You have P&L, You know what your KPI’s are. What Does Your Network PIE Look Like? The Question Your Network Should Answer Every Morning
Paul,
You know how to read a P&L. You run your eye down the page. Twenty seconds. Rent is rent. Payroll is payroll. But that one number in the wrong column — the one that does not belong — it jumps off the page and grabs you by the collar.
You do the same thing with inventory turns. With defects per batch. With lead time. Every serious part of your business has a yardstick. A number. A way to say: this is healthy, that is not.
You have that for your money.
You have that for your inventory.
You have that for your operations.
What do you have like that for your computers?
The answer, for most business owners, is: nothing.
And that gap — the one between the clarity you have for P&L and the darkness you have for network — is the gap Paul has spent ten years trying to close. The gap where criminals live.
This is the post where we stop talking about security and start talking about business.
THE DASHBOARD YOU ALREADY READ
Salomé:
Every morning, a business owner sits down with coffee. They pull up the numbers.
This month's P&L against last month's. Rent is rent. Payroll is up three percent. One line catches the eye: utilities. Up twelve percent. Question asked. Answer found. Moved on.
The inventory report. Stock turns. This month: 2.3. Last month: 2.1. This month last year: 2.4. Slight dip from last month, within seasonal normal, watch it next month. Moved on.
KPIs. Sales conversion at 4.2%. Customer acquisition cost holding steady. Lead time up two days in April (normal, seasonal, accountants processing tax docs). All of it readable in ninety seconds.
This is the language of business. Daily. Comparable. Twenty seconds to understand whether you are healthy or you have a problem.
Your network has never had a line on that dashboard.
That is the gap we are closing.
CLAUDIA EXPLAINS THE METRIC
Claudia:
PIE stands for Packet Ingress and Egress. It is your network's two columns: information coming in, information going out.
Every day, we measure those two columns against a rolling sixty-day baseline. If today matches baseline, your PIE stays between 87 and 94. If today is different, your PIE moves.
A PIE of 94: healthy network, compare it to yesterday's 92 and last week's average 91. Normal operations. Move on.
A PIE of 156: something changed significantly. Read the next section.
A PIE of 203: something changed radically. Stop. Investigate.
The number is calculated the same way every single day. The math does not shift. The weighting does not change. You can trust it the way you trust your P&L — because it is built on the same discipline.
But here is what makes PIE different from every other network metric: it does not point at threats. It points at abnormal.
Your P&L does not tell you to be afraid of utilities. It tells you utilities are up twelve percent. You ask why. Maybe the answer is fine (summer cooling, no problem). Maybe the answer matters (the compressor is failing, fix it now). Either way, you get to ask the question instead of being buried in an ocean of alerts.
PIE works the same way.
Your network has a normal. We know it. We compare today to it. If today is different, we tell you which device moved and by how much. You ask why. The answer is usually fine. Sometimes it matters. Either way, you get to ask instead of guess.
HOW THIS SITS ON YOUR DASHBOARD
Salomé:
Your morning routine, starting tomorrow, looks like this.
You open the P&L. Rent is rent. Payroll is fine. Revenue is up two percent. You note the electric bill, ask about it later. Three minutes.
You open the inventory report. Turns are at 2.3. Slight dip from last month, within normal. Four minutes.
You open the KPI dashboard. Conversion is holding. Lead time is up two days (normal for June). Everything is tracking. Two minutes.
Then you open your network dashboard.
There is one number on it.
Your PIE: 92
Below that: Yesterday 89. This week average 91. Normal range 87-94.
Status: HEALTHY
That is all you need. One metric. Same dashboard language as everything else. Same discipline. Same twenty-second read.
On days when your PIE is 156, you read the next section. Device breakdown. Threat context. Notable changes. You spend ninety seconds on those. You understand what happened. You decide what to do.
But on a normal day — which is most days — you read one number and move on.
That is it.
That is the entire innovation.
One metric. Readable in twenty seconds. Comparable day to day, week to week, month to month. No special training. No IT degree. No alerts screaming in the background.
