Black GhostAutonomous. Sovereign.
Cyber defense infrastructure for the AI era.
We build autonomous systems that observe digital environments, understand their behavior and respond to threats — within the policies your organization defines.
Argos in development · early access open
01Why now
AI accelerated the attack. Defense still runs at human speed.
Reconnaissance, exploitation, social engineering and evasion can already be automated. Most defense still depends on static rules, alert queues and manual analysis.
Conceptual representation: an automated attack goes through reconnaissance, initial access, execution, persistence and exfiltration while a manual defense is still at the alert queue, before triage, investigation and response.
Conceptual representation, not to time scale.
- Larger surface
- Endpoints, cloud, identities and services change every day.
- More telemetry
- Event volume has outgrown what people can read.
- Adaptive attacks
- Campaigns change with every run. Signatures fall behind.
- Manual response
- Every minute between alert and action favors the attacker.
- Control
- Strategic organizations need to decide where their own defense runs.
Our thesis
If attacks have become autonomous, defense has to become autonomous too.
02Black Ghost
Not another alerting tool. A new layer of defense infrastructure.
Black Ghost builds defense systems that run inside the customer’s environment, turn telemetry into context and respond to threats with minimal human intervention. The first one is Argos.
Product
Argos
Autonomous security agent.
A native agent that runs on the endpoint, understands how the environment behaves and executes the response — within the policies the organization defines.
- Runs
- On the endpoint, inside the customer environment
- Decides
- AI with context, bounded by policy
- Delivers
- Response, not just alerts
- Stage
- In development · early access
We start at the endpoint. The same architecture is designed to extend to cloud, network and identity.
- Endpointnow
- Cloudvision
- Networkvision
- Identityvision
03How Argos works
From event to response, inside your environment.
An example: a macro-enabled document starts an execution chain on a workstation. Follow how Argos turns isolated events into a decision.
Raw events · source: agent
- 14:02:06.912 authenticationlogon interactive user=m.alves
- 14:02:07.118 processexplorer.exe → winword.exe Proposal_Q3.docm
- 14:02:07.305 networkdns query update.microsoft.com
- 14:02:09.771 processwinword.exe → powershell.exe -nop -w hidden -enc SQBFAFgA…
- 14:02:09.802 processservices.exe → svchost.exe -k netsvcs -p
- 14:02:10.044 networkpowershell.exe → 203.0.113.42:443
- 14:02:10.390 filecreate %APPDATA%\svc\upd.dll
- 14:02:10.412 filemodify %PROGRAMDATA%\Teams\cache.db
- 14:02:10.655 registryset HKCU\…\CurrentVersion\Run\Updater
- 14:02:10.701 processpowershell.exe → rundll32.exe upd.dll,Start
Demonstration interface. Fictitious data. Argos in development.
01Telemetry
Observes.
The agent continuously collects process, network, file, registry and authentication events directly on the endpoint.
04Architecture
From endpoint to response. Every layer built in-house.
Argos is not an assembly of third-party tools. Agent, telemetry, correlation, intelligence and response are parts of a single architecture.
Conceptual representation. Models, parameters and implementation details are not published.
01
Endpoint
Native agent, lightweight and modular.
- Windows
- Linux
- macOS
02
Telemetry
Process, network, file, registry and authentication collectors, with a local event queue.
03
Normalization
A common event model, based on the Elastic Common Schema and extended for security.
- ECS
04
Correlation
Events linked by time, entity and causality into investigable chains.
05
Artificial intelligence
Edge AI
An efficient model next to the endpoint: low-latency classification and response.
Central
Deep analysis and correlation at scale.
06
Decision
A decision engine that checks every analysis against the organization’s policies and guardrails.
07
Response
Containment on the endpoint: terminate processes, block communication, isolate the host.
Trust foundation
- Agent identity
- Authenticated communication
- Integrity verification
- Secure updates
- Tamper protection
Conceptual representation. Models, parameters and implementation details are not published.
05Approach
What changes when defense is autonomous.
Antivirus, EDR, SIEM and SOC solved real problems. They were designed for a model in which people interpret every alert. Argos starts from a different premise.
| Dimension | Alert-centric model | Argos |
|---|---|---|
| Detection | Rules and signatures | Behavior and context |
| Signal | Isolated alerts in a queue | Events correlated into a chain |
| Decision | A person interprets every alert | Automated decision within policy |
| Response | Fixed playbooks, manual execution | Context-aware response, on the endpoint |
| Processing | All telemetry shipped out | Intelligence at the edge, close to the source |
| Control | Vendor infrastructure | Data, keys and policies under customer control |
Autonomy is not the absence of control.
AI interprets context. The organization’s policies set the limit of every action — and when a person has to approve.
- 01AI reasoning
- 02Context analysis
- 03Decision engine
- 04Policies & guardrails
- 05Autonomous response
06Sovereignty
Strategic security requires control over the technology behind it.
- 01Technological sovereigntyOwn technology instead of dependence on external black boxes.
- 02ControlOver infrastructure, data, keys and response policies.
- 03AutonomyOperating within the customer’s jurisdiction, without relying on external services to keep running.
- 04SecurityA defense that cannot be switched off by third-party decisions.
This is not about isolation. It is about capability: to choose, integrate, replace and keep operating regardless of external decisions.
We were born in Brazil, where depending on foreign technology for one’s own defense is a strategic issue. The same requirement applies to governments, critical infrastructure and regulated sectors in any country.
Built for
- Government & defense
- Energy & utilities
- Telecommunications
- Financial services
- Healthcare
- Industry
- Strategic technology
Sovereignty for Brazil.Autonomous security infrastructure for the world.
07Trust
Designed to go inside critical environments.
An autonomous agent inside critical infrastructure has to be trustworthy before anything else. That is why we build every layer ourselves.
01
Own engineering
The agent, ingestion pipeline, authentication, release distribution and operations interface are developed by Black Ghost.
02
Secure by design
Agent identity, authenticated communication, integrity verification and secure updates are part of the architecture from the start.
03
Local execution
Analysis and response happen close to the protected asset. Less sensitive data leaves the customer’s environment — and jurisdiction.
04
Offensive origin
Black Ghost was born in offensive security. Every architecture decision starts with one question: how would an attacker break this?
Founders
Engineers and security researchers, with backgrounds in software, distributed systems, artificial intelligence and offensive security.
About Black Ghost- João VitorCEO · Engineering & infrastructure
- PabloCTO · Architecture & distributed systems
- GuilhermeCAIO · Artificial intelligence
- Luís FelipeCISO · Offensive security & research
Offensive operations
Built by people who break into systems for a living.
While Argos is being built, our operators run real engagements. It keeps the product connected to how attacks actually happen.
08Access
Argos is in development. Early access is open.
We are looking for organizations that want to validate Argos in real environments and shape what gets built first.
Early access
Follow the development.
Join the early-access list. We reach out as Argos moves into new environments.
No spam. Only development updates.
Team
Talk to the founders.
Pilots, technology partnerships, investment or careers: the conversation is direct with the people building the product.