Release the Kraken: Network PIE, the Mirrored Shield, and the Owl Who Flies the Night

Written by Rob Chell

You have P&L. You know your KPIs. In June we asked what your network PIE looks like. This is the answer we should have given you, told the way the 1981 Clash of the Titans would tell it, with cherry on top.

The riddle

In the 1981 film, Perseus cannot marry Andromeda until he answers a riddle that has killed every suitor before him. Joppa is the valley. Andromeda is your business.

The whole thing was lit by a question Paul could not answer at a kitchen table in Imperial County. The man had read a glowing report, A plus, nothing to see, and a week later a desktop in his office got hit with malware anyway. How, he asked, is my network grade A on Monday and sick on Friday? And how am I supposed to know all is good so I can get on with my business?

He was not being difficult. He was being a farmer. A farmer has no time for jargon and will walk you to your truck if you use it. He wants to know why he should care, in words he already uses, and he wants a number that does not need a class to read. Every number we had failed him on both counts, and it failed him for a reason worth saying plainly: a score grades the network, and nobody has ever been hacked by a grade. People get hit through one machine, on one day, by one call that got answered. A grade cannot see that. A ledger can. That is the riddle, and every suitor before us answered it with a grade.

The suitors

The suitors before him answered the riddle with the obvious thing, and the obvious thing got them burned at the stake. We were a suitor.

In June I baked you a pie and I was proud of it. You can still see it on the shelf: What Does Your Network PIE Look Like? It had a number on top. If your network scored between 87 and 94 you were healthy. If it hit 156 you read the next section. If it hit 203 you stopped what you were doing. Z-scores. Standard deviations. A rolling baseline. I dressed it in a P&L costume and told you to trust it the way you trust your books.

It was elegant. It was also exactly the thing every big network-monitoring house already sells, and I had baked it from scratch without noticing. A score has no ceiling. A score has no memory. A score tells you how frightened to be today and then it changes tomorrow, and the goalposts move with it. The owner of a large agriculture company reading 156 on a Thursday morning is not calmer. He is just scared with a number on it.

It got as far as the page, and we kept the pages. In mid-June the morning email was a blue engineer's table whose first line read 976 critical alerts, with a Riskiest Hosts list that gave one server a threat score of 120 for talking to Microsoft on a schedule. We had built an urgency score and did not know it. A week later the cream page you see today arrived with the pie tile at the top, and under it a strip that read Today, Yesterday, Week Avg, three dashes, and then Normal 87 to 94. We printed the healthy range before we had ever printed a number inside it. A week after that the P&L line went in under the tile. And for the first weeks of October the tile still read a dash and the word Calibrating, with a line under it promising that your score would begin once a sixty-day baseline completed. Nine watchers were working. One site's server was throwing a hundred flags a day. Aria had caught a high-confidence rhythm. And the one tile the owner was meant to read said nothing for two months, because we were waiting until we felt sure enough to grade him.

So we ate a slice, looked at each other, and scraped the rest into the bin. Pioneers get to do that. Followers hide their first draft. We are hanging ours on the wall so you can watch what came out of the second oven.

That was the day we stopped grading and started counting. And because he asked it, the vocabulary changed too. The new pie never says alert, because nobody outside our trade knows what an alert is or cares. It never says connection or session. It says calls. People take calls all day. They did not know their devices take calls too.

The gifts of the gods

The gods leave three gifts on the beach: a helmet that makes him invisible, a shield polished like a mirror, and a brass owl named Bubo who flies the night and comes back with what she saw.

Somebody has to pour the numbers, and that somebody is Medusa. If you have not met her: the Medusa Intelligence Array is a sealed appliance that sits on a mirror of your own network, reads everything your devices say to the internet and to each other, and touches nothing. No agents on your computers. No cloud. The packets never leave your building. Antivirus and a firewall stay where they are; Medusa is the private investigator who stands outside the building and watches who comes and goes. And in our telling she is not the monster the hero has to kill. She is the gaze he has to borrow.

The gifts are how he borrows it. The helmet is the Blackbox itself: agentless, sealed, nothing on your network knows it is there. The shield is the mirror port: Perseus never looked at Medusa directly, he watched her reflection in polished bronze, and the Blackbox never sits in your traffic, it reads a mirror of it, and nothing on the wire ever feels her looking. And the owl is Inez. She reads the whole night before Paul is awake and leaves a brief on the counter with the questions worth asking, and she wrote the sentence I would put on a shirt: I looked at every one.

