Cyber defence for networks that can never phone home.
Sovereign and classified environments cannot ship telemetry to someone else's cloud. QCore builds AI-native detection, response, and intelligence platforms that run entirely on your premises — analytics that explain every verdict, over channels engineered to keep today's traffic sealed for decades.
- [ FULLY ON-PREMISES ]
- [ AI-NATIVE ANALYTICS ]
- [ ZERO PHONE-HOME ]
Krypten AI-NATIVE XDR / SIEM
Krypten watches endpoints, network flows, and software supply chains with detection logic that maps to MITRE ATT&CK and explains every score it produces. Underneath, every hop — agent to manager to dashboard — runs over a mutually authenticated channel with forward secrecy — engineered so that a recorded wire yields nothing.
Built-in detection engine
Brute force, privilege escalation, and reverse-shell rules out of the box — each mapped to MITRE ATT&CK techniques and fed into per-asset risk scoring.
NetFlow analytics
Behavioural detectors flag port scans, host sweeps, beaconing, and exfiltration patterns from flow data alone — no packet capture appliance required.
SBOM scanning
Ingest CycloneDX and SPDX inventories; match components against CVE data and the CISA Known Exploited Vulnerabilities catalogue.
Command-palette triage
Analysts pivot from alert to asset to timeline with keystrokes, not menus. Risk scores explain themselves — every number traces to evidence.
Open interfaces
OpenAPI 3.1 surface, Prometheus metrics, webhook fan-out to Slack, Teams, PagerDuty, Opsgenie, and email, plus a scriptable operator CLI.
178-assertion test suite
Every release passes an end-to-end suite of 178 assertions covering agents, channels, detections, and APIs. We publish the number because we run it.
- [ X25519 KEY EXCHANGE ]
- [ FORWARD SECRECY ]
- [ HKDF-SHA256 · TRANSCRIPT-BOUND ]
- [ CHACHA20-POLY1305 ]
- [ SIGNED ALERTS ]
Research inside: ATT&CK graph analytics
Krypten's research layer builds a multiplex graph over the MITRE ATT&CK STIX corpus — community detection, centrality analysis, and attack-path extraction from initial access to impact. Analysts see not just what a technique is, but where it leads. Like everything we ship, it runs air-gapped.
Prahari AIR-GAPPED ENDPOINT PROTECTION & UNIFIED ENDPOINT MANAGEMENT
Cloud-managed endpoint security is a contradiction on an isolated network. Prahari is endpoint protection and unified endpoint management for air-gapped and classified networks, built around one defining constraint: zero external dependency at runtime. No cloud console. No telemetry. No phone-home. No licence-activation service. No CDN behind the UI.
Centralised anti-malware
Signature and behavioural protection administered from your own console, on your own network, with content that never leaves it.
Patch & vulnerability management
Assess, stage, and roll out patches across the estate — with vulnerability posture tracked entirely inside the enclave.
IT asset management
Hardware and software inventory for every managed endpoint, so the isolated network is also the well-understood one.
Device & application control
USB and peripheral policy, application allow-listing, and configuration lockdown enforced at the endpoint.
CIS benchmark compliance
Continuous measurement of endpoints against CIS benchmarks, with drift surfaced before an audit finds it.
Signed offline updates
Content arrives over controlled media or one-way gateways and is cryptographically verified twice — at intake, and again at every endpoint before it applies.
The zero-dependency ledger
"Air-gap ready" claims deserve an itemised audit. Here is Prahari's, dependency by dependency.
- Cloud console
- None. The management console is a single on-premises installation; every function above runs from it.
- Telemetry / phone-home
- None. No diagnostic, usage, or licensing traffic leaves the network — there is no outbound code path to disable, because none exists.
- Licence activation
- Entitlement is validated against a signed file with an embedded public key. Nothing needs to be reachable — not at install, not at renewal, not ever.
- UI assets
- Served entirely by the console. No CDN, no external font, no third-party script — the browser talks to one host on your network.
- Content updates
- Signed bundles over controlled media or one-way gateways, verified at intake and verified again at each endpoint before load.
DRISHTI AI OSINT & SOCIAL-MEDIA INTELLIGENCE PLATFORM
Open-source intelligence is only as good as its custody. Built for law-enforcement and investigation teams, DRISHTI collects lawfully, enriches entirely in-house, and preserves everything to an evidentiary standard — so what an analyst finds on Monday can stand up in a legal proceeding months later.
Authorisation-gated collection
Multi-source collectors — social platforms, forums, code platforms, RSS, paste sites, CVE and threat feeds — each gated by an authorisation register. No source runs without a recorded lawful basis.
In-house AI enrichment
Named-entity recognition and multilingual sentiment — including Indian languages — run fully in-house. No third-party API ever touches the data path.
