RESEARCH
Measuring our own engine.
Security marketing is full of detection rates with no methodology attached. When we publish numbers, the method comes with them — including the ones that are unflattering.
Nothing published yet
The engine is still in early access, and publishing efficacy numbers before there is a fleet to measure would be marketing rather than research. This page lists what we intend to cover so the commitment is on the record.
What we plan to publish
Pre-execution intent scoring
How execution pathways are simulated inside a three-second budget, and where that approach is strong and weak compared with post-execution behavioural detection.
False-positive economics
A blocked legitimate file costs a user more than most vendors admit. We track the rate against a sub-5% target and intend to publish the methodology alongside the number.
Fileless and living-off-the-land
Memory injection and abuse of signed system binaries leave no file to scan. What interception at the platform level catches, and what it does not.
Rule efficacy
Which rules actually fire on real detections versus which merely add scan cost — measured across the fleet, from consented aggregate data only.
Where our data comes from
Only from customers who opted in, and only as hashes, rule names and scores for items that were blocked. File contents are never uploaded — not for research, and not for training. That constraint limits what we can study, and we accept the limit rather than the alternative. The detail is in the privacy policy.
Researcher with a sample set, a bypass, or a disagreement with our method? We would rather hear it — security@zerowrite.ai.