Xaion Trust Labs

The thesis

Identity was verified once. Behavior happens forever.

The hardest modern compromises happen entirely within legitimate boundaries — valid credentials, living-off-the-land techniques, AI-assisted automation that mimics a real operator. Signature-, rule- and TTP-based tools watch for known artifacts; the adversary watches behaviour. Xaion closes that gap by treating trust as a quantity continuously re-estimated from behaviour, not a gate opened once and forgotten.

Identity is checked once, at the door. Behaviour runs forever. An adversarial AI agent decays that trust slowly enough to clear every signature — and only continuous scoring catches the drift.

Verified onceA single identity gate at session start — then never re-checked.

Blind spotSignature & TTP tools stay flat. No artifact, no alert.

Adversarial AIMimics human rhythm, decaying trust too slowly to trip.

Trust layerXaion scores continuously and flags the drift early.

Inside the work

Where the research comes from.

A short look at Vaitrix — the offensive operations and adversary simulation that ground Xaion's behavioral models in the real world.

Vaitrix · 0:27

Press & recognition

Don't take our word for it. Take theirs.

Our founder Shesh Sarangdhar's cyber-intelligence work has been covered by national and global media — from cyber-terror attribution to large-scale social-media analysis. The interviews and reports below are public, third-party, and unedited.

Founder interviewYOUTUBE ↗

The Hacker News

Researchers to share details of cyber-terrorists targeting Indian government officials

2015

Read ↗

News18

How 355 Indians put the data of 5.6 lakh Facebook users at risk

2018

Read ↗

The Quint

Chinese social media: dissenting voices & questions to the CCP emerge

2020

Watch ↗

News18

Chinese citizens' anti-government posts on the Galwan clash seep through the iron curtain

2020

Read ↗

The architecture

Seven layers, one continuous verdict.

Compromise is behavioural deviation. The Xaion engine turns raw endpoint telemetry into a living trust signature, then measures, fuses and scores its drift in real time — across seven cooperating layers, from signal to decision.

Signal Collection

2,000+ signals · 120/900/3600s

Feature Engineering

1,024+ feature vector

Behavioural Trust Layer

adaptive behavioural signature

Divergence Detection

drift · novelty · peer/fleet

Fusion Intelligence

ensemble + Bayesian fusion

Continuous Trust Scoring

explainable score ∈ [0,1]

Product Layer

detect · authenticate · prevent

Applications

One trust signal. Many products.

The same explainable trust score drives the product layer — and embeds into the tools defenders already run, reaching the credential-takeover, insider and AI-assisted attacks that point-in-time security can't.

A · 01

Behavior-aware EDR

Endpoint detection that reasons about whether an action fits the entity's learned behavior — surfacing living-off-the-land and insider activity that signatures and static rules miss entirely.

process lineageinsiderLOLBins

A · 02

Adaptive IDS / IPS

Intrusion detection and prevention that weights every flow by behavioral trust, cutting false positives and prioritizing the deviations that genuinely break an entity's distribution.

flow scoringlow FPinline

A · 03

Continuous authentication

Identity confirmed every moment, not just at login. Trust decays the instant behavior diverges, triggering step-up or session revocation before damage is done.

session truststep-upzero-trust

A · 04

Anomaly detection

A general-purpose behavioral anomaly engine for users, machine identities and autonomous agents — calibrated, explainable, and tunable to your tolerance for risk.

UEBAagent trustexplainable

Research & method

High-dimensional. Multi-timescale. Explainable.

Xaion is a research-first lab. Our work, Behavioural Trust Modelling, evaluates system integrity from ~1,274 high-dimensional behavioural variables across multiple time horizons, using a hybrid of statistical and neural methods — chosen for rigor and interpretability, because a trust decision you can't explain is one you can't trust.

xaion://trust-engine · score.py

# continuous trust score from fused behavioural signals
# windows: 120s / 900s / 3600s   ·   features ≈ 1,274

def trust_score(x_t, entity):
    mu, sd  = baseline[entity]            # MIDAS / EWMA baseline
    z       = (x_t - mu) / sd            # statistical deviation
    s_base  = anomaly(z)
    s_cpd   = page_hinkley(x_t, entity)   # change-point / drift
    s_rec   = autoencoder.error(x_t)      # reconstruction error
    s_drift = embedding_drift(encode(x_t)) # concept drift
    s_peer  = fleet_divergence(x_t, entity)# peer / fleet

    # fuse weak + strong indicators → [0,1]
    T = sigmoid(a*s_base + b*s_rec + g*s_drift + d*s_cpd + e*s_peer)

    if T < THRESHOLD:
        emit("trust_decay", entity, explain=decompose(T))
    return TrustScore(T, contributors=decompose(T))

[ M1 ] MIDAS statistical baseline

EWMA-normalized rolling statistics model each entity's normal behaviour and adapt to legitimate change. Deviation is a calibrated z-score.
Z_t = ( X_t − μ_t ) / σ_t
[ M2 ] Change-point detection

Page-Hinkley and CUSUM track cumulative change in the mean to catch both abrupt shifts and slow, low-and-slow drift.
PH / CUSUM → ΔX_t > θ
[ M3 ] Neural autoencoder

A learned latent model reconstructs expected behaviour; high reconstruction error flags structural anomaly the baseline can't see.
E_t = ‖ X_t − X̂_t ‖²
[ M4 ] Embedding-drift detection

Distance between live and reference embeddings (cosine / Mahalanobis / KL) surfaces gradual concept drift over long horizons.
D_t = d( z_t , z̄ )
[ M5 ] Fleet intelligence & fusion

Cross-entity comparison detects coordinated, distributed activity; an ensemble fuses every indicator into one calibrated trust score.
T_t = σ( αS_base + βS_neural + γS_drift + δS_cpd )
[ M6 ] Explainable & privacy-aware

Every score decomposes into the contributors that drove it, and is built on timing, geometry, counts and rates — not sensitive content.
decompose(T_t) → ranked contributors

Continuity of trust

Trust is a state, with decay and recovery.

