Behavior-Native XDR

Understand the Behavior Behind the Threat.

DNA Cybertech Solutions, a Canadian company, builds behavior-native XDR: it structures fragmented security telemetry into behaviors your team can investigate directly—explainable, traceable back to their evidence, and honest about what was never observed.

See a behavior record Request a pilot
Read the research →
The behavior pipeline, compact The five pipeline stages as a compact labelled rail, sized for the hero's fixed-width visual column. The behavior stage is emphasised because it is the layer we add. Full descriptions of each stage appear beneath, in the how-it-works section. Telemetry Behavior Detection Investigation Response
Pipeline, vertical The same five pipeline stages stacked vertically for narrow viewports, connected by a rail on the left, with the behavior stage emphasised. Telemetry endpoint, Kubernetes, AI agents Behavior structured, typed, evidence-aware Detection rules, models, correlation Investigation cause, effect, relationships Response decided from clear evidence
representation layerBuilt before detection.

The problem

Security teams don’t have a data problem. They have an understanding problem.

Endpoint, network, identity, cloud and detection tools already produce enormous amounts of evidence. The harder work begins afterward: reconstructing what actually happened across fragmented signals.

More telemetry. More detections. More alerts.

Not automatically more understanding.

Our approach

Behavior, not the alert, is where investigation should start.

We add a dedicated behavior layer between telemetry and every system that needs to reason over it. [architecture]

01 / Architecture

One representation.
Many consumers.

Detection, hunting, correlation, investigation and response all read the same structured behavior instead of rebuilding it independently.

Follow the pipeline
Architecture overview Seven telemetry sources on the left feed a single emphasised behavior layer in the centre, which in turn feeds six consumers on the right: detection, hunting, correlation, investigation, AI agents and response. Endpoint, Kubernetes and AI agent sources are drawn solid because they are supported today; network, identity, cloud and email are drawn dashed because they are not supported yet. The point of the drawing is that no consumer owns the representation. One behavior layer, many consumers Endpoint Kubernetes AI agent Network Identity Cloud Email Behavior layer structured / typed evidence-aware Detection Hunting Correlation Investigation AI agents Response Each consumer reasons over the same representation, so none of them owns it. Solid sources are supported today; dashed sources are not supported yet.
Architecture overview, stacked The same architecture as architecture-overview.svg — seven telemetry sources (endpoint, Kubernetes and AI agent solid; network, identity, cloud and email dashed as not supported yet), one behavior layer, six consumers — stacked vertically for narrow viewports: sources on top feeding down into the behavior layer, which feeds down into the consumers below it. One behavior layer, many consumers Endpoint Kubernetes AI agent Network Identity Cloud Email Behavior layer structured / typed evidence-aware Detection Hunting Correlation Investigation AI agents Response Each consumer reasons over the same representation, so none of them owns it. Dashed sources are not supported yet.
This is where behavior is represented. [architecture]

How it works

From signal to understanding, in five stages.

01

Telemetry

Activity from Linux and Windows endpoints, Kubernetes and AI agents, next to the tools already in your environment.

[architecture]
02

Behavior

Events become typed behaviors before a detection decision is made.

[architecture]
03

Detection

Rules, analytics and correlation reason over the same structured object.

[architecture]
04

Investigation

Context, effects, relationships and evidence arrive connected.

[design intent]
05

Response

Decisions retain what supported them and where visibility ended.

[design intent]

Inside a behavior

Every behavior answers the questions an analyst actually asks.

FACE-EO provides a six-dimension representation in plain language—including the question most systems leave implicit: how certain are we? [research] [schema]

The six questions a behavior answers Six stacked rows, each a plain-language question: who or what acted, what it can do, what it did, what changed immediately, what remained afterward, and how certain we are. The sixth row is drawn dashed and hatched because it represents what was not observed. Every behavior answers six questions 1 Who or what acted? execution context 2 What can it do? functional profile 3 What did it do? actions 4 What changed immediately? immediate effects 5 What remained afterward? persistent effects 6 How certain are we? observability The sixth question is the one most systems never ask.
The six questions a behavior answers, compact The same six-question model as face-eo-model.svg, narrowed for phone-width viewports so headings and tags keep a legible size instead of shrinking with the card. The sixth row remains dashed and hatched because it represents what was not observed. Every behavior answers six questions 1 Who or what acted? execution context 2 What can it do? functional profile 3 What did it do? actions 4 What changed immediately? immediate effects 5 What remained afterward? persistent effects 6 How certain are we? observability The sixth question is the one most systems never ask.
The sixth question records what was observed, inferred, or never visible.
02 / Representation

Context and uncertainty live in the record—not in an analyst’s memory.

