MixMode
How Third-Wave AI is Revolutionizing Attack Detection and Security Automation

In an era marked by increasing cybersecurity breaches, organizations grapple with an
unprecedented challenge. Traditional tools are built to identify historically known attacks through
intelligence feeds, manual analysis, signature-based detection, and rules-based systems; however, they face a significant gap when it comes to new and novel, signature-less threats. According to the Ponemon Institute, over 80 percent of successful attacks use unknown techniques that lack recognizable signatures or precedents.

First generation machine learning and neural networks-based systems have dominated the cyber landscape for 20 years. These historical systems are trained using vast amounts of data, including historical threat feeds and telemetry from the network and endpoints, which can help operators see known attacks. In addition, machine learning algorithms, using this training data, can widen the aperture slightly to improve their ability to detect small variants of these historical attacks. While these platforms have proven to be useful in some regards, there are significant weaknesses with these systems. For example: inability to see unknown attacks (which are increasing rapidly with artificial intelligence); unmanageable alert volumes; and a requirement to write rules and maintain the systems with an increasing number of security personnel (which CISOs know are impossible to find and hire).

Amidst these developments, the promise of artificial intelligence (AI) is emerging to fill these gaps, complementing the rules-based systems with a more innovative, self-learning approach by learning a network’s normal behavior and pointing out the highest risk events (without relying on rules or signatures). AI 3.0, also known as third-wave artificial intelligence, represents the latest evolution in AI technology, characterized by its focus on contextual adaptation, explainability, and human-AI collaboration. Unlike its predecessors, AI 3.0 is designed to comprehend and adapt to complex real-world scenarios, provide transparent and explainable rationale for its decisions, and collaborate seamlessly with human operators. This paradigm shift in AI has profound implications for cybersecurity, as it enables AI systems to contextualize security events, discern subtle indicators of compromise, and collaborate effectively with security teams to mitigate emerging threats. This ensures that AI-based solutions can keep pace with the evolving threat landscape, providing a formidable defense against ever-evolving cyber threats.

At the forefront of this evolving cybersecurity technology, MixMode has emerged as a leading
enterprise cybersecurity entity that recognizes the significance of addressing new unknown novel attacks in various cybersecurity programs. It offers a patented, self-supervised learning platform designed to detect known and unknown threats in real-time across cloud, hybrid, or on-prem environments.

“MixMode was created using our patented time series foundational model to provide advanced threat detection at scale. Our proprietary AI technology leverages real time prediction capabilities to identify both incoming novel and legacy known attacks, resulting in alert precision, alert reduction, and significant time and cost savings for security teams,” says John Keister, CEO of MixMode.

The MixMode Platform, a pioneering advanced AI cybersecurity solution, utilizes third-wave AI, also known as AI 3.0, to revolutionize threat detection and response. Analyzing interactions among entities of all types in network and cloud environments, MixMode’s AI swiftly identifies deviations in behavior that merit investigation, demonstrating flexibility in learning networks and efficiently flagging potential issues.

This innovative platform enhances organizations’ security posture, fortifies threat detection capabilities, and promptly mitigates the potential impact of cyber-attacks on networks. It serves as a crucial component to increase efficiencies and augment and expedite the value derived from security information and event management (SIEM) and other legacy security tools.

Initiating the process of understanding typical network behavior enables MixMode to detect
both familiar and unprecedented attacks in real-time. By continually adapting to the ongoing changes in a network environment, the platform assesses whether a deviation in network behavior requires escalation to security personnel. This unique methodology enables MixMode to provide accurate real-time threat detection across network, cloud, or hybrid environments, identifying predictive and pre-attack behaviors, thus preventing attacks beforehand, avoiding a costly and damaging breach.

MixMode was created using our patented time series foundational model to provide advanced threat detection at scale. Our proprietary AI technology leverages real time prediction capabilities to identify both incoming novel and legacy known attacks, resulting in alert precision, alert reduction, and significant time and cost savings for security teams

MixMode’s versatility is evident in its seamless integration with various data types. Processing time series data efficiently, it delivers actionable insights within seconds, accommodating standard network data, cloud data (e.g., AWS flow logs, AWS CloudTrail), and compatibility with Azure and identity data, such as Okta, all within a single platform. The streamlined onboarding process for new customers, achieved through software-based solutions (without a requirement to purchase proprietary appliances), allows the system to quickly learn the environment and provide actionable insights within days. The platform’s flexibility to adapt and learn from its environment sets it apart. MixMode takes pride in its transparent approach, regularly engaging customers to provide clarity on alerts and foster a deeper understanding of its functionality.

This commitment to transparency recently proved invaluable for a Fortune 500 client facing a
significant AWS environment challenge, particularly with AWS Flow Logs and AWS CloudTrail.
They were struggling to detect unknown novel attacks efficiently due to the sheer volume of data. MixMode successfully addressed this issue by ingesting and analyzing hundreds of billions of records per month to provide specific AI analytics on high-risk events, including highlighting the elements leading up to it. The client, who had spent years attempting to solve this problem manually with a large team of AI engineers, expressed satisfaction with the streamlined security approach enabled by a combination of SOC expertise and advanced technology.

MixMode strongly emphasizes delivering tangible outcomes for customers, particularly in an
economic landscape where many face constraints on their cybersecurity budgets. It is
dedicated to providing value quickly, showcasing results by fully analyzing all available data to identify both known and unknown cyber threats. MixMode delivers customers the ability to reduce mean time to detection from the industry average of several months to mere minutes. The platform also enables companies to make their teams far more efficient by reducing the dependence on writing rules, maintenance, and manual hunting. This has resulted in one client saving more than $10 million per year versus their previous platform. MixMode envisions an exciting opportunity to assist large organizations in improving their capabilities, responding faster to threats, and optimizing resource utilization. The company’s approach promises to make cybersecurity more nimble and AI-driven, facilitating better decision-making for organizations looking to enhance their cybersecurity posture and optimize their security operations.