Every industry that relies on digital infrastructure — defence, finance, cloud, critical infrastructure — is built on a flawed assumption: that surfaces stay static long enough to protect. ACSE eliminates that assumption. One platform. Six domains. A trillion-dollar opportunity.
Static surfaces have always been a liability. What changed is the speed, scale, and automation of the attacks exploiting them — and the regulatory cost of getting it wrong.
WormGPT, FraudGPT, and AutoGPT-based attack frameworks cut reconnaissance from days to minutes. AI maps surfaces, correlates fingerprints, and drafts exploit chains faster than any human analyst can respond. ACSE's answer: the surface expires before any AI model can act on what it observed.
Shodan and Censys re-index the entire internet every few hours. Every static API endpoint, every TLS certificate is catalogued before you've noticed the scan. ACSE: what they index is cryptographically stale by the time they serve the result.
IBM X-Force 2024: credential-based attacks rose 71% year-over-year. Valid accounts were used in 30% of all incidents. The root cause isn't weak passwords — it's that stolen credentials remain valid. ACSE closes this at the root: credentials expire at mutation cycle boundaries.
The average enterprise uses over 1,000 cloud services. Each service is an API. Each API is a static fingerprint accumulating in attacker databases. ACSE: the surfaces it protects rotate every minute by default.
Change Healthcare: 9 days and $2.457B in damage. SolarWinds: 14 months. These attacks succeed because surfaces stay static long enough to stage. ACSE's staging window is one rotation interval — 60 seconds by default.
SEC rules, EU NIS2 (2024), India DPDP Act, CERT-In mandatory reporting. Board directors are personally liable. The cost of a static surface failure is now measured in fines, criminal liability, and stock price.
An attacker can't rely on a surface they mapped yesterday
once that surface has changed today.
ACSE is infrastructure — like TLS, it sits beneath everything else and makes everything else more effective. Every industry built on digital surfaces is a potential deployment.
Command, control, intelligence, and surveillance surfaces are the most targeted in the world. Nation-state adversaries rely on long-duration reconnaissance — the exact capability ACSE eliminates. A host whose network fingerprint changes every minute, with every change checked by an independent verifier, leaves a long reconnaissance campaign holding a map that is out of date.
16 CISA-designated sectors — power grids, water systems, hospitals, transportation networks — run on legacy OT/IT systems with static surfaces. Colonial Pipeline was stopped by one leaked VPN password. Change Healthcare cost $2.457B.
SWIFT, central banks, payment processors, and trading platforms handle $120T+ in annual global flows. In benchmark, SquidShield produced 500,000 consecutive fingerprints with 100% uniqueness, measured at 165k mutations per second; it has not yet been deployed against a live payment surface. Rotating the observable surface raises the cost of reconnaissance — it does not, on its own, stop credential replay or session hijacking, which need authentication and session controls alongside it.
AWS, Azure, and GCP integration at the platform layer means one deployment protects every tenant workload. ACSE becomes a cloud-native security primitive — deployed once by the hyperscaler, enforced everywhere. One hyperscaler partnership scales to billions of endpoints.
ElectricEelGrid is designed to target the power side-channel in COLO environments, where physical co-location can expose observable electromagnetic and thermal side channels. It is implemented and tested but deliberately not yet activated, pending a future anomaly-detection subsystem this project has not yet built; independent hardware-based side-channel validation is future work.
Government CERTs, national SOCs, election infrastructure, and classified national systems face nation-state adversaries with unlimited resources. LeviathanGrid provides 16-node simultaneous rotation for nation-scale topology — the capability that would have stopped SolarWinds at all 18,000+ victim organisations simultaneously.
ACSE doesn't replace your SIEM, your EDR, or your Zero Trust architecture. It changes the surface all of those tools protect. Like TLS — infrastructure that makes your entire stack more effective.
An agent and a small helper on each protected Linux node, plus a Control Plane and a verifier. ACSE deploys alongside your existing stack — firewalls, SIEM, EDR, Zero Trust all remain in place and become more effective because they now protect surfaces that change rather than surfaces that don't.
ACSE doesn't need to know about a vulnerability to make reconnaissance of a host go stale: the network fingerprint an attacker maps changes at every rotation, whatever exploit they plan to use. It does not stop an attacker who needs no reconnaissance — one holding valid credentials, a supply-chain implant, or a working exploit for the running service.
