Behavioral threat intelligence for enterprise security teams. AVERY is designed to sit on top of the SOC and EDR stack you already run and surface the patient adversary that signatures miss. No black boxes.
Most security tools are built to catch what's already been seen. AVERY is built around the assumption that sophisticated adversaries are already inside your network, patient, deliberate, and specifically designed to evade signature-based detection.
AVERY is designed to surface high-fidelity findings with the context your analysts need to act, not a queue of alerts to filter through.
AVERY is not yet generally available. This is where each part of it stands today.
Read-only connections to telemetry you already run: network metadata such as Zeek or flow logs, authentication logs, and host or EDR events. Nothing sits inline in your traffic, and AVERY takes no response actions.
NorthQuinn sensors for network segments that produce no usable telemetry. Each sensor is designed to authenticate to AVERY’s intake before its events are accepted.
In your environment, in your cloud or on-premises, so telemetry and findings stay under your control.
None of these deployment options is generally available today. Design partners help decide which comes first.
Signature tools ask whether an event matches something already known to be bad. AVERY is designed to ask a different question: is this host, identity, or channel behaving differently from its own history?
AVERY is designed to build a behavioral baseline for each entity from telemetry your environment already produces: network metadata, authentication events, and host activity, read through read-only connections.
Timing regularity, first-seen relationships, protocol and TLS characteristics, data symmetry, and access scope are each designed to be scored on their own. A single odd event is common and rarely worth an analyst’s time.
A finding is designed to be raised only when several independent signals point the same way, and it arrives with the evidence for each one and the ATT&CK technique it suggests. Signals that are never corroborated fade back into the baseline.
Automated, for AVERY, means the baselining and scoring are designed to run without an analyst writing a rule for each new pattern. People still decide what to do about a finding.
Limits. AVERY can only judge what its telemetry shows. Some covert channels, such as DNS tunneling, need dedicated analysis, and our published research describes where these methods work and where they don’t.
See the approach step by step in the interactive demonstration (synthetic data)
Detection logic designed to surface implant callbacks that blend into normal traffic, including low-volume and irregular communication patterns across multiple protocols.
Correlation of network activity and host telemetry to reconstruct attacker movement across the environment, identifying the full campaign scope rather than isolated events.
Detection coverage across DNS traffic for covert channel abuse. DNS is one of the most frequently abused covert channels and one of the least inspected.
Process monitoring, privilege escalation detection, and persistence mechanism identification through host telemetry correlated against network activity across the kill chain.
Threat intelligence feeds correlated against your traffic as it arrives. Known malicious infrastructure, file hashes, and behavioral indicators matched against session data with actor attribution where available.
Detection logic built around how adversaries actually operate, not around specific tool signatures that change with every campaign. Coverage that persists across toolset changes and campaign evolution.
AVERY’s detection scope is designed to span the kill chain. Specific detection methodology is shared under NDA in technical walkthroughs with qualified organizations. We do not publish our tradecraft.
Request a Technical WalkthroughEvery finding is designed to arrive documented, explained, and tied to a specific adversary technique. Your team knows what fired, why it fired, and what to do, not just that an alert number incremented.
Detection logic is designed around how adversaries actually operate: techniques modeled on documented real-world attack patterns and mapped to MITRE ATT&CK, not compliance checklists or vendor default rules.
AVERY is designed to run in your environment, in your cloud or on-premises, with no third-party egress. Your telemetry and findings stay under your control, and the platform is built on open-source components rather than proprietary collection.
AVERY is designed to work from telemetry your environment already produces, through read-only connections. It sits alongside your existing stack rather than replacing it or sitting inline in your traffic.
SOC teams drowning in alerts need a platform that performs genuine triage. AVERY is designed to reduce analyst workload by surfacing only high-fidelity findings with the context needed to act, not a queue to filter through.
Environments facing nation-state threat actors require detection capabilities designed to match that adversary level. AVERY was built with APT-grade threats as the design target, not a feature added after the fact.
Defense contractors hold the designs, data, and network access that nation-state actors target, under contractual security obligations. Patient, persistent access campaigns are exactly the threat AVERY is designed for.
After a breach, the priority is establishing what happened and ensuring the adversary is no longer present. NorthQuinn’s forensics work reconstructs the timeline; AVERY is designed to keep watching afterward, so a returning adversary stands out against the rebuilt baseline.
We’ll walk you through the approach and a detection scenario relevant to your environment and threat model, under NDA.
Request a Briefing