Behaviors carry their actor, capabilities, actions, immediate effects, persistent effects and observability. Parent-child composition and shared resources remain part of the representation.

observedinferrednot observed

One complete record

Judge the representation yourself.

One scheduled-task persistence behavior, including identifiers, evidence count and a telemetry gap. The dashed row is not decoration—it states where the record’s visibility ends.

DirectObserved evidence
DerivedExplicit inference
AbsentDeclared coverage gap
A behavior record A single behavior record card. A persistence behavior with its identifier, actor, host, user and first observation time in monospace fields, its effect, its supporting evidence count, and a dashed hatched region declaring a period where no endpoint telemetry was available. Persistence Scheduled task created behavior_id bhv_8f2c41a9 type Persistence actor powershell.exe host FINANCE-WS-042 user j.smith first_observed 10:42:18Z effect Execution configured for user logon evidence 6 events / 2 sensors / 1 rule not observed no endpoint telemetry 10:42:31 - 10:44:02
A behavior record, compact The same behavior record as behavior-card.svg, narrowed for phone-width viewports so its monospace field values keep a legible size instead of shrinking with the card. Persistence Scheduled task created behavior_id bhv_8f2c41a9 type Persistence actor powershell.exe host FINANCE-WS-042 user j.smith first_observed 10:42:18Z effect Execution configured for user logon evidence 6 events / 2 sensors / 1 rule not observed no endpoint telemetry 10:42:31 - 10:44:02
A complete behavior record with its blind spot left visible. [schema]

Trust

Three different questions. Three different answers.

The trust triad Three equal panels separated by hairline rules: explainability answers why the system believes something, traceability answers where that belief came from, and observability answers what was seen, inferred or never seen. They are presented as equals, not as a hierarchy. by structure Explainability Why does the platform believe this? Evidence is structured before the explanation is written. of security reasoning Traceability Show me exactly where that belief came from. Every conclusion walks back to the behavior and evidence beneath it. evidence-aware Observability What was seen, inferred, or never seen at all? Absence is represented, not silently omitted. Three different questions. Three different answers. A platform can pass one and fail the others.
The trust triad, stacked The same three trust panels as trust-triad.svg — explainability, traceability, observability — stacked vertically for narrow viewports and separated by hairline rules instead of a side-by-side layout. They remain presented as equals, not as a hierarchy. by structure Explainability Why does the platform believe this? Evidence is structured before the explanation is written. of security reasoning Traceability Show me exactly where that belief came from. Every conclusion walks back to the behavior and evidence beneath it. evidence-aware Observability What was seen, inferred, or never seen at all? Absence is represented, not silently omitted. Three different questions. Three different answers.
01 / Why

Explainability by structure

The explanation is not generated after the decision. Context, actions, effects and evidence are part of the behavior itself.

[architecture]
02 / Where

Security reasoning traceability

Walk from telemetry to response, then back again. Every conclusion stays connected to the behavior and evidence beneath it.

[architecture]
03 / What

Evidence-aware observability

See what was directly observed, what was inferred, and where telemetry simply did not exist.

[schema]
The traceability chain Six linked stages from telemetry through evidence, behavior, detection and decision to response. Solid arrows above the chain run forward showing how a conclusion was built; dashed arrows below run backward, each carrying the question that step answers when the chain is walked in reverse. Security reasoning traceability — walkable in both directions Telemetry from which signal? Evidence supporting what? Behavior supporting which call? Detection leading to what? Decision justifying what? Response forward: how the conclusion was built reverse: show me where that belief came from — this is not an audit log
The traceability chain, stacked The same six linked stages as traceability-chain.svg — telemetry, evidence, behavior, detection, decision, response — stacked vertically for narrow viewports. Solid forward arrows run down the left edge; dashed reverse arrows run up the right edge, each carrying the question that step answers in reverse. Traceable in both directions Telemetry from which signal? Evidence supporting what? Behavior supporting which call? Detection leading to what? Decision justifying what? Response forward ↓ left · reverse ↑ right — not an audit log
Security reasoning remains walkable in both directions.
Forward / construction

Raw observations retain source, sensor and time identity.

