zone archetypes:

• Redacted zone telemetry: Normalized locally to strip sensitive identifiers before export.
• Window labels: SOC-confirmed classifications on the contributed windows (confirmed-benign, unreviewed, or excluded-known-incident).
• Incident context: Disclosure of known or suspected incidents within the window so baseline distributions are accurately partitioned.
• Aggregate publication rights: Permission to include the anonymized, aggregate calibration statistics (never raw events) in co-authored methodology collateral.

AnankeLabs supplies the local redaction tooling and a round-trip verification harness so partner security teams can validate every export prior to transfer.

Partner deliverables

• Environment-calibrated baseline report: A calibrated policy-positive rate per zone per hour measured against the partner’s operational traffic, with confidence intervals per zone archetype.
• Zone headroom profile: A structural breakdown showing which defended zones run high on attack pressure and which maintain deep control margin under a deterministic policy floor.
• Right-to-recall: If a previously undetected incident is later discovered inside a contributed window, the calibration cohort is re-run and any published aggregate is updated accordingly.
• Co-authorship credit: Optional co-authorship recognition on resulting calibration research.
• Priority adapter access: Early access to KAIROS Cyber releases ahead of general availability.

Data protection and confidentiality

• Mutual NDA: Executed prior to sharing any technical specifications, tooling, or sample exports.
• Local redaction: Raw events, IP addresses, hostnames, usernames, and credentials never leave the partner environment in identifiable form.
• Aggregate-only reporting: Published findings report statistical rates and confidence intervals only.
• Pre-release review: Partner teams review and approve any external output prior to publication.
• NDA specification package: The complete data specification, normalization profiles, redaction rules, labeling guide, and replay verification harness are delivered under mutual NDA before any telemetry exchange begins.

Scope a pilot

Engineering and security operations teams operating across any of the four zone archetypes can initiate a pilot review via the contact page. Upon initial scoping, AnankeLabs provides the draft mutual NDA, the complete partner data specification, and the local redaction and verification harness.