01detection
Detect breaches.
Cyber attacks must communicate over the network. Network communication has observable shape. Prophet models that shape at enterprise scale and detects when your network has been breached with near-zero false positives.
01post-breach operating layer
Network detectionand attackreconstructioninfrastructure.
Detects modern breaches with near-zero false positives.
Reconstructs the full attack provenance chain.
- detection
- modern breaches
- reconstruction
- access → egress
- telemetry
- network + host
- delivery
- as a service
- architecture
- first principles
- interaction
- console + CLI
A slowly rotating three-dimensional wire mesh represents ordinary network communication. Ivory and slate wires connect nearby points. A lavender trace introduces longer, branching relationships across that existing manifold, making imposed activity visible without replacing the communication around it. This is an explanatory illustration, not live network data or product output.
Prophet is network detection and attack reconstruction infrastructure delivered as a service. Customers deploy lightweight collectors wherever traffic exists; Prophet operates everything behind them. Prophet models network-wide communication and detects activity imposed by an attacker. It reconstructs the full provenance chain of the attack: how the attacker got in, which identity they used, what they ran, how they moved, what they collected, and where the data went. Prophet returns the reconstruction as an evidence-backed case instead of a raw alert.
02reconstruction
Reconstruct attacks.
Prophet reconstructs the full attack provenance chain across access, identity, execution, movement, collection, and egress. The result is an evidence-backed case with the remaining unknown made explicit.
Prophet uses a distributed collection topology. Lightweight collectors deploy wherever traffic originates: containers, Kubernetes nodes, VMs, cloud environments, physical infrastructure, taps, endpoints, and any OS. They extract communication shape as compact telemetry and, on hosts, preserve the process, session, and identity context behind each flow. Network telemetry drives detection; host context supports reconstruction. Prophet operates collection, reconciliation, storage, inference, and reconstruction as one service.
Deploy collectors.
Deploy lightweight collectors with a single command across Linux, Windows, Docker, Kubernetes, VMs, cloud environments, endpoints, or taps. Collectors extract communication shape and protocol metadata - DNS, HTTP, TLS, and flow behavior - and stream compact telemetry to Prophet. Configuration is managed centrally in the Prophet console. Prophet's ingest and storage infrastructure scales horizontally to handle any traffic volume.
deploy nodeesc
dockerlinux / macwindowskubernetes
curl -sSL https://dev.prophet.io/install | bash -s -- pt_de4d46fa7e22▣connection status
waiting for node to connect...
approve node
configure
optional configuration
descriptionVMWare virtual switch tap
profilenone (default config)
tagssan-jose DC▌
Detect breaches.
Prophet models your network-wide communication shape deeply enough to learn what the network produces on its own. Exogenous activity imposed by an attacker becomes visible as a departure from that behavior.
Detection12K targets · 16 cases
CRITICAL Confirmed malicious activity on Docker Swarm cluster. Off-distribution TLS beaconing from swarm-edge-04.
01:26 PM
Benign - scheduled Veeam backup. Telemetry across upload events is structurally identical.
12:23 AM
Reconstruct attacks.
When breach signal appears, Prophet reconstructs the full attack provenance chain: how the attacker got in, which identity they used, what they ran, how they moved, what they collected, and where the data went. It tests competing explanations and returns an evidence-backed case with each fact labeled observed, inferred, or unavailable.
discriminatorhigh
April upload tooling is statistically incompatible with the March session.
April session: 78 flows, IQR 172-236 MB, mean duration 1.3s - no distributional overlap with March.
verify
April 9 flows to files.slack.comdiscriminatorhigh
Session used a pre-stored Slack token.
No credential acquisition preceded the upload.
verify
DNS queries pre-onset windowcorroboratorhigh
Four never-seen Tailscale IPs aligned with upload escalation.
First contact appeared 4 min 10 s before the upload spike.
Ask Prophet.
Ask Prophet any question about your network traffic. It runs a deep search across months of traffic collected across your enterprise, follows pivots across flow and protocol telemetry, and returns the answer.
what external services is my network sending traffic to?
Thinking3.9s
Good question. I'll fan out across destination organizations, ports/protocols, and application-layer services.
subagent
exploretop destination orgs by upload bytes
got 160,041 hitssubagent
exploretop dest port:protocol pairs by flow count
got 160,111 hitssubagent
exploretop TLS SNIs by flow count
thinking...answerexternal SaaS and cloud destinations dominate the last 15m.ready
context /⌘K
message prophet or type / for commandsA mature cyber attack is an active, distributed adversarial presence living inside the enterprise. After initial breach, it uses the enterprise fabric as the substrate for its own proliferation. It is optimized for stealth, novel expression, leverage, and eventual destruction.
Its power is distributed orchestration: the ability to coordinate communications and activities across a surface too large to reduce to one artifact, one path, one host, or one known technique.
Its weakness is its nervous system: the network communications that keep the system coherent.
Detecting mature cyber attacks requires modeling what the enterprise network produces on its own, so precisely that an adversarial communication system becomes visible as exogenous activity imposed within the network.
Existing cyber architectures are built to detect and prevent initial access. They are poorly suited for the attacker activity that follows breach.
Mature attacks are distributed adversarial systems. Their events are fragments, not the system. Their coherence lives in communication.
Modern defense assumes breach and detects what happens after.
Start with a coverage package. Add Nodes and Devices as your network grows.
- Nodes
- Where you install Prophet Node: a server, virtual machine, firewall, or a host collecting mirrored traffic.
- Devices
- Other machines observed on your network: laptops, phones, printers and IoT. A Node’s own machine is never also billed as a Device.
Choose your billing period
Personal
For individual networks and personal infrastructure.
$100/ month
Billed monthly
- 3 Nodes included
- 15 Devices included
Team
For shared infrastructure and growing teams.
$200/ month
Billed monthly
- 10 Nodes included
- 50 Devices included
Enterprise
For larger deployments and custom operating requirements.
Custom
Typically from $5,000/month
- Custom retention and service levels
- Contract and procurement terms
Every plan includes full detection and autonomous attack reconstruction.
No per-seat tax. No per-alert tax.Enterprise agreements are scoped around your operating requirements and the SOC capacity Prophet replaces, rather than the self-serve usage rates below.
Estimate your coverage
Beyond your package: $15 per Node and $2 per Device, with lower Device rates above 500.
Machines running Prophet Node.
Other observed machines. Exclude your Nodes.
The estimator picks the lower-priced package for your footprint.
Personal package + usage
$100/ month
Billed monthly
- Personal package
- $100
- 0 additional Nodes × $15
- $0
- 0 additional Devices
- $0
Includes 3 Nodes and 15 Devices before additional usage.
Self-serve covers up to 100 Nodes and monthly package-plus-usage totals below $5,000, before annual discounts. Larger deployments, or those needing contract terms, use Enterprise.
How Device usage is priced
- 1–500 Devices
- $2 / Device / month
- 501–2,000 Devices
- $1.50 / Device / month
- 2,001+ Devices
- $1 / Device / month
Bands use your total Device count. Each rate applies only within its band; your package’s included Devices are not charged.
Devices are distinct machines, not addresses. Addresses Prophet cannot reliably associate with a machine are not billed as Devices.
Devices are counted at your network’s busiest hour each month. Prophet confirms usage from 30 days of observation; any pricing change is prospective, never retroactive.
Packages assume typical traffic. Sustained high-throughput deployments may require a different package or an Enterprise agreement.