ProVerif models of three message types. The peer handshake keeps its channel secret and authenticates both peers. Every accepted Defensive Leap is proven to come from the node it names. Every executed protected action is proven to have been granted by the node. Replay protection is shown by tests. This is not a zero-knowledge proof. ASMP frames are authenticated, not encrypted. Group secrets rotate on a schedule, and a retired secret is deleted and no longer accepted. Deletion is not cryptographic erasure: copies can remain in database logs and in backups taken before the rotation. The group secret is delivered sealed to each node's long-term key, so a recorded delivery could be opened if that key were later compromised. This is not forward secrecy.
Finance, healthcare, defence, cloud, COLO and nation-scale — each domain has a tuned mutation profile. The shipped agent composes all ten domain profiles plus TorpedoRay in a single mutation cycle (the KaliCoreTarget composite), and the composite asks every sub-target to validate on each cycle. Apart from the surfaces listed on the Scope page — the Linux host TCP/IP stack and TLS front, the service address and its DNS name, and the management plane — the profile behaviours act on an in-memory model pending integration. TorpedoRay is the transport-channel profile rather than a business domain: on Linux it acts on the host TCP/IP stack fingerprint, and TLS-side rotation is performed by the TLS front.
Sub-millisecond per-node mutation cycles. 2,130 tests passed, 0 failed (20 October 2026). The compute for one mutation cycle takes 4.5–46 microseconds depending on profile (benchmark, 12 October 2026); a deployed node rotates every 60 seconds by default. Estate-wide coordinated rotation (Defensive Leap), detection to a receiving node's surface having moved: median 1.9 seconds, p99 3.8 seconds — the worst of runs with 1, 10 and 50 agents on one host, 13 October 2026; a node that signs its audit records in a TPM adds about half a second.
Indian patent application IN202641070690 (published 19 June 2026, Journal No. 25/2026; pending examination, expedited examination requested). The Kali Invariant, PME architecture, ASMP/1.0, and the ten domain profiles, TorpedoRay and the KaliCoreTarget composite — are described and claimed in the application.
One dashboard. Every estate. Real-time Kali Invariant status across every protected node — with SIEM dispatch, firewall orchestration, and hardware-backed key custody for the audit chain built in from day one.
The audit-signing key for every protected node can be generated and held inside a TPM 2.0 module, never extractable from the chip — verified on real hardware. API authentication is enforced via API-key + role-based access control (Admin / Operator / ReadOnly).
Live organ-state view across every registered estate. EWMA of mutation-cycle duration, torpedo count, channel fingerprint, JA3 hash, p0f signature — updating every 5 seconds.
Every mutation event and Torpedo firing dispatches to your SIEM automatically. Splunk HEC, IBM QRadar, RFC 5424 Syslog, and stdout — all supported out of the box.
When a surface mutates, the connected firewall updates automatically. Palo Alto Networks XML API (Dynamic Address Groups), Cisco ASA REST, and Fortinet FortiOS — all three integrated.
Define mutation schedules, EWMA thresholds, and active profiles per estate from a single API. Assign policies across hundreds of nodes with one call.
Every mutation event from every node aggregated into a tamper-evident PostgreSQL audit chain. Paginated API for compliance review, forensics, and regulatory reporting.
Four report types — Summary, EWMA Anomaly History, Attack & Defence Log, Audit Extract — generated in the background and downloaded as CSV or JSON.
Enter a CIDR range and click TCP Probe — every live host appears, classified by port signature, with a suggested mutation profile. SSH Scan for Linux estates. Scan All Sources for LDAP/Azure AD/Cloud.
The KaliCore Mandala icon sits in the system notification area (Windows + Linux). One click opens the dashboard. Live health polling. Installed automatically by the MSI or DEB.
The ACSE CA issues a unique X.509 client certificate to every registered agent. Mutual TLS verifies both sides at the TLS handshake layer. Required by government security evaluations and banking sector pilots.
Symmetric HMAC-based key-wrapping operations via the PKCS#11 standard. Dynamic library loading — no compile-time vendor dependency. Compatible with Thales Luna, SafeNet, Entrust nCipher, Utimaco, and SoftHSM2. Asymmetric HSM-resident key operations (e.g. ECDSA-P256 custody) are defined end-to-end but not yet produced by any signer — tracked as a roadmap item.
On first boot with no database configured, the Control Plane launches a browser-based wizard on port 9000. Three screens: PostgreSQL connection → admin account creation → API key reveal. Zero manual configuration required.
SHA3-signed license tokens enforce estate limits per tier — trial (3 estates), professional (configurable), enterprise (unlimited). HTTP 402 on limit breach.
Version manifest hosted on Cloudflare CDN. On startup: applies staged .next binary and re-execs. Background check every 24 hours. SHA3-256 hash verification before staging. ACSE_AUTO_UPDATE=true to enable.
