MAGICIAN Platform

Transcend anything seen or felt before by crafting sovereign cyber autonomy for India.

India's Sovereign Autonomous EDR & AI-SOC Platform

MAGICIAN is an on-soil AI security analyst that lives inside your own network. It spots attacks, investigates them, and stops them in about a second and a half — with no foreign cloud, no internet, and no 24/7 human SOC shift to hire. Built from the kernel up with ring-0 C ELAM drivers and an on-device 3-billion-parameter ReAct AI agent.

Sovereign Cyber Autonomy. Zero Cloud Telemetry. 1.48s On-Device Containment.

Request Enterprise PoC See How It Works

Scroll down

0.00s

Median Time to Containment

Autonomous neutralization of ransomware and advanced persistent threats (APTs) directly on-device — always under 2.1 seconds.

0LOC

Pure Sovereign Core

Verified clean lines of code across Rust Core, C/C++ ELAM Kernel Drivers, Linux eBPF, and Python (Zero bloat).

0Bps

Zero Cloud Telemetry Leakage

100% on-premise and air-gapped. Zero bytes of sensitive memory dumps or logs leave the sovereign network perimeter.

0ms

Hardware Network Severance

Dynamic Windows Filtering Platform (WFP) isolation speed upon detection of lateral movement.

Sovereign Cyber Autonomy ✦Zero Human SOC Dependency ✦1.48s On-Device Containment ✦Registered with iStart Rajasthan ✦Udyam Registered MSME ✦CERT-In 2022 Aligned ✦Viksit Bharat 2047 Cyber Sovereignty Goals ✦ Sovereign Cyber Autonomy ✦Zero Human SOC Dependency ✦1.48s On-Device Containment ✦Registered with iStart Rajasthan ✦Udyam Registered MSME ✦CERT-In 2022 Aligned ✦Viksit Bharat 2047 Cyber Sovereignty Goals ✦

01 / Mission & Sovereign Mandate

A sovereign leader in groundbreaking cyber defense, we help forward-thinking national infrastructure achieve impact, autonomy and growth.

Startup Registration

Recognized by iStart Rajasthan

Department of Information Technology & Communication (DoIT&C), Government of Rajasthan.

DoIT&C // Govt. of Rajasthan

MSME Registration

Registered MSME Enterprise

Officially registered with the Ministry of Micro, Small & Medium Enterprises, Government of India.

Ministry of MSME // Govt. of India

National Alignment

Cyber Sovereignty Goals

Aligned with National Cyber Security Directives and the Viksit Bharat 2047 Cyber Sovereignty Goals.

CERT-In 2022 · Viksit Bharat 2047

Ahamoris Labs is registered with iStart Rajasthan; the programme's curation process is currently active.

Registered with iStart Rajasthan (DoIT&C, Govt. of Rajasthan) Udyam Registered MSME Aligned with National Cyber Security Directives Viksit Bharat 2047 Cyber Sovereignty Goals

R&D Center & Engineering Labs

India's Defense Dilemma & the Human SOC Bottleneck

02 / The Macro Problem

India's digital backbone — banks, hospitals, power grids, defense networks — is guarded by tools it does not own, analysed by people it does not have enough of.

Problem 01

3 vendors

The Foreign Endpoint Oligopoly

CrowdStrike, SentinelOne and Microsoft Defender control enterprise endpoint defense. India has had zero Tier-1 sovereign alternative.

Problem 02

$8B+

The Foreign License Drain

A critical currency outflow: recurring dollar licenses paid to foreign vendors, year after year, for protection India cannot inspect.

Problem 03

Jul 2024

The Global Outage Lesson

One faulty CrowdStrike update grounded airlines, hospitals and stock exchanges worldwide. Concentrated foreign cloud dependency is an existential national security risk.

Problem 04

1M+

The Analyst Deficit & Alert Fatigue

India faces a shortfall of over one million cyber analysts. Humans need 16–48 hours to triage an alert — attackers deploy ransomware in minutes.

The Speed Gap

Attackers move in minutes. Human SOCs move in days.

Ransomware deploys

Minutes

Human analyst triage

16–48 hrs

Cloud EDR containment

15–45 min

MAGICIAN on-device AI

1.48 sec

Illustrative, non-linear scale — bar length conveys relative order of magnitude, not exact proportion.

In plain wordsImagine your whole country's locks are made abroad, the keys are held abroad, and a night-watch team that can't keep up reads the alarms. That is the gap MAGICIAN closes.

Zero Human SOC Dependency

03 / The MAGICIAN Solution

Tier-1/Tier-2 SOC payroll saved, every year

₹0Lakhs+

Traditional EDRs flood consoles with thousands of false alarms, forcing enterprises to staff 24/7 human SOC shifts. MAGICIAN's autonomous ReAct AI is an always-on, on-soil analyst that makes those shifts unnecessary.