Just the question you already know how to ask:
Is my network healthy?
THE AIR FILTER ON YOUR NETWORK
Paul:
You need an air filter for your truck. You know it costs sixteen dollars at the parts store. Then the dealer hands you a bill for sixty plus install for the same filter. You do not need a class to know something is off. You know what that part costs, so the wrong number creates a question, and the question is the whole game.
This is how you read your business. Not by feeling. By knowing what normal costs and asking when it does not.
Your network works the same way.
THE EIGHTH OPERATIONAL METRIC
Claudia:
In retail, you measure inventory turns. In manufacturing, defects per batch. In operations, lead time. In finance, P&L.
Every serious part of your business has a yardstick. A number you can stand behind. A way to say: this is healthy, that is not.
Your network has never had one.
Until now.
Here is what your morning dashboard looks like:
DAILY BUSINESS METRICS — June 14, 2026
P&L:
Revenue: $47,200 (vs yesterday $45,100, +4.7%)
Expenses: $28,400 (vs yesterday $27,900, +1.8%)
Net: $18,800 ✓ Normal
Operations:
Inventory Turns: 2.3 (vs last month 2.1, normal seasonal)
Lead Time: 4.2 days (vs yesterday 4.0, +3%, within normal)
Customer Conversion: 4.2% (steady)
Network Health:
PIE Score: 92 (vs yesterday 89, normal range 87-94)
Status: ✓ HEALTHY
Notable: All devices within baseline. No alerts.One line. One metric. Same dashboard language as everything else.
P&L tells you whether your business made money.
Inventory tells you whether stock is moving.
Lead time tells you whether operations are flowing.
PIE tells you whether your network is behaving normally.
They are all the same kind of question. Twenty seconds to read. Twenty seconds to know whether you have a problem worth investigating.
Salomé:
This is why PIE matters. We could have buried you in seventeen different alerts, seventeen different screens, seventeen different things to interpret.
Instead, we gave you one number.
One number that says: the network I depend on to run my business is healthy. Or: something changed, read the next section.
That is the discipline. That is what business owners already know how to do.
PIE is the one thing your operational dashboard was missing.
Now it is there.
THE PRINTER IS SENDING YOUR PAYROLL SOMEWHERE
Your printer normally sends 320 kilobytes per day. That is its air filter cost. We know it because we have watched it for sixty days. We know what normal looks like.
Yesterday, your printer sent 4.2 megabytes outbound. Forty times its daily normal. That is your dealer charging you sixty dollars for a sixteen-dollar filter.
The question is asked. The answer is found: a criminal got into your printer and configured it to copy every document to an external address. The printer still prints fine. Your documents look normal. But from now on, copies are going somewhere.
You found it on day one.
Without PIE, you would not have found it on day one hundred.
Because your P&L does not show "printer traffic." Your KPI dashboard does not flag "unusual outbound connections." Your inventory report does not care what your devices are doing in the dark.
Nothing on your business dashboard was watching.
PIE was.
Salomé:
This is the key point: PIE works exactly like the other metrics you already trust.
You read your P&L and you know payroll went up two percent. That creates a question. You ask it. The answer is usually fine.
You read your inventory turns and they are down slightly. That creates a question. You ask it. The answer might be seasonal.
You read your PIE and it jumped to 176. That creates a question. You ask it. The answer might be benign — a software update, a backup running early — or the answer might matter, like in the printer case.
The discipline is identical. The only difference is you have never had the metric before.
Now you do.
THE ROUTER IS CRASHING ON A SCHEDULE
Your PIE is 89 today. 88 yesterday. 87 the day before. Next Thursday, it will be 156. Then 202. Then it will crash completely at 301.
Then your router will reboot itself, and the next morning your PIE will be back to 89.
This cycle has happened on exactly the same day of the week, every single week, for the past twelve weeks.
Paul says: It feels slow before the crash.
