Defenders today process an overwhelming amount of raw data that needs to be boiled down to an understandable cybersecurity incident. Instead of just reiterating analysts’ findings and adding more noise, cybersecurity technologies should support them by identifying what matters and help them act before the attackers can achieve their goals. That is the problem ESET’s correlation engine ESET LiveCortex, and its specialized cybersecurity model ESET NeoCortex, are designed to solve.

The problem does not lie in lack of data

Modern security environments generate an extraordinary volume of events. Endpoints, identities, cloud workloads, networks and applications all contribute evidence. The hard part is sorting through it all and deciding which signals belong together, which ones increase the risk, and what actions – if any – should follow.

For a security analyst, a thousand technically correct alerts can still equal poor performance, as every alert requires attention, context and decision, causing alert fatigue. For a buyer, the same problem manifests in growing operational costs, as there’s more telemetry to move, retain and search, more tooling to tune, and more analyst time spent reconstructing an attack from evidence scattered all over the environment.

We built ESET LiveCortex to change that logic. Instead of handing the customer another stream of raw observations, it correlates and enriches data across protected perimeters into incidents, prioritizes the results, responds where appropriate, or presents actionable guidance when human input and decision is needed.

ESET LiveCortex is the technology customers experience

In plain language, ESET LiveCortex is the nerve center of protection for business environments. It connects weak signals – that may look harmless in isolation – builds them into a coherent incident, and prioritizes them, separating urgent work from the noise.

This matters because many attacks are not a single obviously malicious event. They are chains of often benign activities distributed over time including sign-in anomalies, a suspicious process launch, an unusual connection, configuration changes and a later attempt to access data. Each of those points is insignificant enough to fly below the radar, but together they might form a catastrophic incident. The defender understands how those events relate, yet might miss the attack due to a flood of other alerts.

Within our XDR platform ESET PROTECT, ESET LiveCortex reduces the amount of manual searching needed to understand an incident. Defenders receive a more curated and actionable view, while business users are less likely to be interrupted by avoidable investigations and repeated alerts.

This is currently a B2B story: the capability is designed for organizations and the security professionals or service teams protecting them.

ESET NeoCortex: the specialized world model that will never go rogue

One of the technologies helping to power this approach within ESET LiveCortex is ESET NeoCortex – our own specialized proprietary cybersecurity model. It combines language-model capabilities with a world-model approach focused on security incidents.

Where a large language model is good at representing and reproducing language, a world model learns how a system behaves, what states are possible, how events relate, and what may happen after a given sequence or action. In cybersecurity, that "world" is not a physical room, but a continuously changing digital environment that attackers are trying to penetrate.

Combined, the world model and the language model go from full understanding of what has already happened, to estimating what could plausibly happen next and simulating the effect of a defensive action before taking it.

In a world where AI agents can threaten both their builders and innocent third parties, NeoCortex is designed to never go rogue and always remain under control. It uses read-only tools, runs in tightly restricted sandboxes, and logs activity at the source, destination, and network levels. On top of that, continuous monitoring, strict budgets on tokens, and a kill switch keep its work in check – with a human expert in the loop when it comes to critical decisions.

Why not just send the data to a general-purpose LLM?

Because operational understanding matters much more than fluency in any given topic.

First, a general-purpose LLM is optimized to produce plausible sequences of text across almost any domain. But security operations need consistent decisions over structured, time-dependent and adversarial evidence.
More importantly, raw telemetry is not a normal conversation consisting of only easily-understandable language and relations. It contains entities, timestamps, indicators, process relationships and partial observations that must be correlated and interpreted as a whole.
Also, attackers can deliberately manipulate content that will be processed by an LLM. ESET research has already observed this behavior, specifically via the GuardBreaker case, where a malicious comment in the code attempted to trigger an LLM’s safety guardrails and stop analysis before the malicious code was reached.
A model call alone is not enough to defend against most attacks. It is just a single layer, and as ESET’s 40 years in cybersecurity show, reliable security requires a lot more, including deterministic controls, specialized models, correlation logic, validation, auditability, human expert oversight and constrained response mechanisms. There’s no silver bullet.
Sending broad telemetry and potentially sensitive proprietary information to an external general-purpose service can introduce cost, data-governance and dependency questions that are distinctive from running a purpose-built model under ESET’s control.

Now, generally available LLMs have their uses but ESET utilizes such frontier models only where they add value. The point is that critical detection and correlation workloads should not depend on a single general-purpose model or a single external provider. A layered design lets each component do the job for which it is best suited, especially when it comes to defending business environments.

Why specialized models are more accurate

The accuracy of a cybersecurity model depends on context. A generic model may recognize security vocabulary, but it has not necessarily learned which combinations of endpoint, identity, cloud and network events form a meaningful incident in ESET-protected environment. ESET NeoCortex is trained for incident understanding using cybersecurity-specific vocabulary, data and objectives.

What makes the model specialized is its ability to:

reconstruct missing parts of incident context
create compact incident representations called embeddings
and identify which events are surprising in relation to the rest of an incident.

That is much closer to the real operational problem than asking a general model an open-ended question such as "Is this an incident?".

An embedding can be thought of as an incident’s index card. It is not the full book, but it captures enough of the meaning and structure to place similar incidents near one another. This enables search, similarity, grouping and clustering without rereading every raw event from the beginning.

From lower model cost to customer value

ESET’s internal research indicates that training a world model such as ESET NeoCortex requires substantially less compute than training a large general reasoning model, but how does that translate into any benefit for the customer? The devil hides in the details of what a smaller, specialized, self-hosted model enables:

Swift and frequent improvement cycles as new incident patterns and product needs appear.
Lower infrastructure overhead for operating the necessary capability at scale.
Predictable processing and no pay-per-token dependency for the core model.
Deployment control for sovereignty-sensitive and regulated environments.
The ability to focus compute on the security context that changes a decision instead of burning it on broad and sometimes excess conversational capability.
Independence from third-party vendors.

