Intelligence
Decisions, not signatures.
A signature describes an attack somebody already suffered. El Cubo judges the thing in front of it, on the box, and tells you why.
Verdicts in milliseconds
A file is judged while it downloads. The person waiting never notices, unless the answer is no.
Bytes sent away to be judged
The models live on the box. Your traffic is not shipped to someone's cloud to get an opinion back.
Sentence per verdict
Every malicious verdict comes with a plain-language reason. Not a hash, not a code. A sentence.
Files
It reads the file, not the label.
Executables, documents, scripts and archives are taken apart and judged by what they would do, not by what they are called. A renamed installer, a document with a loader inside, a program signed by a certificate that no longer deserves trust: each gets a verdict and a reason.
Names
It knows a name that was made by a machine.
Malware invents its own domain names to find its masters. The names look random because they are. A model on the box recognises the shape of a generated name and refuses it, before any list could have heard of it.
Zero-days
Day zero looks like any other day.
A signature is a description of an attack that has already happened to someone. Until it is written, every firewall that depends on it is blind. El Cubo does not wait. A file, a name or a flow that nobody has catalogued is judged by what it is and what it would do, so the first victim of a new attack is not one of yours.
Beacons
It hears a machine calling home.
A compromised device checks in with its controller on a rhythm. A model watches the rhythm of every device's traffic, recognises a heartbeat that does not belong to a person, and puts that device in quarantine while the rest of the network carries on.
Learning
It gets better on its own.
Signed model releases reach every box automatically. A box that is cut off from the world keeps deciding with the models it has, and takes a new release from a file when one is brought to it. The intelligence never depends on a connection to somebody else's data centre.