Skip to content

Aegis

Research preview

Security intelligence,built in-house.

Aegis is our family of cybersecurity-specialized AI models, the reasoning layer behind every Notealy investigation. We develop it through dataset engineering, evaluation, and fine-tuning, and we measure every version in the open.

Follow progressRead the reports
Family
Aegis
Current version
Aegis-1 · Development build
Fine-tuned
Not yet
Latest report
Report 001, November 4, 2026

01Architecture

Three layers,kept independent.

Model development stays separate from the enterprise product, so Aegis can be evaluated and versioned on its own.

  1. Enterprise product

    Notealy Platform

    Workspaces, assets, findings, remediation, alerts, reporting, and audit trails, with strict tenant isolation.

  2. Orchestration

    Notealy Security Engine

    Coordinates specialized security tools, collects evidence, runs agents, and retests. Tools verify; the model reasons.

  3. AI model family

    Aegis

    Our cybersecurity-specialized language models for security reasoning, classification, and structured analysis.

02Aegis-1

Where Aegis-1stands today.

An open-weight base model with defensive-security instructions. It has not been fine-tuned yet; it is the starting point that future versions are measured against.

Research goals

  • Understand source code security and reason about root causes
  • Classify weaknesses accurately against the MITRE CWE taxonomy
  • Interpret security telemetry and assessment evidence
  • Recommend defensive mitigations and secure code fixes
  • Use security tools through structured interfaces
  • Recognize uncertainty instead of fabricating findings

What we measure

  • False positives
  • False negatives
  • CWE classification accuracy
  • Evidence quality
  • Remediation success
  • Regression detection
  • Latency and inference cost
Read Report 001: Baseline evaluation of Aegis-1

03Training data

Provenance first,then scale.

Every source is checked for licensing and privacy before it is used, and benchmarks are kept strictly separate from training data.

  • OWASP knowledge

    Application security guidance and weakness classes.

  • MITRE CWE and ATT&CK

    The taxonomies findings are classified against.

  • Vulnerability intelligence

    CVE records and known-exploited vulnerability data.

  • Licensed code examples

    Publicly licensed vulnerable and fixed code, with provenance tracked.

  • Synthetic applications

    Purpose-built vulnerable apps for controlled, authorized testing.

  • Reviewed remediations

    Fix examples checked before they are used for training.

Confidential customer pentest reports are never incorporated into shared model training without explicit authorization.

Keep exploring

Notealy

Let's talk aboutyour security.

Interested in Notealy Platform for your organization, or in our research? Tell us about your environment and your security program.

Talk to us