NorthQuinn is a cybersecurity technology company. Our flagship platform, AVERY, is behavioral threat intelligence for enterprise security teams, designed to raise a finding only when several independent signals agree. It is in active development, and we are recruiting five founding teammates to build it.
Signature tools ask whether an event matches something already known to be bad. AVERY is designed to ask a different question: is this host, identity, or channel behaving differently from its own history?
AVERY is designed to work from telemetry your environment already produces, through read-only connections, and every finding is designed to arrive with the evidence behind it and the ATT&CK technique it suggests. The baselining and scoring are designed to run without an analyst writing a rule for each new pattern. People decide what to do about a finding.
AVERY is not yet generally available. Its detection engine and enrichment pipeline are in active development, and the approach behind them is being built and tested against public, labeled network datasets.
Designed for enterprise SOC teams, government and intelligence-community environments, and the defense industrial base. Who it’s for
NorthQuinn is an early-stage company with a working thesis, published research, and a platform in development for enterprise security teams, on the path to federal, intelligence-community, and defense organizations. We are recruiting five founding teammates, each owning one part of the company from the beginning.
Roles, commitment, and terms are worked out directly with the people who fit, not through a job listing.
Founded by Angel Gonzalez Gines, Founder & CEO and architect of AVERY. Incorporated in Delaware, 2026.
Experience with federal, intelligence-community, or defense environments is valued in every seat.
We are looking for a small number of security teams to help shape AVERY while it is being built: organizations that face patient, well-resourced adversaries and want detection designed for them.
What a design partnership involves, and how any data is handled, is agreed with each organization in writing before anything starts.
Become a design partnerChoose “Design Partnership” on the contact form.
We publish the research behind AVERY’s approach, release tools that implement parts of it, and say plainly where each method does not work. Corrections are published with a revision note.
A ten-day study of attacks against an internet-facing honeypot with an industrial control system persona (NQ-TIR-2026-001), and a multi-signal method for separating command-and-control beacons from benign periodic traffic (NQ-DER-2026-001). Both were corrected in October 2026.
Read the researchAnalysis tools that implement parts of the approach are released as open source, with tests and documentation that states what each tool does not do.
See the toolsAVERY’s approach is being built and tested against public, labeled network datasets, and the interactive demonstration shows the method step by step on fully synthetic scenarios.
Launch the demoWalk through two synthetic intrusions, a patient C2 beacon and a valid-credential misuse, and one ordinary week. Watch a signature view and a behavioral view read the same moments. In the beacon scenario, one view flags the intrusion on Day 4; the other first alerts on Day 31. In the ordinary week, nothing crosses the line.
Launch the Demo“Most organizations are compromised before they know it. Incident responders still measure median dwell time in weeks, and the median hides the long tail, where the most patient adversaries live. AVERY was built around one assumption: the adversary is already inside, and the mission is finding them before they find what they came for.”
Alongside building AVERY, NorthQuinn offers security engagements in the same areas the platform is designed for: hunting, detection, forensics, and security operations. Each one is scoped directly with the organization.
Request an AVERY briefing, apply for one of the five founding seats, become a design partner, or propose a research collaboration. Tell us what you are working on. Questions about a security engagement start here too.