Can synthetic data replace ESET’s real-world data?

Synthetic data is useful. It can expand rare scenarios, support privacy-preserving experimentation with real-world data and test a model against deliberately varied cases, yet it is not a full substitute for real incident data.

Generated examples inherit the assumptions and blind spots of the process that created them. They can reproduce known attack patterns convincingly while missing the messy, incomplete and constantly shifting relationships that appear in real environments. They also struggle to reproduce benign activity and its distribution, which is key to avoiding false positives.

Plus, ESET’s advantage is not data volume alone. It is the combination of decades’ worth global telemetry, threat intelligence, malware research, carefully classified samples, incident context, product feedback and experienced defenders, who can evaluate the model’s decisions. The defensibility lies in the feedback loop between data, expertise, deployed protection, and product outcomes.

From time-to-react to time-before-impact

Most security metrics start the clock after something has happened, such as “time to detect”, “time to investigate” and “time to respond”. A world-model approach suggests a more ambitious target: identify the likely continuation of an attack chain while there is still time to interrupt it.

We describe this direction as "minus-one-day defense". It does not mean predicting an unknown vulnerability before it exists. It means using the partial incident already visible in a customer environment, together with patterns learned from previous incidents, to estimate the attackers’ next plausible moves before they make them.

For example, if a sequence resembles incidents in which credential access was followed by lateral movement and then data collection, the system could raise the relevance of the indicators that point towards those transitions. The prediction is a ranked set of plausible next states, not a claim of certainty. It must be paired with confidence, evidence and safe response controls.

The value for the customer is the chance to move the decision point earlier. Instead of reacting only after the damaging stage, defenders can prepare, verify or block the attackers’ likely next step while the attack is still in progress.

Actionable security without becoming another data warehouse

SIEM platforms remain important for broad search, compliance, detection engineering and investigation. ESET LiveCortex is not a SIEM replacement. Its role is different: to produce high-fidelity, contextual incidents and automate containment where ESET has enough confidence and control.

That distinction matters economically. Many SIEM commercial models scale with ingested data volume and retention. Sending every low-value event to an expensive analytics tier can increase costs without improving the analyst’s decision. By correlating and reducing noise earlier, ESET LiveCortex can help customers work from a smaller set of actionable security objects while retaining the right underlying evidence for investigation and policy needs.

The internal telemetry funnel illustrates the design goal: only a small fraction of tens of billions of raw events should become customer-visible incidents.

What ESET NeoCortex unlocks next

The immediate value is better incident understanding and representation – less noise, more readily available context. The longer-term opportunity is a set of product experiences that reduce repetitive work and make expert knowledge reusable:Why ESET can build this

A startup can hire excellent researchers and generate large amounts of synthetic data. Building a dependable cybersecurity world model still requires a wider system:

Real-world threat and incident data gathered through deployed protection, with appropriate privacy and governance.
A feedback loop that shows whether the model improved real security outcomes instead of relying on a laboratory benchmark.
Human experts who understand malware, attacker behavior, threat intelligence, incident response and product operations based on decades of experience.
Infrastructure for data pipelines, training, evaluation, secure deployment, monitoring and continuous improvement.
A product platform where model outputs can become investigation context, recommendations and constrained response actions.
Long-term control of critical model, data and infrastructure dependencies.

This is also why the team behind the model is broader than an AI research group. AI researchers and ML engineers are essential, but so are data engineers, infrastructure and networking specialists, security researchers, operations teams, product managers, UX designers, privacy and legal experts, quality engineers and production owners.

Why ESET can build this

A startup can hire excellent researchers and generate large amounts of synthetic data. Building a dependable cybersecurity world model still requires a wider system:

Real-world threat and incident data gathered through deployed protection, with appropriate privacy and governance.
A feedback loop that shows whether the model improved real security outcomes instead of relying on a laboratory benchmark.
Human experts who understand malware, attacker behavior, threat intelligence, incident response and product operations based on decades of experience.
Infrastructure for data pipelines, training, evaluation, secure deployment, monitoring and continuous improvement.
A product platform where model outputs can become investigation context, recommendations and constrained response actions.
Long-term control of critical model, data and infrastructure dependencies.

Sovereignty is operational resilience

ESET will continue using frontier models where they are the right tool. Being sovereign does not mean rejecting the global AI ecosystem or claiming that every dependency remains in customer’s region. It means identifying which workloads are too critical to leave entirely outside our control, then designing for continuity, transparent governance and practical alternatives.

For ESET NeoCortex and critical security workloads, control over the model and processing environment reduces exposure to abrupt changes in provider, commercial or geopolitical spheres. It also gives ESET greater visibility and oversight over how the technology is trained, evaluated, updated and constrained.

ESET’s continuous and long-term AI investment has paved the way to independent security-first foundational models, a layered AI security stack and a new-generation AI SOC. The purpose is not independence for the sake of independence, but to give customers durable protection when circumstances outside their control suddenly change.

A different unit of progress

The AI race is often described in model size, benchmark scores and parameter count. In cybersecurity, the more useful measure is the quality of the output delivered to the defender.

ESET LiveCortex and ESET NeoCortex are built around that outcome – fewer disconnected signals, more coherent incidents, earlier understanding of what an attacker may do next, and safer paths from evidence to action. The aim is not to replace the analyst with a chatbot. It is to make expert security judgment available at the scale and speed of the protected environment.