The platform

The Decentralized Brain.

A single validator defends alone. A mesh defends together.

[01]·The problem

No SOC. Millisecond response. Adversaries that never sleep.

Validators secure trillions of dollars of staked capital across networks like Solana, Ethereum, Sui, and Cosmos. They get slashed, ejected from consensus, or taken offline when they fail. The attack surface is large, the response window is milliseconds, and there is no SOC watching them.

Existing security tools were built for enterprise IT, not for validator infrastructure operating at machine speed against adversaries who never sleep. The gap isn't detection. The gap is what happens between detection and response, and how fast that loop can close without a human in it.

[02]·What Mesh does

Every validator a sensor. The brain learns from all of them.

Every IBSR node observes its local traffic and reports patterns home. Mesh correlates across the fleet. Detection improves with every validator on the network. The collective view is the moat.

Single-node machine learning cannot solve this problem. A single validator sees a tiny slice of global traffic: not enough signal to distinguish a novel attack from environmental noise, not enough diversity to learn what malicious behaviour looks like across the long tail of possible attacks. A node defending alone is structurally weaker than a node defending as part of a mesh, by definition.

Mesh nodes exchange threat telemetry - anomaly signatures, behavioural fingerprints, abuse patterns - without sharing customer traffic or operational data. An attack pattern observed at one validator strengthens the defences of every other validator in near-real-time.

[03]·Architecture

Brain → instructions → enforcement.

IBSR

Observes locally

Open-source node on operator infrastructure. Watches traffic. Builds behavioural baseline. Reports patterns home to Mesh.

Mesh

Correlates globally

Decentralized brain. Trained on the substrate corpus. Correlates fleet telemetry. Issues scoped enforcement instructions back to operators.

Guard

Enforces locally

Open-source node. XDP/eBPF kernel-level blocking on instructions from Mesh. Drop-in compatible with existing firewalls.

IBSR reports home. Mesh decides. Guard acts. Authority is granted by the operator per abuse class and is revocable at any time.

[04]·Trained on the substrate

The data foundation underneath the brain.

Mesh learns from a corpus we built specifically for this - 1,092 multi-modal bundles across 19 attack primitives spanning 9 of 10 vulnerability families, contract-validated. The format is open. The corpus is ours. Read the research →

[05]·Where this breaks

Failure modes. Named before deployment, not after.

[!]

Adversarial drift

Attackers adapt to detection. Any behavioural model creates selection pressure to evolve. Mesh retrains continuously across the fleet and injects synthetic adversarial patterns to stress-test its own baselines.

[!]

Baseline poisoning

If an attacker is already present during the learning phase, the baseline is compromised. IBSR treats initial observation periods as untrusted and cross-validates against known-good patterns from across the mesh.

[!]

Authority capture

A wrong call at kernel speed is a self-inflicted outage. Guard rate-limits its own actions and requires escalating confidence thresholds for increasingly disruptive responses.

[!]

Scope creep

Pressure to extend authority beyond what the evidence supports. Every grant is bounded, versioned, audited. Expansion requires a new evidence cycle.

Become a design partner.

We work with a small number of validator operators and L1/L2 foundations at a time.