Skip to content
NagaHana
हिन्दी

The world model for network threat forecasting

Security tools show you what’s happening. NagaHana shows you what may happen next.

NagaHana learns how your network lives and breathes, runs it forward in time, and forecasts the attacks that could unfold — each with its likelihood, its evidence and the time you have to act.

Request a briefingSee how it forecasts
Live simulation · illustrative network

Drag to turn the network · rest on a node to forecast from it

Entities in view
—
Futures evaluated
—
Most likely path
—
Time to impact
—
Forecast stream · illustrative
  • ForecastLateral movement → 10.119.20.174 · 71% · 1–3 h
  • Regime shiftPayroll batch window opened · baseline adapted
  • ForecastBeacon-like cadence from 10.119.51.20 · C2 pattern · 58%
  • Blind spotSensor on 172.20.165.0/24 silent 14 min · confidence lowered
  • ExposureExploitable service on 10.119.1.4 · suspicion weighted up
  • ClearedBackup surge on 10.119.30.226 matches its schedule · no action
  • ForecastCredential reuse on svc-backup · 44% · 4–9 h
  • PlaybookSequence resembles a known group’s tradecraft · offered as a lead
  • ForecastStaging on 10.119.30.78 → exfiltration · 37% · 6–12 h
  • RewindIncident IR-0419 reconstructed · 7 stages · 41 entities

01The gap

Every tool you own looks at the present. Or the past.

Logs tell you what happened. Detection tells you what is happening — by which point the attacker is already moving. NagaHana works where defenders have never been able to stand: ahead.

Logs & SIEM

What happened

Detection & response

What’s happening

NagaHana

What may happen next

PastNowNext →

02How it works

A living model of your network — run forward in time.

NagaHana is a world model. It doesn’t wait for a signature to match; it understands how your network behaves, so it can reason about how the present will unfold.

  1. 01Sense

    Listens. Never touches.

    Passive by design. NagaHana reads the wire through network taps, flow records and the sensors you already run. Nothing is installed on your hosts.

  2. 02Model

    Builds the world.

    Every host, identity and service becomes part of one continuously updated model — across every layer of your network: traffic, identity, naming and encryption.

  3. 03Forecast

    Runs it forward.

    NagaHana simulates how the present can unfold and ranks the futures that matter, each with a calibrated likelihood and an expected time to impact.

  4. 04Advise

    Puts you ahead.

    Every forecast arrives with its evidence, its confidence and a recommended action. Your analysts decide — early.

03Inside NagaHana

Four minds. One loop. Nothing hidden.

NagaHana is built as four cooperating parts around a shared, long-lived memory of your network. Each has one job, and every hand-off between them is on the record.

Memory

Select a part to see what it does

  • Physics-informed
  • Self-supervised
  • Energy-based
  • Multiplex graph
  • Space · time · cause
  • Frozen, certifiable core
Inside the model

04Memory

Slow attackers are betting you forget. NagaHana doesn’t.

Low-and-slow intrusions spread their steps across weeks, so no single window ever looks suspicious. NagaHana keeps months of memory for every entity on your network — and connects the quiet steps into one story.

A short look-back windowNagaHana’s memoryForecast →
JanFebMarAprMayJun

  • Months, not minutes

    Every host, account and service keeps its own long memory, so rare and slow behaviour stands out against months of context.

  • Learns your normal

    A bank, a hospital and a power plant behave differently. NagaHana settles into your network’s own rhythm on site — without retraining.

  • A frozen, certifiable core

    The model itself is fixed at release. Only its memory adapts — bounded, auditable and reversible — so no one can quietly teach it bad habits.

Illustrative timeline.

05The unseen

Most of your network is dark. NagaHana reasons about it anyway.

Encrypted traffic, unmonitored segments, silent sensors — every real network has blind spots. NagaHana models what it cannot see, fills the gaps with honest inference, and shows you exactly where its view ends.

Sensor coverage ends
  • Observed
  • Inferred by NagaHana
  • Unobserved
  • Forecast path
  • Encrypted doesn’t mean invisible — timing, volume and structure still speak.
  • Gaps are modelled, never silently ignored — and never assumed safe.
  • It marks its own blind spots, so you know where to look.

06Forecast horizon

See further. Know how far to trust it.

Drag the horizon forward. Near-term forecasts are sharp; distant ones branch and blur. NagaHana shows you both — because a forecast that hides its uncertainty is a liability.