Reverse / verification

Which original events were available?

Evidence state legend, stacked The same five evidence-state swatches as observability-legend.svg, laid out one row per state with the description beneath its swatch instead of beside it, sized for narrow viewports without shrinking below a legible size. No state uses red. Evidence states Observed seen directly in telemetry Partially observed some evidence, incomplete Inferred derived, not directly seen Not observed known gap in coverage Telemetry gap sensor silent for a period Severity is carried by evidence and labels, not by alarm color.
Evidence states differ by form, not only by color.

Built for security teams

One behavior layer.
Different operating questions.

01 / SOC analyst

Open a behavior, not a pile of logs.

Execution context, actions, effects and supporting evidence are already connected. Every element stays traceable to its source telemetry.

[design intent]

Research-driven

Behavior isn’t a feature we added. It’s the architecture we started from.

Our behavior model is grounded in FACE-EO, a representation for security behavior implemented as a dedicated layer between telemetry and downstream detection.

Explore the research foundation

What we can show—and what remains unmeasured

Evidence awareness, applied to us.

Demonstrable today

  • A dedicated behavior layer before detection [architecture]
  • A documented six-dimension representation [schema]
  • Observed, inferred and not-observed states in the record [schema]

Not yet measured

Behavior Investigation Pilot

Help us measure it on your telemetry.

30–45 days, up to 100 endpoints, 10–20 representative investigation scenarios. We measure time to first understanding, pivots, queries and raw events inspected, root-cause identification and unresolved telemetry gaps, then publish the method with the results.

Request a pilot
DNA Cybertech Solutions The DNA Cybertech Solutions lockup: the DNA wordmark with the CYBERTECH SOLUTIONS descriptor beneath it, beside a network mark of five square nodes joined to a central hub.

About DNA Cybertech Solutions

Research becomes product. Production becomes research.

DNA Cybertech Solutions researches how security activity can be represented so humans and machines can reason over it more effectively. Our platform is that work turned into an operational product.

Direct answers

Questions worth asking before a demo.

Why do we need another security platform?

You may not need another source of alerts. We add a behavioral representation layer above the telemetry and tools you already run, so existing evidence becomes easier to investigate and defend.

Do I have to replace my EDR or SIEM?

No. Our platform runs next to the EDR and SIEM tools you already operate and adds a behavioral representation layer above their evidence. Today it supports Linux and Windows endpoints, Kubernetes and AI agents as telemetry sources.

Is this the same as event correlation?

Correlation answers which events may belong together. Behavioral representation carries what that combined activity means: who acted, what changed, what persisted, what supports the conclusion, and what was never visible.

Is traceability just audit logging?

No. An audit log records activity inside a tool. Security reasoning traceability records how a security conclusion was formed—from telemetry and evidence through behavior, detection, decision and response.

Does observability mean infrastructure monitoring?

No. Here, observability is evidence awareness inside a security record: what was observed directly, what was inferred, and where sensor coverage was absent.

Why not just send everything to an LLM?

Language models reason well, but reasoning depends on context quality. Security telemetry is noisy, fragmented and partially observed. We structure activity into behaviors first, so a human or an AI system reasons over context, actions, effects and evidence status instead of raw events.

How is this different from EDR process trees or attack stories?

Process trees and attack stories are valuable for lineage and correlation. We represent each behavior as an explicit record (who acted, what it could do, what it did, what changed, what remained, and how certain we are) that detection, hunting and investigation can all reuse.

See the structure

See what an investigation looks like when behavior comes first.

In a pilot, we take your telemetry and show one behavior you can open, question, trace back to its evidence, and see where that evidence runs out.

Request a demo Read the behavior model