Strega Byte was founded as an innovative startup to bring what happens in research labs into everyday products. We have a single focus area, and it is a crossroads: cybersecurity and artificial intelligence, together.
Attackers already use artificial intelligence to write flawless phishing emails and scan for open doors automatically. Whoever defends a small network cannot fall behind, but cannot hire an expert either. Our research works exactly here: bringing intelligent defence to places with no IT department.
For us artificial intelligence is not a word to print on the box. It is the tool that lets a Box in a ten-person office understand what it sees, explain it in plain words and act immediately, without leaving the decision to people whose job is not security.
Models that learn what a normal day on a small network looks like and recognise what departs from it, even with little data and no analyst to tune them.
How long must a network be observed before the unusual can be told apart from the dangerous?
How do we keep false alarms below one a week per site?
Turning a technical alarm into a message an owner understands and can act on: observed fact, interpretation, recommended action. Language models only work on non-binding text, with rules and human review.
Which words make a person act without frightening them?
How do we guarantee a generated explanation stays faithful to the event?
Combining weak signals that say nothing on their own (a DNS lookup, a failed login, a traffic spike) into a recognisable situation, enriched with the reputation of addresses and domains.
Which combinations of events foreshadow an attack on a ten-person office?
Small offices are starting to use AI assistants and agents too. We study how to protect them: data leaking to external services, malicious instructions hidden in documents, control over what an agent may do.
How can a network notice that an AI assistant is sending confidential data out of the office?
Protecting without surveilling: minimised browsing logs, pseudonymised devices in reports, limited retention. Security must not turn into remote monitoring of employees.
How much can we see in order to protect, without seeing too much?
Predefined actions that start automatically when the risk is clear (blocking an address or a country, isolating a device), with limited and reversible effects and a tamper-evident log (entries chained by cryptographic hashes). The system decides and acts; the owner gets the explanation, the technician the details.
When is an automatic action safe enough to start without asking anyone?
Project targets: they will be measured and published at the end of the pilot.
We start from mature open source technologies reviewed by large communities, such as OPNsense and Suricata, and put research where it adds value: interpreting, explaining, deciding.
Every hypothesis goes through the pilot programme: real installations, weekly measures of useful alerts, false alarms and response times.
Our articles of association commit us to working with universities, research centres and companies, including in national and European funded programmes. Our doors are open.
Explicit targets: over 80% of alerts rated useful by the client, response within 4 working hours, fewer than one useless alert a week per site.
We are looking for partners for theses, industrial PhDs, national and European funded projects and field trials. We have a line of innovative, high-performing and robust products.