Rather than a binary verdict, each entity holds a modelled trust state that decays as anomalies accumulate and recovers as behaviour returns to baseline — every transition attributable to understandable contributors.

Stable

within bounds

Watch

mild anomaly

Degrading

accumulating

Challenged

step-up / gate

Disrupted

continuity broken

Recovering

returning

// State transitions are asymmetric — recovery demands stronger temporal consistency than decay requires to raise concern.

~1,274

High-dimensional behavioural variables per entity

120·900·3600s

Multi-timescale windows — burst to long-term drift

Hybrid

Statistical + neural + temporal + fleet context

Linux·Win·macOS

Cross-platform agents (macOS on the roadmap)

Selected research

Working papers from the lab.

Working paper

Behavioural Trust Modelling: A High-Dimensional Approach to Security

Introduces continuous behavioural trust modelling — integrating baseline statistics, change-point detection, neural autoencoders and embedding-drift analysis into a single continuous trust score — and shows earlier detection of credential abuse, slow insider threats and AI-assisted attacks than event-based approaches.

Statistical + neural · multi-timescale

Specification

Behaviour Trust Layer — Ontology v1

A formal, privacy-aware, cross-platform semantic model for trust-relevant signals: a clean signal universe, entity model, canonical naming, causal relationships and trust-state definitions with decay and recovery contributors — the foundation for explainable trust scoring.

Cross-platform · explainability-first

0.94

entity trust

Why a trust layer

A measurable foundation, not another alert.

24/7

Trust re-estimated continuously, per entity

0–1

Single calibrated score, not raw anomalies

1 API

Embeds across your existing defense stack

σ ↑

Statistical rigor with explainable output

The lab

Research that ships. Offense that informs it.

Xaion Trust Labs is the research and product arm — we build the behavior trust layer. Our offensive-security sibling, Vaitrix, stress-tests the real world. The loop between them keeps our models honest.

Xaion exists to make trust a first-class, measurable quantity in security systems. We pair advanced statistical modelling with modern AI to build the layer that detection and response tools have been missing — one that understands behavior over time, scores it, and explains itself.

Our mission is to deliver decisive cyber and AI-driven advantage that helps enterprises and intelligence agencies detect, disrupt, and neutralize threats before they manifest in the physical world. Everything we learn from adversaries in the field — through Vaitrix — flows back into the models. Everything we model gives defenders a foundation that doesn't expire at login.

RESEARCH · PRODUCT

The behavior trust layer — statistical and AI models for continuous trust scoring, anomaly detection and continuous authentication.

Request research access →

SERVICES · OFFENSE

Vaitrix

Red teaming, offensive security and DevSecOps — adversary simulation that pressure-tests defenses and feeds Xaion's research.

Visit vaitrix.co.in ↗

Trust is not
a moment.
It's a distribution.

Identity was verified once. Behavior happens forever.

Where the research comes from.

Don't take our word for it. Take theirs.

Researchers to share details of cyber-terrorists targeting Indian government officials

How 355 Indians put the data of 5.6 lakh Facebook users at risk

Chinese social media: dissenting voices & questions to the CCP emerge

Chinese citizens' anti-government posts on the Galwan clash seep through the iron curtain

Seven layers, one continuous verdict.

One trust signal. Many products.

Behavior-aware EDR

Adaptive IDS / IPS

Continuous authentication

Anomaly detection

High-dimensional. Multi-timescale. Explainable.

[ M1 ] MIDAS statistical baseline

[ M2 ] Change-point detection

[ M3 ] Neural autoencoder

[ M4 ] Embedding-drift detection

[ M5 ] Fleet intelligence & fusion

[ M6 ] Explainable & privacy-aware

Trust is a state, with decay and recovery.

Working papers from the lab.

Behavioural Trust Modelling: A High-Dimensional Approach to Security

Behaviour Trust Layer — Ontology v1

A measurable foundation, not another alert.

Research that ships. Offense that informs it.

Xaion Trust Labs

Vaitrix

Build on a foundation
of measured trust.

Identity was verified once. Behavior happens forever.

Where the research comes from.

Don't take our word for it. Take theirs.

Researchers to share details of cyber-terrorists targeting Indian government officials

How 355 Indians put the data of 5.6 lakh Facebook users at risk

Chinese social media: dissenting voices & questions to the CCP emerge

Chinese citizens' anti-government posts on the Galwan clash seep through the iron curtain

Seven layers, one continuous verdict.

One trust signal. Many products.

Behavior-aware EDR

Adaptive IDS / IPS

Continuous authentication

Anomaly detection

High-dimensional. Multi-timescale. Explainable.

[ M1 ] MIDAS statistical baseline

[ M2 ] Change-point detection

[ M3 ] Neural autoencoder

[ M4 ] Embedding-drift detection

[ M5 ] Fleet intelligence & fusion

[ M6 ] Explainable & privacy-aware

Trust is a state, with decay and recovery.

Working papers from the lab.

Behavioural Trust Modelling: A High-Dimensional Approach to Security

Behaviour Trust Layer — Ontology v1

A measurable foundation, not another alert.

Research that ships. Offense that informs it.

Xaion Trust Labs

Vaitrix

Build on a foundationof measured trust.

Build on a foundation
of measured trust.