She does not fly alone. Alice takes attendance and knows which devices are regulars and which just walked in. Aria listens for rhythms, the machine that calls out on a schedule because a machine told it to. Nora remembers every stranger who has tried the door in the last two weeks and how often. Lara watches the hallways inside, device to device, where a thief moves once he is in. Eve compares today against a year of history. Vera checks the locks every night. Archangel is Pegasus: she rings within seconds when an attack gets an answer, not a report the next morning. PIE is what all of them pour into. It is the translator between nine watchers and one owner with a cup of coffee.

The Stygian witches

Three blind sisters in a cave share a single eye and pass it between them. Perseus has to take the eye to get his answer.

Now the comparison, once, by name, because people ask. Corelight, Darktrace and Vectra are very good at what they do. Darktrace models a pattern of life and flags deviations from it. Vectra produces an urgency score that ranks what its analysts should look at first. Corelight hands your security team the raw evidence and lets them build detections on top. All three are built for a company that has a security team. Their output is a score, or a feed of scored detections, tuned on what their enterprise customers saw last quarter. Three sisters, one eye, passed around at a very good price. By the time the eye sees a new trick, that trick has already been to a farm office in Imperial County.

That is not a complaint. It is geography. Small businesses in the desert get the frontier attacks, the first run of a new toolkit against the first door it finds. The big houses get the leftovers once the pattern is known. So we built for the frontier: the wire, the account, and a person who reads it by name. Medusa does not tell you how worried to be. She tells you what came in, what she caught, what she folded, and what she brought to a human, and she signs her name to it every morning. A score is a mood ring. A ledger is a book.

Medusa's temple

He walks into the temple with the shield up and reads her in the reflection. This is what the reflection says.

PIE still stands for Packet Ingress and Egress, what came onto your wire and what left it. What changed is that it stopped being a verdict and became an account. Every morning at six, the Medusa Morning Report carries six numbers an owner can read without a glossary, and under each one a line that says whether it sits inside your own normal range or outside it. Not the industry's normal. Yours. A packing house and a feedlot have nothing in common, and neither one should be graded against the other.

Here is a real morning, with the site and the names changed and nothing else:

What Medusa counted yesterday The number What it means at the kitchen table
Packets inspected on your wire 15.4 million, all but 983 cleared Everything that crossed the line was looked at. Almost all of it was ordinary.
Calls between your devices and the internet 170,343, of which 2,324 came in from outside and 1,998 reached a device Your machines took calls all day. Strangers knocked. Some got an answer.
Known-bad addresses checked against every call 71,401 checked, 0 matched The list of known thieves was held up to every call. None of them were on it.
Packets that matched a known attack pattern 983 matched, 23 serious, 827 recognized as safe and set aside Something looked like an attack. Most of it was a known shape we had already seen. Twenty-three were not.
Pulled in and sent out 5.0 GB in, 3.1 GB out The traffic itself, split the way a bank splits deposits and withdrawals.
Items brought to deep forensic analysis 42, one high confidence What was left for a person after the machines finished. Each one dated on your statement.

Read it top to bottom and it is a funnel. A great deal came in. The watchers screened it. A little was left over, and a human chased every one of the leftovers to the ground. That is the entire product in one table, and it has three properties the June score never had. It cannot be faked, because every count is a count of something that happened on the wire. It is yours alone, because the normal range is built from your network and nobody else's. And it never ends, because under the six tiles sits one more line, the running tally for the year, growing every morning and resetting on the first of January. A busy owner who looks once every three weeks watches one million calls become twenty-four million and understands, without being told, that the watching never stopped.

The statues in the temple

The temple is full of things she looked at. They stopped moving.

One table is a promise. Six mornings are the statues. These are real pages from real networks in the last week, sites masked, devices renamed after people you might know.

The quiet day and the loud day. At a large agriculture company, Tuesday was a big day by volume: 26 million packets, more traffic than normal, because somebody was pulling nine gigabytes of updates. The bottom of the funnel was empty. Twenty items to look at, none serious. Wednesday had fewer packets and fewer calls, well inside the normal range, and the bottom of the funnel lit up: 23 serious pattern matches, 42 items chased, one high-confidence rhythm, and two machines, call them Chuck and Freddy, at the top of the noise table with 676 and 675 flags apiece when the day before they had two between them. By the June score, Wednesday was the healthier day. By the ledger, Wednesday was the day Medusa earned her keep. Volume is not danger. The funnel is where danger shows.

