Aegis CypherCloak Blackbox NDR

The SmiteByte Aegis CypherCloak Blackbox replaces a $110,000-a-year security analyst with a small, silent device that plugs into your network and never takes a day off. It watches every computer, camera, phone, and device on your network 24 hours a day, seeing things your firewall and antivirus completely miss, and delivers one plain-English email every morning at 6 a.m. telling you exactly what happened the night before. Built on proven open-source tools trusted by leading universities and government agencies, it catches data leaving your building, devices behaving strangely, and threats moving silently between your computers before they become disasters. Every edition now includes ARIA, our statistical beacon detection engine that listens to the rhythm of your network traffic and catches command-and-control activity that signature tools and intel feeds cannot see, the same class of capability enterprise SOC teams pay $350,000 a year to operate. Higher editions include enhanced hardware, daily device discovery, dedicated ARIA tuning, and hands-on compliance reporting that has helped businesses achieve potential cyber insurance premium reductions of 10 to 45%.

-Technical Specifications- Built on Suricata for signature-based IDS alerting, Zeek for passive protocol analysis and behavioral logging, ARIA (Automated Rhythm and Interval Analysis) for automated statistical beacon detection, built on the RITA-J methodology recognized by CISA and used by enterprise SOC teams that pay $350,000+ per year to operationalize it, OpenVAS/GVM for daily vulnerability scanning against 100,000+ NVTs, tcpdump for full packet capture and C2 beacon detection, Nmap for device discovery and port analysis, and Wireshark-compatible packet captures for deep forensic investigation. All correlated through a custom daily engine that produces actionable threat intelligence without cloud connectivity or endpoint agents. The system operates both defensively and offensively. Suricata and Zeek watch your network continuously for threats and anomalies. ARIA listens to the rhythm of every conversation every device has with the outside world and flags traffic that moves like a machine instead of a human, catching encrypted command-and-control, fresh domains, and slow beacons that signature tools and intel feeds cannot see. OpenVAS actively wargames your own infrastructure daily, probing for vulnerabilities the way an attacker would, so weaknesses are found and closed before they can be exploited. Deploys via mirror/SPAN port for complete agentless east-west visibility, detecting lateral movement, data exfiltration, and persistent beacons that perimeter tools and EDR solutions consistently miss. Professional and Enterprise editions include enhanced high-performance hardware, custom Suricata rule packs, dedicated ARIA threshold tuning and custom whitelisting for your specific environment, and compliance reporting aligned to HIPAA, PCI-DSS, NIST 800-171, ISO 27001, SOC 2, and CMMC frameworks.

• Rural Resilience Edition $9,999 (Renewal: $2,000/year) Up to 25 endpoints. Built for farms, rural co-ops, small agribusiness, and OT/IoT environments (tractors, grain systems, irrigation). Lightweight IP-based visibility (no MAC collection, no mirrored traffic capture) with one-time beacon detection for essential internal threat hunting. Includes ARIA behavioral beacon detection running automatically every morning at 5:45am, the same class of statistical engine enterprise SOC teams pay six figures a year to operate, now baseline standard at every Blackbox tier. Includes one year remote tuning and phone support. Because rural ops are getting crushed and deserve real visibility, not theater.

• Small Business Edition $24,999 (Renewal: $5,000/year) Up to 90 endpoints. Ideal for corner shops, small retail, local services. Higher throughput for busier networks with automatic daily beacon scanning for ongoing new-device baselining and threat detection. Includes ARIA running every morning with default thresholds and standard whitelisting. One year priority remote support (faster response, custom scripting).

• Professional Edition $59,999 (Renewal: $12,000/year) Up to 150 endpoints. Includes enhanced high-performance hardware built to handle the savage resource demands of full mirrored traffic capture and deep packet storage. Perfect for small developers, manufacturing facilities, medical practices, law firms, schools, police stations, and similar. Automatic daily beacon scanning for continuous baselining and new-device discovery, plus hands-on compliance assistance with reporting templates (NIST 800-171, ISO 27001, HIPAA, CMMC, etc.) tailored for insurance requirements. Includes ARIA with environment-specific threshold tuning, custom whitelisting for your legitimate software stack (backup agents, update checkers, monitoring tools, line-of-business applications), and false-positive analysis built around how your network actually behaves, not generic defaults. Real customer deployments have achieved up to 98% vulnerability closure rates with consistent tuning and remediation. One year dedicated remote support + custom rule packs.

• Enterprise Edition $119,999 (Renewal: $24,000/year) Unlimited endpoints. Includes enhanced enterprise-grade hardware engineered for the intense resource load of full mirrored traffic capture at scale. Suited for maquiladoras, international operations, larger critical infrastructure. Automatic daily beacon scanning, full compliance-ready reporting and hands-on assistance. Includes ARIA with full environment-specific tuning, custom scoring weight calibration where justified, ongoing threshold review, and integration of your specific traffic patterns into the statistical model. Real customer deployments have achieved up to 98% vulnerability closure rates with consistent tuning and remediation. Includes one year priority support with dedicated contact (faster response, custom integration). On-site installation or audit available (customer covers travel expenses).