Detecting what conventional toolsnever see.
A firewall recognizes what it already knows. An intrusion using valid credentials, at a plausible hour, from a credible address, triggers nothing. Our approach compares every activity against normal behavior — and surfaces whatever falls outside it.
The findings
of French companies were hit by ransomware in 2024 — the highest rate in Europe.
Sophos, State of Ransomware 2024
more data exfiltrations in 2025 than in 2024: attackers are after theft, not encryption.
ANSSI, Cybersecurity Threat Landscape 2025
of victims take more than a month to recover — versus 24 % in 2023.
Sophos, State of Ransomware 2024
The public sector, healthcare, local authorities and educational institutions are among the most affected targets — because they combine critical data with constrained resources.
Our approach
Behaviour-based detection, alongside the tools you already run
Your firewalls, antivirus and SIEM already apply rules and, for the most recent ones, behavioural analysis. We are not adding another layer: we correlate those signals with what your tools do not know — your real business usage and how your AI agents behave. The goal is to make visible what currently goes unnoticed, without replacing what already works.
Continuous correlation of weak signals
Login times, locations, volumes, sequences of actions, unusual access: taken in isolation, these signals mean nothing. Correlated, they outline an anomaly. The agent connects what no single tool connects.
Alert qualification: who, what, when, how severe
When a signal falls outside the norm, the agent gathers the context: who is acting, on what, when, how severe, and what has already been affected. The alert arrives actionable, not as a raw log. The delay depends on volume and configuration — it is measured with you during scoping.
The decision stays human
The agent detects, qualifies and alerts. It does not block an operation on its own. A security system that gets it wrong alone costs more than it protects: that is why human validation remains mandatory for sensitive actions.
What we analyze
Different surfaces, one same principle: compare against normal behavior and surface the gap.
Hijacked credentials
A legitimate account used by someone else: detection through a behavioral fingerprint (times, tools consulted, types of operations, volumes).
Phishing and fraudulent emails
Analysis of content, sender, links and context — not just keywords. Alert at the decisive moment, before the click.
Server and workstation vulnerabilities
Identification of exposed configurations and abnormal behavior on machines, prioritized by criticality.
Suspicious transactions and activities
Continuous analysis of operations and access to sensitive data, compared against each account's habits.
AI agent drift
Supervision of agents in production: hallucinations, bias, prohibited calls, with adjustable thresholds and an audit trail.
Networks and flows
Detection of abnormal exchanges between systems, unusual data movements and out-of-scope connections.
What the solution does — and what it does not do
We prefer to set the limits ourselves. A security system whose reach is overestimated is a dangerous system.
What we do
- Continuously analyze the activities and access you make visible to us
- Compare against usual behavior and flag significant deviations
- Qualify each alert: who, what, when, severity, affected scope
- Log every detection in a verifiable way (audit trail)
- Support you in documenting compliance (GDPR, EU AI Act)
- Adapt thresholds to your business context to limit false positives
What we do not do
- We do not guarantee exhaustive detection of every threat
- We do not automatically block your operations: the decision stays human
- We do not replace your CISO or your legal obligations
- We do not certify your compliance: we help you document it
- We guarantee no result when logs are incomplete
- We do not handle incident response or remediation
Comment nous opérons cette approche
Cette page décrit notre méthode de détection. Elle est mise en œuvre dans VerAI Shield, notre solution de cybersécurité et de conformité AI Act : périmètre, offres et engagements de service y sont détaillés.
Découvrir VerAI ShieldConditions and caveats
The following points frame our detection services. They are reflected in our contractual terms and apply to every deployment.
- Decision-support tool. The system produces alerts and analyses. It does not replace the judgment of your teams, who retain control over decisions and actions.
- Customer responsibility. The security of your systems, regulatory compliance and the decisions taken from alerts remain your responsibility. Our work transfers neither your legal obligations nor the responsibility for your infrastructure.
- Dependence on the data provided. Detection relevance depends on the completeness, quality and freshness of the logs and activity sources you make accessible to us. Partial coverage produces partial detection.
- No guarantee of exhaustiveness. No detection system, whatever the technology used, guarantees the identification of every threat. We commit to means and a method, not to an exhaustive result.
- Compliance: support, not certification. We provide the documentary elements useful for a compliance process (register, traceability, risk-analysis support). Effective compliance is established by you or by a third-party auditor.
- Personal data. Behavioural analysis may process personal data. Its implementation requires a GDPR framework defined with you (purpose, retention period, information of data subjects) before any deployment.
These caveats are not a stylistic precaution: they define what we can honestly claim. They are detailed in our contractual terms, provided before any signature.
Assess your exposure
A conversation identifies your most exposed surfaces and what is realistically detectable with your current logs.