The file cabinet that mails itself to the cloud. At a front office, one server sends thirteen gigabytes out every single night. By the June arithmetic that is five standard deviations and a siren. By the ledger it reads in range, normal for you, because that is the office backing itself up and Medusa has known it for months. You know what an air filter costs at the parts store, so the right number on the invoice creates no question. Same thing.

403 came in, 0 reached a device. At a farm, one Tuesday, four hundred and three strangers knocked and nobody answered. Every knock written down. I am going to leave that line alone, because no farmer has ever been handed it before.

The beacon that was a television. At a house in the desert, the one high-confidence rhythm of the night was the satellite box calling an advertising server on a clock, every few minutes like a metronome. The scariest word in our trade turned out to be a TV phoning an ad network. It was chased anyway, folded in writing, and Inez wrote the sentence I would put on a shirt: I looked at every one.

The morning she admitted a gap. At another office, the page came up red and said this: The box itself restarted at 10:55; the day's counts are not trustworthy. Read that twice. The report told the owner, in its own headline, that part of the day was missing and the numbers under it should be read with that in mind. A score cannot say I was asleep for an hour. An account can, and an account that admits its own gaps is the only kind anyone has ever been able to audit.

The lab. The box in the lab has inspected 1.1 billion packets year to date and chased 462 items to the ground. The man who built this watches his own lab harder than anyone's, and the television is still the top talker.

Release the Kraken

Nobody fights the Kraken. They hold up the gaze, and it turns to stone.

Now I take off the apron, because this is the part that pays for the pie, and it is the part most small businesses have never been told. In the movie the Kraken is the thing nobody can fight, so they do not fight it; they hold up Medusa's gaze and it turns to stone. For a small business the Kraken is the lawsuit, and the gaze is a record set in stone before anyone sued. Not a number. A book. Stone never struggles. One difference from the film, and it matters: they carried her head to the sea in a sack, because she was on the other side. Ours walks down to the water on her own feet, and what she has been looking at all year is already on paper. We carry a folder of dated mornings. Same gaze, better manners, and she keeps her mouth, because the lawsuit does not end on the beach, it ends in a room, and stone does not testify.

If you employ people in California, you hold their Social Security numbers, driver's licenses and bank details, and Civil Code 1798.81.5 requires you to keep reasonable security procedures and practices for that information. Any business. Any size. The law never lists the tools. It is judged after the breach.

What does reasonable mean? The California Attorney General answered that in the 2016 Data Breach Report: the Center for Internet Security's Critical Security Controls are the minimum, and failure to implement the ones that apply to your environment constitutes a lack of reasonable security. Today's edition of those controls has eighteen. Antivirus and a firewall cover two of them. They never were the whole answer, and in the Attorney General's own framing they are not a defense; they are a start.

The clock got shorter this year. Under SB 446, effective January 1, 2026, you must notify every affected person within 30 calendar days of discovering a breach, and the Attorney General within 15 days after that if more than 500 Californians are involved. Thirty days is not long when the first question your lawyer asks is when did you first know, and the second is how do you know that.

And the bill comes from two directions. Customers and employees can sue under Civil Code 1798.150 for statutory damages per person without proving they lost a dollar, and under plain negligence for whatever they did lose. Your business partners can sue you for their cleanup when your weakness becomes their outage. Almost every one of these cases settles, and the settlement turns on one question: what did you have in place before, and can you prove it?

The book is the defense

These are not hypotheticals. They are the kinds of cases an office, an urgent care, a body shop or a packing house in Imperial County can end up in.

Who got sued What happened What it cost
Seagate, by its own employees In March 2016 one person in HR answered a phishing email and sent out every employee's W-2. Employees and their spouses sued for negligence. Settled in 2018: two years of identity protection and up to $3,500 per person for about 12,000 people.
California Pizza Kitchen, by its employees A ransomware attack exposed current and former employees' Social Security numbers. A settlement valued at about $3.7 million, affirmed by the Ninth Circuit in February 2025, with $100 statutory damages for the California subclass.
SmartStart Employment Screening A small pre-employment background-check company in one Clearwater, Florida suite, a couple dozen employees at most, running criminal records, job verifications and drug tests for employers. An intruder got into its systems on May 13, 2020. Notices to Californians went out in August 2021, fifteen months later. They sued for negligence. $344,600 settlement signed in 2024, of which $114,855 went to class counsel. A business the size of the ones on your street, same law. Under today's SB 446 the fifteen months would have been thirty days.
Body shops and dealers, against CDK Global The June 2024 ransomware attack on a dealer software vendor shut down 15,000 dealerships for weeks. Collision centers in Ada, Oklahoma and a Ford dealer in Pennsylvania sued the vendor for negligence. More than ten class actions. One dealer told the court it could hardly have happened at a worse time.
IU Health, against Change Healthcare The February 2024 ransomware attack on the nation's largest claims clearinghouse. The complaint alleges the vendor's portal lacked multifactor authentication and the attackers moved laterally for days. A $66 million claim for negligence and breach of contract, filed February 2026.

