The technology
AEGIS is made of two parts: AegisForge finds and proves business-logic flaws, and AegisWall turns that proof into a live defense. These are the new techniques inside it. Every one below is built and backed by a passing test.
Project codename: M-SPD
Invented and proven
Fourteen techniques in three groups. Each one has a test that passes today.
AegisForge
The sword: finds and proves flaws
-
Differential Concurrency Proof
It sends the same action one at a time and then all at once, and reports a race bug only when the difference is statistically real, stopping early when it’s obvious and testing longer when it’s rare. Example: in our test app, a balance landed on 200 instead of 100 in 6 of 6 simultaneous tries and in 0 of 6 one-at-a-time tries.
Why a normal firewall or scanner can’t do thisScanners send fixed test inputs and report a “maybe”.
-
Money-reading oracle
It understands what a response means (success, duplicate, rejected, not yours) and reads the actual amounts. So it sees that value moved, from 100 to 200, about twice the right credit, not just that “the request worked”.
Why a normal firewall or scanner can’t do thisOther tools only see status codes and text.
-
Blind rule miner that admits when it’s safe
Given an app it knows nothing about, it works out the rule the app should follow (like “only once” or “only the owner”), tries to break it, and confirms the flaw on the buggy version while saying “defense verified” on the safe one. In our blind test it made zero false alarms on the safe build.
Why a normal firewall or scanner can’t do thisOther tools need hand-written rules or raise false alarms.
-
Two-language double check
AegisWall doesn’t simply trust AegisForge. It recomputes the statistics itself in a second programming language and accepts a finding only if both agree; otherwise it sets the finding aside in quarantine.
Why a normal firewall or scanner can’t do thisA single engine can’t catch its own math mistake.
AegisWall
The shield: blocks what breaks the rules
-
Logic Firewall
It blocks a 900 SAR refund on a 300 SAR payment, even though every field in the request is valid. The shop’s code doesn’t need to change.
Why a normal firewall or scanner can’t do thisOther tools look for bad text; they don’t know that “a refund can’t be more than what was paid”.
-
Self-approval guard
The same employee creates a payment and then approves it. Each request is fine on its own, but AegisWall blocks the approval.
Why a normal firewall or scanner can’t do thisOther tools have no idea that “the approver must be different from the creator”.
-
Find → prove → enforce
The proof AegisForge produces is turned into a live rule. The rule starts in watch-only mode, and a named person must approve it before it blocks anything.
Why a normal firewall or scanner can’t do thisOther tools hand you a PDF report.
-
Request order seal (Continuum Seal)
A signed ticket links each step to the one before it. A step sent out of order, replayed, or sent twice at the same moment is refused.
Why a normal firewall or scanner can’t do thisOther tools check each request alone and can’t see the order.
-
Learned normal traffic
It learns what normal requests look like and flags odd, attack-shaped input. Then it freezes what it learned, so an attacker can’t slowly “teach” it to accept attacks.
Why a normal firewall or scanner can’t do thisSimple learning filters can be slowly trained to accept attacks.
-
Fake success for attackers (Ghost Allow)
A flagged attacker sees “payment succeeded” while nothing actually happens, so they waste their time.
Why a normal firewall or scanner can’t do thisA normal firewall can only block; it can’t safely mislead an attacker.
-
AI-fix cage
When AI drafts a fix, the draft is sealed and tested inside a cage. It is never applied automatically.
Why a normal firewall or scanner can’t do thisOther tools risk pushing a bad AI fix live.
Proof
Shared by both parts
-
Finding-DNA sealed record
Every block and allow is chained together with SHA-256. Change one byte, and a one-command checker, available in two programming languages, shows exactly where.
Why a normal firewall or scanner can’t do thisOrdinary logs can be edited silently.
-
Receipts for allowed requests too (Proof-Carrying Allow)
Every allowed request gets a receipt of the checks it passed. So “why was this let through?” can be answered, not just “why was this blocked?”.
Why a normal firewall or scanner can’t do thisOther tools log blocks only.
-
Explainable blocks
Each block names the rule that was broken, the evidence behind it, and the matching Saudi NCA Essential Cybersecurity Controls (ECC) control.
Why a normal firewall or scanner can’t do thisOther tools show a rule ID number.
Built, waiting for live testing
The code for these is written. We’ll mark them proven only after they run against a real website we own.
-
Built · not yet tested on a live site
ACSM
Asynchronous Concurrency-Starvation Mapping
It sends one valid but heavy request and measures how long it ties up the server. It never floods the server with requests.
-
Built · not yet tested on a live site
Scanner checks
Names only. These checks are built but have not been run against a live site yet.
- SQL injection
- Template injection
- File-path tricks
- Command injection
- Reflected XSS
- SSRF with callback confirmation
- Open redirect
- CORS mistakes
- Slow regex (ReDoS)
- Exposed .env, .git and admin pages
- JWT token weaknesses
-
Built · not yet tested on a live site
More checks
- Workflow race testing across steps
- Session-token strength check
-
Built · not yet tested on a live site
AI-guided checks (local offline model)
Built, but not run in our tests.