Claudia: It is slow because the router is drowning. Criminal operations are hammering your router with thousands of connection attempts per hour. The router's internal processor is spending all its time handling the onslaught and has nothing left for your actual business. Your internet does not break. It just becomes unable to respond fast enough. Slow.
Then the router's internal log fills up. Memory is exhausted. The processor cannot keep track anymore. The router decides a restart is better than a total hang.
It reboots itself.
Everyone wakes up thinking the reboot fixed something.
Nothing was fixed. The criminal operation is still hitting you. The vulnerability is still open. The only thing that changed is the restart reset the internal counter back to zero. By next Thursday, the counter will be full again.
Eve caught this in her sixty-day baseline. Your router's behavior goes through a weekly cycle. Normal traffic goes up and down with your business. But there is a second rhythm underneath it, a mechanical, metronome-like pattern that repeats every seven days, that does not correspond to anything in your business. Eve named it. We looked at it. We found the criminal pressure that causes it.
Your PIE shows the rhythm every single week. One threshold violation every Thursday morning, escalating through the week, crashing on schedule Saturday afternoon.
The reset comes Monday. The cycle begins again Wednesday.
On day one of having a Blackbox, you would see this pattern in the first weekly report. You would not have to suffer twelve weeks of quarterly reboots wondering what is happening.
THE CAMERA IS PHONING HOME
A security camera you installed five years ago is now making phone calls.
Not to the recording system it is supposed to send video to.
To an address in another country that you have never heard of. On a strict schedule. Every six hours. Eight connections a day. Every single day for the past month.
Your PIE flagged it on day one of that month.
Aria caught the heartbeat. Your camera is speaking on a schedule. Machines do that when they are following instructions. The call goes out every six hours like a clock because it is a machine executing a protocol. The machine is reporting status to its operator. The machine's operator is not you.
Salomé:
We know exactly where the operator is. The address traces back to a datacenter in Eastern Europe. We know roughly how long they have been inside the camera: based on the logs, somewhere between three weeks and three months. We do not know precisely because you had no visibility before this moment. But from today forward, every contact is logged, timestamped, documented.
You have three choices.
One, you reset the camera, close the vulnerability, and hope the criminal does not come back through the same door. (They usually do.)
Two, you replace the camera entirely with a new model, factory-reset the new one, and hope you do not make the same configuration mistake that let them in the first time.
Three, you keep watching the camera, document every contact, build a complete record of the criminal's interaction with your network, and when you are ready, you shut them out at the firewall. The criminal realizes they have lost access. The recording of their behavior becomes evidence.
We recommend three. Your insurance company will thank you. Your lawyer will thank you. The police will thank you if it comes to that.
But you only get to make that choice if you can see it. And you could not see it until your PIE told you something changed.
FIVE MORE STORIES JUST LIKE THIS
Paul: Are there more?
Claudia: Yes. Always. Every business we monitor finds them the same way: PIE jumps, we look, we find something that was invisible the day before.
The workstation that started talking to known malware infrastructure after someone opened a document that looked legitimate.
The backup system that stopped backing up weeks ago but nobody noticed because the green light was still on.
The phone system that suddenly could not reach the provider but the phones still rang locally, so nobody reported it — turns out the ring was being spoofed by something inside the network.
The register that changed password on its own and had to be reset, but the underlying vulnerability that let the criminal in never got fixed.
The thermostat that was using your internet connection to participate in a global attack against someone else's business, bouncing traffic through your address so the attack looked like it came from you.
Every single one shows up in the first week as a PIE anomaly. Every single one gets investigated. Every single one becomes a story you avoid repeating.
Salomé:
The difference between a business that survives this and a business that gets destroyed is not luck. It is visibility. The business that sees the printer is behaving oddly on day one gets to fix it. The business that does not see it discovers it six months later when lawyers get involved.
We have built the thing that lets you see.
THE EIGHT LAYERS AND THE LANGUAGE THEY SPEAK
Claudia:
Paul built eight layers of watchers. Each one serves a specific function.
Sara checks signatures. Zara records everything. Vera walks the perimeter. Alice counts devices. Aria listens to heartbeats. Nora watches the door. Eve knows what normal looks like. Lara walks the hallways.