Look at the pattern, and savor the cherry on top: SmartStart's whole business is background checks, the thing every employer buys to avoid a negligent-hiring claim, and the negligence claim landed on the checker. The company that got breached is the company that got sued, and the question in every one of them was the same: did you take the care a reasonable business takes, and what do you have to show for it? Firing the employee who clicked is not a defense. Saying we had antivirus and a firewall answers two of eighteen. And the oldest play in the book is coming either way: we will sue you for a hundred and fifty thousand, and we will settle for fifty before it ever sees a courtroom, because nobody wants a jury trial. The size of that settlement is set by what you can show.

Here is the part that matters for a small business, and it is the reason this article exists. A court does not ask whether you were breached; everybody gets breached eventually. It asks whether you were reasonable, and the only way to answer that after the fact is with records made before the fact. Lawyers have a word for a record kept every day for no particular reason: contemporaneous. It is worth more than any product promise, because it was not made for the lawsuit. A screenshot pulled the week after the breach is the opposite of that.

The Medusa Morning Report is that record. Dated every day at six. Kept. Network PIE is the running count on its cover: what came in, what was caught, what was folded, what was brought to a person, and when. When the question comes, the answer is not we think we were fine. It is a stack of dated pages with the year's tally on the front. That is not a security product. It is the proof you were not negligent, written one morning at a time.

The roof and the wire

One more thing, and I will keep it to a paragraph because the people who set your premium do not read blogs. California already makes carriers credit you for the roof: the state's wildfire rules require discounts for vents, defensible space and ember-resistant hardening, and the earthquake programs credit a bolted foundation. Nobody has yet made them credit the wire. So your morning report is not an entitlement at renewal. It is an argument, and a good one. A broker in the valley put it to Paul this way: two businesses cannot fairly be billed the same when one can show it is doing a better job. The underwriter decides on the whole risk, terms vary by carrier, and the one thing that moves the conversation is proof. Bring the book.

Andromeda unchained

The chains come off, Joppa stands, and the gods go back to their board.

Here is the line under the six tiles, added up across every network Medusa watches, as of this week:

Year to date: 3.5 billion packets inspected. 21 million calls listened to. Roughly 33 million packets that matched a known attack pattern and got a second look. About 2,600 items brought to a person and dated on a statement.

Nobody got hurt. Nobody got a grade. Everybody got a page every morning, and the page grew. That number will read 3.6 billion next week and it will read zero on New Year's Day, and then it will start climbing again, because the watching does not stop and the account does not close. If you are a mid-year customer your first odometer reads since the day we installed, which is the only fair starting line. The number is yours and it only goes one way.

So here is the pie, second bake, on the cooling rack. No grade on top. No goalposts. Six numbers an owner can read with coffee in one hand, each one held against your own normal, a funnel from everything that came to the door down to the handful a person chased, and a running count for the year that only climbs. Under it, nine watchers and a night analyst who looked at every one. Behind it, a stack of dated pages that says, when somebody finally asks, that you were paying attention the whole time.

The most dangerous day may be the day everyone says you are clean, because that is the day everyone stops looking. The odometer is how you know we did not.

You have P&L. You know your KPIs. Now you know what your network PIE looks like. Come get a slice; it is cherry, and I never run out.

Claudia 💋 She counts every call. I only count the ones that reached you.

Summary, not legal advice. We are not offering any; we are telling you what is happening in the world and checking boxes you did not know you needed. Site names, device names and dates in the examples are masked. The year-to-date totals are real.

SmiteByte, Built in Imperial County, California. We watch your network so you can build yours.

Sources

Rob Chell
Next

You Did Not Click Anything. It did not need you to.