The acse-agent binary runs on every protected node. First boot: self-registers with the CP, writes api_key + estate_id to .env. PME engine runs in a dedicated thread. Push loop sends live state to CP every 30 seconds.
Every estate, user, API key, policy, SIEM sink, and firewall device belongs to an organisation. Isolation is enforced at the application layer: every handler checks the caller's org_id/estate ownership before reading, writing, or deleting, and a foreign-org request returns 404 rather than leaking existence. Verified live by replaying the original cross-tenant attack (rename, resource-limit DoS, delete) against another org's estate and organisation — every attempt returned 404 with the target's data untouched. PostgreSQL Row Level Security is enabled on several tables but is not currently enforcing — the application connects as the table owner, which bypasses RLS regardless — so isolation should be attributed to the application-layer checks, not to RLS as a second defence-in-depth layer.
Each node reports an exponentially weighted moving average of its mutation-cycle duration with its telemetry. Detecting anomalies from it needs the Control Plane to judge durations, which is planned. A learned classifier (a local ONNX model) is designed but not shipped; it is planned once there is field data to train it on.
This is a deliberate architectural decision, taken out of security requirements. The Control Plane is the only ACSE-PME component that faces the outside world: it terminates public HTTP endpoints, brokers SSO/SAML/OIDC identity federation, and performs PKI/CA private-key operations. Concentrating this attack surface on a single, well-understood, deeply auditable platform — rather than distributing it across three separate OS-specific build and dependency chains — is a deliberate security-first choice, not a platform limitation.
The Endpoint Agent and System Tray, which run on protected infrastructure rather than facing the public internet, remain fully cross-platform: Linux, Windows, and macOS.
SAML/OIDC federation capability is unaffected — the IdP may run on any operating system; only the Control Plane's SSO endpoint, which IdPs talk to over standard network protocols, is Linux-hosted.
Before you can protect a node, you need to know it exists. The ACSE Control Plane discovers every server, VM, HCI node, and storage controller in your estate automatically — across 22 source types — then suggests the right mutation profile for each one.
Set ACSE_REGISTRATION_TOKEN on the Control Plane and on each agent node. On first boot, the agent calls POST /v1/discovery/self-register, receives its api_key, and starts pushing immediately — no admin catalog step required. Ideal for Ansible/SCCM rollouts and cloud auto-scaling groups.
"If I have a firewall, locked-down ports, and a hardened server — what is the use of TLS?"When HTTPS was introduced, that question was asked. The answer was simple.
Hardening protects the network. TLS protects the data independently of the network. Your firewall, your locked ports, your patched OS — TLS adds a layer that operates regardless of all of them.
ACSE protects the surface identity independently of everything else. Your firewall, your patched OS, your Zero Trust policy — ACSE adds a layer that operates regardless of all of them.
In concrete terms — three scenarios every security team will recognise:
The surfaces ACSE rotates change every minute by default. A network fingerprint mapped before the attack is out of date after the next rotation.
The observable surface the attacker mapped around that credential changes at the next cycle, so a staged follow-on goes stale. ACSE-PME does not, on its own, stop a valid sign-in with the phished credential — that needs MFA and session controls alongside it (see Scope).
The endpoint fingerprint the attacker mapped through that open rule is stale. The path they found leads nowhere — not because the firewall was fixed, but because the destination no longer looks the same.
The point is the same as it was with TLS:
TLS is not a replacement for your firewall. ACSE is not a replacement for your EDR, your SIEM, or your Zero Trust architecture. It is an additional layer that operates independently of all of them — and makes all of them more effective, because the surfaces they protect are no longer static.
Every component of ACSE — engine, server, agent, tray, dashboard — is built on proven technology with no framework bloat and no AI-generated code. 83,472 lines of hand-written Rust across 226 files. 2,130 tests passed, 0 failed (20 October 2026).
A planned public ACSE endpoint — to be deployed on a cloud host, open to the world. No registration, no forms — a running instance of the Kali Invariant, and a question to put to it directly. It is not live yet.
A fully operational ACSE instance — the same engine and the same Kali Invariant, with the same measured per-cycle compute (4.55–45.77 µs per cycle, measured 12 Oct 2026). It will be open to any security researcher, red team, or penetration tester in the world. It is planned, not yet deployed.
Can you exploit a service whose observable surface changes faster than you can act on what you observed? The Kali Invariant is a concrete check: the surface fingerprint an independent verifier observes must not repeat within a window of recent cycles. The Control Plane judges it from the verifier's observations, not from the engine's own report. A public challenge is planned so that others can test it.
For pilot deployments, investment discussions, or to review the full technical evidence base — reach out directly.