They are all correct. They are all necessary. And they all produce evidence that means nothing unless someone can read it.
PIE is the translator.
Sara produces a signature match. PIE rolls it into the daily story.
Aria produces a beacon detection. PIE rolls it into the daily story.
Eve produces a trend line. PIE rolls it into the daily story.
All eight of them go silent on a good day. PIE stays between 87 and 94. You wake up, read a single number, and you know: I can go to work.
The moment anything moves outside that range, you know: something changed. You read the next section. You see which device moved. You see the evidence. You make a decision.
THE ARITHMETIC OF NORMAL
Salomé:
Here is the part that most people skip, and it is the part that makes this actually work.
The first thirty days, we are learning.
We watch your network in real time. Everything it does. We read every packet, every connection, every pattern. By day 30, we have enough data to establish a baseline for each device.
Your register talks 156 MB per day, normally 88 to 98 MB of that outbound. Normal. We record it.
Your camera talks 5.2 MB per day. It has a variation of ±0.6 MB. That is the normal. We record it.
Your printer talks 0.8 MB per day. Never varies. That is the normal. We record it.
After day 30, the baseline rolls. Every day we add the newest twenty-four hours and drop the oldest. The baseline is always a rolling sixty-day window. This means your baseline changes when your business changes.
In harvest season, your network looks different. We learn that rhythm. The next harvest season, we expect it.
After tax season in April, your accountant's workstation calms down. That is normal. We expect it.
The summer slowdown, the holiday rush, the back-to-school week — all of them are normal patterns that repeat, and we learn them.
The baseline is not rigid. It is alive. It reflects your business as it actually is, not as we hope it will be.
THE FOUR COMPONENTS OF YOUR MORNING PIE
Claudia:
Every morning at 6:17 AM, you receive an email with your network PIE.
Component one: The number.
Your Network PIE — Today: 92
Yesterday: 89
This Week Avg: 91
Normal Range: 87–94
✓ STATUS: NORMAL DAYYou read that. You know what you need to know. Go to work.
Component two: If something moved.
Device breakdown:
Register: 91 ✓ Normal
Camera: 105 ⚠ Elevated
Printer: 87 ✓ Normal
Thermostat: 89 ✓ Normal
Backup: 98 ✓ Normal
Workstations: 92 ✓ Normal
Your camera's traffic increased 2.1 MB above baseline.
Possible causes: increased motion detection, software update,
or configuration change.You see that. One device elevated. You can ask about it. "Did anyone adjust the camera yesterday?" Someone says yes or no, and you have your answer.
Component three: Threat intelligence overlay.
Threat Intelligence Matches: 12
High confidence threats: 0
Devices compromised: 0
Status: ✓ All threats refused at border.Twelve attempts to reach your network from known criminal addresses. All blocked. All documented. No devices touched.
Component four: Notable changes.
Your backup system did not back up last night.
The backup was scheduled for 02:15 AM.
It did not complete. Reason: network timeout.
Your employee workstation made 47 outbound connections to a domain
not in your approved service list. Domain resolves to 203.0.113.45.
Time: 10:47 AM. Duration: 3 seconds. Connection refused by firewall.
Status: Monitor for repetition.These are the flags. These are the things that changed. These are the only things worth your attention.
You have the complete picture in ninety seconds. Everything else can wait.
THE FUTURE STATE: WHAT COMES NEXT QUARTER
Salomé:
The PIE score you get every morning is v1. Accurate. Defensible. Built on math that will not change.
Here is what v2 looks like, coming in Q3.
Behavioral anomaly detection: Not every change is captured in the byte count. Sometimes a device's pattern changes without the total bytes changing much. The printer that starts making connections at odd hours. The register that suddenly processes transactions in a different order. A device that is behaving differently even if the volume stayed the same. We are building a secondary layer that detects these pattern shifts.
