AI · Cybersecurity
EmberXAI
An AI threat-detection platform that doesn't just flag malware — it explains why, with audit-grade reasoning for every alert.
Industry
AI · Cybersecurity
Year
2025
Duration
20 weeks
Team
1 ML engineer, 2 backend engineers, 1 frontend engineer, 1 product designer
Results
Outcomes, measured.
99.2%
Detection accuracy
On the customer's holdout test set, beating the previous vendor by 4.1pp.
180 ms
P95 detection latency
End-to-end including LLM-generated explanation.
100%
Audit explainability
Every alert ships with a human-readable rationale and feature attribution.
63%
Analyst time saved
False-positive triage cut by nearly two-thirds.
The challenge
What was broken.
- Security teams won't trust an AI black box. The product needed to flag malware accurately AND explain its reasoning in human-readable terms.
- Detection latency needed to stay under 200ms for real-time scanning at scale — millions of files per day per customer.
- Audit trail had to be tamper-evident: every detection, every explanation, every analyst override needed to be cryptographically logged.
Our approach
How we solved it.
- Built a layered detection pipeline: signature matching → static analysis → ML classifier → LLM-powered explanation generator. Each layer's contribution is logged and surfaced.
- Used PyTorch for the core classifier with feature attribution (Integrated Gradients) so every prediction comes with the top features that drove it.
- Tuned the architecture for latency: ClickHouse for hot detection data, Redis for caching, Kubernetes for horizontal scale during scan bursts.
- Implemented an immutable audit log on top of an append-only ledger with hash-chained entries — analysts can override but every override is preserved.
What we built
Concrete deliverables.
ML classifier with feature attribution and confidence scoring
LLM-powered explanation layer with safety filtering
Real-time scanning API on FastAPI + Kubernetes
Analyst console with detection review, override, and triage workflow
Tamper-evident audit log with cryptographic integrity
Customer-facing reports with regulatory-friendly formatting
Tech stack
PythonPyTorchFastAPIClickHouseRedisKubernetesAWSOpenAIPostgreSQL
Services used
The capabilities behind this build.
AI Solutions
LLM agents, retrieval pipelines, and ML integrations that unlock real business leverage — not demos.
Read more
SaaS Product Development
Zero to revenue. Multi-tenant architecture, billing, auth, dashboards, analytics — done properly.
Read more
API Integrations
Payments, identity, messaging, analytics — integrated with rock-solid reliability and clean abstractions.
Read more
Want to ship something like this?
Tell us your problem. We'll come back with a plan, timeline, and fixed pricing.