ESET has unveiled NeoCortex, its own AI model trained specifically on security data. The model supports LiveCortex, the analysis engine within the ESET PROTECT Platform. According to the company’s internal research, training costs are 200 times lower than those of large, general-purpose AI models.
NeoCortex is built on what is known as a world model architecture, which ESET explains in a technical blog on NeoCortex. Drawing on historical security incidents, the model learns how digital environments behave and how individual events relate to one another. To this end, LiveCortex collects signals from workstations, cloud environments and applications, such as an anomalous login attempt or an unusual network connection, which may appear harmless in isolation.
Reconstruction and prediction
According to ESET, NeoCortex can use these combined signals to reconstruct missing information and predict attackers’ possible next steps. The company calls this approach ‘minus-one-day defense’. Its aim is to neutralise a threat before an attack reaches its next stage.
ESET also states that the model reduces the number of unnecessary alerts for security teams. According to the company, LiveCortex processes billions of events every day, of which 0.00111 per cent contribute to an actual incident reported to customers. That works out at roughly one in every 90,000 events.
Lower training costs
ESET attributes the lower training costs to the model’s focus on cybersecurity data. The model works exclusively with security data such as timestamps, suspicious processes and the connections between them, which the company says means less computing power is required. Through optimised training and the use of its own hardware, ESET says it can update security patterns more frequently at predictable infrastructure costs. The figure of 200 times lower costs comes from the company’s internal research.
Human oversight
Chief Technology Officer Juraj Malcho says the model was developed to augment human expertise, not to replace it. According to Malcho, NeoCortex does not make critical security decisions independently and forms part of a multi-layered security structure.
ESET says it applies a range of safety measures. These include sandboxed execution environments, read-only tools, continuous monitoring and a physical kill switch that allows the system to be shut down immediately.
In-house infrastructure
NeoCortex is developed and managed entirely within ESET’s own infrastructure. The European company says this allows it to retain control over how the model works and how customer data is processed. ESET expects this to reduce dependence on external AI providers and make organisations less vulnerable to geopolitical risks or unexpected changes in commercial direction by third parties.
The full report can be read via the technical blog on NeoCortex.
This article was originally published in Dutch on MSP Business. Read the original →