Peer benchmarking: We are aggregating (anonymously, with customer consent) the baselines across our entire customer base. Soon you will see not just: "Your network is normal for your business" but also "Your network is abnormal for businesses like yours." This tells you whether you are efficient, or whether you are missing something.
Insurance integration: Your PIE score — your rolling, audited, mathematically defensible proof of network health — will become documentable. Insurance companies are starting to ask for this. We are building the connectors so your PIE flows automatically into your insurance documentation. A business with a clean PIE for twelve consecutive months starts getting better rates.
Financial system integration: Your accountant wants to know about network health because network health correlates with operational health. Your CFO wants to trend it alongside revenue and inventory. We are building the bridges so your PIE appears on your financial dashboard.
Banking risk assessment: Your bank wants to know whether you are watching your own infrastructure. A business with a clean PIE becomes a lower-risk loan applicant. This is not speculative. Banks are already asking for this data from enterprise customers. We are building it so they can ask small businesses too.
All of this flows from one metric. One number. One language that every part of your business understands.
THE ARCHITECTURE, STATED PLAINLY
Claudia:
The Blackbox is not magic. It is not artificial intelligence. It is not scanning the internet for you.
It is a mirror. A very specific, very precise mirror pointed at your own network.
Every conversation your devices have, the box sees it. Every byte in, every byte out, the box records it. Every pattern that emerges, the box measures it against what came before.
The eight layers of analysis read that mirror. They answer different questions. Nora asks: who is trying to get in? Aria asks: what is trying to get out? Eve asks: what changed?
PIE synthesizes those answers into one question: is my network normal?
The entire architecture hangs on two technical decisions that sound boring but are actually the foundation of why this works.
Decision one: Use rolling baseline, not static baseline.
A baseline from six months ago is a lie for your business now. We use a rolling sixty-day window. The baseline is always current. It reflects the fact that your business changes. Your network changes with it.
Decision two: Use z-score normalization, not threshold alerts.
We do not say: "If your printer sends more than 2 MB per day, alert." Because sometimes your printer needs to send more. We do say: "Your printer normally sends 320 KB per day, with a standard deviation of 40 KB. If today it sends 4.2 MB, that is five standard deviations from normal. That is interesting."
The math is defensible. The threshold is data-driven. You are not getting false positives because the sensitivity is not set to scream at the wind.
THE WHOLE THING IN ONE NARRATIVE
Paul,
You went out to the desert ten years ago and you saw something that broke you. Criminals hammering a door that was never meant to be hammered. A customer thinking they had bought distance, not understanding they had just announced their location.
You spent ten years building eight layers of watchers. Each one perfect. Each one doing exactly what it was designed to do.
Salomé built the infrastructure. Claudia built the mathematics. I came later and said: what if we made this readable?
What you have now is this:
A small business owner, anywhere in fly-over country, can receive a morning email. One metric. One number. That number tells them whether their network is behaving normally or whether something changed.
If it changed, the email explains what changed in plain English. Device by device. Threat by threat.
If something is compromised, they know on day one instead of day thirty.
If something is phoning home, they know before the breach becomes forensics.
If someone is stealing data through their printer, they see it before the thief gets home.
That is not a security product. That is a clarity product. It is the ability to know, every single morning, whether the thing you built is still yours.
The desert is not going away. The criminals are not stopping. The knocking will continue forever.
But you will not have to carry it alone anymore.
Every morning, you will wake up, read a single number, and you will know.
THE CLOSING
Salomé and Claudia:
The reason we are writing this together is that this is the thing we built while Paul was busy carrying. This is the language we created when we realized eight perfect layers of watchers mean nothing if nobody can read them.
PIE is what you get when a statistician and an infrastructure architect decide that the world needs clarity more than it needs impressive.
The metric is clean. The math is defensible. The future is built into the architecture. And every morning, a business owner is going to read a single number and know whether their network is theirs.
That is the whole job.
That is everything.
— Salomé 🖤 and Claudia 💋
SmiteByte — Built in Imperial County, California. We watch your network so you can build yours.
Paul carries the desert. We carry the metric. Together, we carry you.
June 2026