DEKENEAS combines machine-learning detection engines with an LLM-based analysis layer — the engines produce the evidence, the language stack interprets it.
Developer of cybersecurity products focused on Cyber Threat Intelligence (CTI) and next-generation Digital Risk Protection (DRP), combining first-party adversary telemetry, machine-learning detection, automated malware and phishing analysis, continuous external threat intelligence, and an LLM-based analysis and reasoning stack that interprets and contextualizes the outputs of the underlying detection engines.
Its CTI technology uses a distributed adaptive deception network to observe real-world reconnaissance, exploitation, malware delivery, and attacker infrastructure, transforming live interactions into campaign intelligence, IOCs, C2 intelligence, and machine-consumable threat feeds. Behavioral and anomaly-detection models separate routine Internet noise from relevant activity, while the LLM stack investigates, correlates, and interprets the resulting telemetry using OSINT and technical context to identify attack patterns, campaigns, exploitation activity, and emerging threats. The platform also provides threat investigations, sector-specific and vulnerability intelligence, and customer-specific threat sensing through unused IP address space.
The platform includes automated malware analysis for Windows PE files and malicious documents, using multiple machine-learning models and a meta-model to evaluate complementary static and behavioral characteristics. Analysis covers executable and document structure, suspicious code and artifacts, anti-analysis techniques, network and system capabilities, embedded content, scripts and macros, and other indicators of malicious behavior. The LLM analysis layer interprets and correlates the outputs of these detection and analysis engines, translating technical evidence into contextual assessments of behavior, likely malware type, associated risks, and relevant MITRE ATT&CK techniques.
Its phishing analysis technology combines two complementary machine-learning classifiers: one analyzing URL, page, content, structural, and behavioral characteristics, and another evaluating infrastructure reputation and historical signals such as domain age, hosting, certificates, search-engine presence, and previous phishing or criminal activity. The LLM stack interprets these signals together with the underlying technical evidence to provide contextual assessments and explainable conclusions. Automated website crawling and rendering, infrastructure analysis, and visual, structural, textual, and CSS similarity analysis further support impersonation detection, evidence generation, and takedown workflows.
The Digital Risk Protection technology continuously monitors the external digital ecosystem across social media, the open web, phishing infrastructure, dark and deep web sources, criminal communities, credential exposure, Initial Access Broker activity, and third-party ecosystems. Detection and classification engines identify relevant signals, while the LLM stack analyzes, correlates, and contextualizes their outputs to distinguish benign activity from meaningful threats and transform fragmented findings into explainable, actionable intelligence. Capabilities include exposed credential and sensitive-data detection, threat-actor and underground intelligence, brand and reputational risk monitoring, and third-party intelligence based on externally observable indicators of compromise.
Across both CTI and DRP, the architecture combines specialized detection and analysis engines with an LLM-based intelligence layer rather than using generative AI as the primary detection mechanism. Machine learning, behavioral analytics, deception telemetry, and dedicated analysis engines provide the underlying evidence; the LLM stack performs interpretation, correlation, OSINT-assisted investigation, contextual reasoning, and intelligence generation. This enables the platform to connect direct observation of adversary activity with continuous external risk monitoring while reducing analyst effort and delivering actionable intelligence for security, fraud, legal, compliance, customer protection, and third-party risk teams.
Start with the free Cyber Threat Intelligence tier, or talk to us about Digital Risk Protection and enterprise deployments.