Authorized defensive security R&D

Defensive security research with measurable recovery outcomes

Mikronik is extending its systems, storage and automation work into controlled defensive-security research. Our current focus is ransomware resilience: detecting credible destructive behavior early, containing it across endpoint, network and storage layers, preserving volatile evidence, and proving recovery from protected storage state.

Owned / explicitly authorized systems onlyInternal defensive workflowsContainment-firstEvidence-driven validationNo customer-facing cyber access
PROVEN foundations

Storage recovery authority outside the endpoint

  • ZFS-backed block storage is operational in the controlled lab.
  • Authenticated block-storage access has been validated with a dedicated canary LUN.
  • Snapshot and rollback authority remains below the Windows-visible storage layer.
  • Control and evidence functions are separated from ordinary endpoint activity.
ACTIVE engineering

Hella Shield cross-layer containment

behavioral signal → process suspension → network containment → storage-session isolation → protected snapshot → volatile-evidence capture → recovery

The public description is intentionally architectural. Credentials, exact topology, private rulesets, low-level bypass logic and raw forensic artifacts are not published.

ACTIVE methodology

Measure the failure window, not the marketing claim

Our work is structured around repeatable controlled tests. We intend to publish measured containment and recovery results, including failure modes, rather than claim perfect prevention.

TTDtime to credible detection
TTCtime to containment
RTOtime to verified recovery
OPEN validation

What still has to be proven

  • Sub-second containment latency under realistic endpoint load.
  • False-positive and false-negative behavior across controlled simulator tests.
  • Amount of data modified before containment at different trigger thresholds.
  • Independent delayed or immutable recovery copy beyond the primary storage host.

Responsible-use boundary

Testing is limited to systems, applications, networks and data that Mikronik owns, operates or is explicitly authorized to analyze. The research is defensive and internal. We do not provide public exploit payloads, credential material, third-party attack access, or customer-facing access to higher-risk cybersecurity capabilities. Public documentation is deliberately sanitized while private test receipts, rollback proofs and benchmark evidence are retained for legitimate review.

Intended OpenAI Daybreak use

Mikronik intends to request organizational access for bounded internal defensive workflows. The expected use cases are threat modeling, malware and incident analysis, detection engineering, vulnerability triage, secure-code review, patch validation and controlled ransomware-resilience testing on owned or explicitly authorized systems.

Daybreak access, if approved, would be kept separate from customer-facing applications and would not be proxied or extended to external users.

Contribution objective

Our goal is not to claim novelty for established storage or security primitives. The contribution we are developing is a reproducible, low-cost cross-layer resilience design with measurable outcomes and documented failure cases.

Designed in-house: SunNAS / Hella Storage Fabric, our hybrid SAN/NAS research platform for protected recovery and bounded-damage measurement.

As the test program matures, this page will publish validated benchmarks and sanitized lessons that can help the broader defender community.

Start hereFlagship paperExperiment seriesContact MikronikBack to Mikronik