IOC extraction
IPs, URLs, emails, hashes, CVEs, and wallet addresses extracted with defang handling, ready to pivot into Krypten or your existing tooling.
Identity correlation
Cross-platform identity correlation with explicit confidence grading — the platform tells you how sure it is, and why.
Explainable threat scoring
Threat scores with explainable AI, plus an entity and IOC link-analysis graph and a live dashboard for the watch floor.
Evidentiary preservation
SHA-256 anchored artefacts and a chain-of-custody design suitable for legal proceedings. Full data residency; deploys as a pre-staged on-premises appliance.
PARAKH SECURITY ASSESSMENT WORKFLOW & REPORTING PLATFORM
Findings scattered across spreadsheets do not get fixed. PARAKH runs the whole assessment engagement — scope to retest — in one place, with every finding tied to evidence, an owner, and a verifiable close.
Engagement & scope management
Engagements, scope, and rules of engagement managed end to end — multi-tenant, with role-based access control and a full audit log behind every action.
Findings register with evidence
Every finding carries its evidence — captures, requests, artefacts — in a structured register, not a screenshot folder.
CVSS 3.1 / 4.0 scoring
Standardised severity scoring and risk rating on every finding, so prioritisation is an argument about facts, not adjectives.
Remediation & retest tracking
Findings are assigned, fixed, and retested — with before/after status recorded, so "closed" always means "verified closed".
Three-audience reporting
Executive, technical, and compliance-mapped reports generated from the same findings data — one source of truth, three readerships.
API-driven ingestion
Scan engines feed PARAKH over its API: web application / DAST results, configuration and CIS-benchmark hardening reviews, and network vulnerability assessments.
SUGAM WEB COMPLIANCE & ACCESSIBILITY SUITE
Public-sector and enterprise web estates are judged page by page. SUGAM checks them that way — accessibility and the mandatory elements Indian government websites require — and keeps checking after the fixes land.
Automated WCAG 2.1 AA checks
Accessibility conformance checked automatically across every page — structure, contrast, alternatives, navigation.
GIGW 3.0 mandatory elements
The checks Indian government websites must pass: required policies, metadata, sitemap presence, and language support.
Manual-review workflow
Automated results route into a structured human review — because some conformance judgements need eyes, and those judgements need a record.
Gap reports & re-validation
Clear gap reports for the web team, then automated re-validation to confirm the gaps actually closed.
Portfolio view
Compliance posture across many sites on one screen — for the department that owns fifty websites, not one.
Compliance certificates
Certificate generation for sites that pass — evidence-backed, dated, and regenerable at the next audit.
Assessment & audit services
Hands-on security assessment by the team that builds the tooling — every engagement scoped, evidenced, retested, and reported through PARAKH.
Vulnerability assessment & penetration testing
Structured VAPT with evidence-backed findings and verified closure.
Infrastructure security audit
Network, server, and platform posture reviewed against measurable baselines.
Secure configuration review
Hardening reviews mapped to CIS benchmarks, with drift called out precisely.
Web application security testing
Application testing aligned with OWASP methodology, reported for three audiences.
Questions we actually get asked
What secures the channel between agent and manager?
Hybrid key establishment with forward secrecy: an X25519 ephemeral exchange feeds an HKDF-SHA256 key schedule bound to the handshake transcript, and every frame is protected with ChaCha20-Poly1305 authenticated encryption. Compromise a long-term key tomorrow and yesterday's traffic stays sealed — forward secrecy is the point.
What does "fully on-premises" mean, precisely?
No cloud dependency of any kind. Krypten and Prahari install, license, update, detect, and alert without a single outbound connection. Updates for air-gapped estates travel as signed content over controlled media or one-way gateways and are verified twice: once at the intake point, once at each endpoint.
Why is every alert digitally signed?
An alert that can be forged is worse than no alert. Every alert carries a digital signature, so the dashboard — and any downstream system — can verify that it genuinely came from the manager, unaltered. Integrity is a property of the alert itself, not of the pipe it travelled.
How does DRISHTI stay on the right side of the law?
Structurally, not procedurally. Every collector is gated by an authorisation register: a source without a recorded lawful basis simply does not run. All artefacts are SHA-256 anchored on ingestion, and the chain-of-custody design assumes the output may one day be examined in court.
Can we verify the engineering claims?
Yes — that is the point of making them specific. The 178-assertion end-to-end suite runs during evaluation on your infrastructure, and the cryptographic parameters above are exact, not aspirational. Request an evaluation and bring your own packet capture tools.
Put Krypten on your wire.
An evaluation deployment runs on your hardware, inside your perimeter, against your traffic. We bring the software; you keep the data.