NowNow
Now+15 min+1 h+6 h+24 h

Most likely path

64%

Plausible futures

3

Drag to look further ahead

Illustrative values. How far and how widely NagaHana looks ahead is configured for each site.

07Rewind

The same world model runs backwards.

When something happens, NagaHana replays the world exactly as it was — what it saw, when, and what it predicted — so investigators get the whole story, in order, with nothing reconstructed from memory.

Illustrative incident09:12 · Initial access
203.0.113.15810.119.1.410.119.51.2010.119.10.810.119.20.17410.119.30.78198.51.100.100
▲ Forecast issued

Warning before exfiltration

3 h 12 min

From the moment NagaHana forecast the path to the first exfiltration attempt.

  • Replay any capture
  • Trace back to patient zero
  • What-if replay
  • Blind spots marked
  • Tampering flagged
  • ATT&CK-tagged narrative
  • Reproducible, with chain of custody

08Explainable by construction

It shows its work.

No black-box scores. Every forecast carries the evidence behind it, the confidence it deserves, what NagaHana could not see, and what to do next — sealed so it stands up in a review, an audit or an investigation.

FC-2291Forecast · active

Lateral movement toward 10.119.20.174

Expected in
1 h 40 – 2 h 50 min
Likelihood
71%
Horizon
6 h

When it may happen

Each dot is one in twenty outcomes

Now+3 h+6 h

What it couldn’t see

Two sensors on the finance segment were silent for 9 minutes. Confidence has been adjusted to reflect the gap.

Why NagaHana thinks so

  • New service-ticket pattern for svc-finance34%
  • Directory reconnaissance from a VPN host27%
  • Admin-share path never used by this peer group21%
  • Activity outside the account’s working hours11%
  • Sign-in from a new location7%

Recommended

Require step-up authentication for svc-finance and watch admin-share access from the VPN pool.

Evidence chain sealed · tamper-evidentsha256 9f2c…a41e

  • Calibrated

    When NagaHana says 70%, it happens about 70% of the time — and every forecast is scored the way weather forecasts are: against what happened, and against a naive baseline.

  • Explained

    Every call traces back to the observations behind it, in language an analyst can question.

  • Verifiable

    Forecasts and their evidence are sealed in a tamper-evident chain, so what it said — and when — can be proven later.

Go deeper

Everything behind the forecast.

09Who it’s for

Built for networks that cannot afford to be surprised.

  • Enterprise

    Get ahead of intrusions before they become incidents.

    • Forecasts across users, servers, cloud and identity
    • Learns your business rhythms, so routine surges stay routine
    • Works alongside the security tools you already run

  • Critical infrastructure

    Protect operations where downtime is not an option.

    • IT and OT modelled together, as one network
    • Passive — never touches fragile control systems
    • Runs entirely on-premises, data-diode ready

  • Forensics & threat intelligence

    Reconstruct what happened — and what was about to.

    • Replay any moment exactly as the model saw it
    • Sealed, reproducible evidence with chain of custody
    • Adversary behaviour mapped to MITRE ATT&CK®

Why NagaHana

Named for the one who ends what lurks.

Every network has something waiting in its dark corners — patient, quiet, coiled out of sight. It poisons slowly, and it strikes when attention drifts.

And whenever it is seen, it sheds its skin: new tools, new addresses, new signatures — so the defences that remember only its last appearance are left holding an empty husk.

NagaHana takes its name from the Sanskrit for the one who strikes down what lurks. It doesn’t chase the skin. It watches for what an intruder must do — the moves it cannot shed — and sees the strike coming before it lands.

  • It sees what lurks.

    In the unobserved corners, in the slow months, in the noise of ordinary days.

  • It reads the moves, not the skin.

    Tools and addresses change. What an intrusion must do to succeed does not.

  • It finds them. Your team ends them.

    NagaHana puts your defenders ahead of the strike — and leaves the decision where it belongs.

Nothing lurks for long.

10Request a briefing

See what’s lurking in your network.

Tell us a little about your environment. We’ll arrange a private briefing and show you NagaHana forecasting a network shaped like yours.

  1. 01A short conversation about your environment
  2. 02A private, tailored walkthrough of NagaHana
  3. 03A deployment discussion — on your terms, on your premises

We use these details only to respond to your request.