In plain wordsInstead of hiring a night-shift team to read alarms, MAGICIAN reads, understands and handles them itself — in seconds, inside your building.

The old way

Legacy EDR + Human SOC

Thousands of false alarms per day
24/7 Tier-1 & Tier-2 analyst shifts
₹40 Lakhs+ in annual payroll
16–48 hours to triage an alert
Telemetry shipped to a foreign cloud

The MAGICIAN way

Autonomous AI Analyst

Machine-speed reasoning over raw telemetry
Investigates alerts & auto-writes the RCA
Surgical containment in <2.1s (1.48s median)
No Tier-1/Tier-2 human shifts required
Everything stays on your own hardware

Step 01

Detect

Kernel sensors stream process telemetry; the math filter flags anomalies instantly.

<10 ms

Step 02

Investigate

The on-device AI reasons over multi-process behaviour like a senior analyst would.

Machine speed

Step 03

Explain (RCA)

An automated Root Cause Analysis dossier is compiled for audit and humans.

Automated

Step 04

Contain

Process trees killed, shadow copies frozen, the network severed — surgically.

<2.1 s · 1.48 s median

₹6,000 – ₹8,000per endpoint / year

Tier-1 enterprise defense, priced for Indian budgets.

80% lower TCOvs CrowdStrike

Versus $280–$420 per node per year (₹23,000–₹35,000).

88% gross marginsustainable by design

On-premise delivery with no per-customer cloud burn.

Interactive · Savings Estimator

What would your fleet save?

Endpoints protected1,000

Illustrative estimate using mid-range list pricing: CrowdStrike ≈ ₹29,000/node/yr, MAGICIAN ≈ ₹7,000/node/yr, plus ₹40 Lakhs/yr of Tier-1/Tier-2 SOC payroll avoided. Actual quotes vary.

Foreign EDR licences

—

Human SOC payroll

—

MAGICIAN all-in

—

Estimated annual saving
—

—

The 3 Billion Parameter On-Device ReAct AI Engine

04 / Dual-Brain Architecture

A localized, 4-bit quantized 3B-parameter Small Language Model — magician-3b-agent — running directly on-premise on standard hardware. No expensive cloud GPUs. No external internet.

Input

Raw Process Telemetry

Syscalls, process trees, file writes, sockets, memory events from the kernel sensors.

➔

Tier 1 · <10 ms

Mathematical Anomaly Filter

High-speed statistical ensemble drops the noise at the millisecond layer.

Isolation ForestLocal Outlier FactorElliptic Envelope

➔

Tier 2 · 3B Generative Reasoner

Autonomous ReAct Cognitive Loop

Only the suspicious few reach the AI, which thinks, acts and verifies.

Thought➔ Action➔ Observation

➔

Output

Containment + RCA Dossier

Surgical kill / freeze / sever, and a signed incident report in the local vault.

Column A · Dual Architecture

Featherweight Endpoint Sensor + Sovereign AI-SOC Core.

An ultra-lean sensor on client endpoints captures kernel signals and streams encrypted telemetry to your dedicated MAGICIAN Core — deployed on-premise or in your private Indian cloud.

Endpoint SensorRust / C / eBPF (<45 MB RAM)

Central AI Brainmagician-3b-agent (3B ReAct)

DeploymentOn-Premise / Sovereign Cloud

Foreign Cloud LeakageZero Bytes

SOC Shift DependencyZero (Saves ₹40L+/year)

Column B · Dual-Brain

A fast reflex, and a thoughtful mind.

Tier 1 is the reflex: a mathematical ensemble (Isolation Forest + Local Outlier Factor + Elliptic Envelope) that screens raw telemetry in under 10 ms.

Tier 2 is the mind: the 3B generative reasoner that investigates what Tier 1 flags, using the ReAct loop — so the AI is never wasted on noise, and real attacks are never missed.

In plain wordsTier 1 is a smoke detector. Tier 2 is a firefighter who walks in, finds the source, and puts it out.

Column C · Air-Gapped Advantage

Nothing leaves the building.

0Bps

Cloud telemetry leakage. Zero bytes of memory dumps or sensitive logs ever cross your network perimeter.

Classified military bases
Banking core networks
Nuclear installations
Fully operational with the internet unplugged

Interactive · The ReAct Loop

Thought ➔ Action ➔ Observation

magician://3b-agent.thought

05 / Engineering

Proprietary 7-Layer Sovereign Defense Stack

Every layer is sovereign, verified and air-gapped — from ring-0 boot silence to tamper-proof national audit vaults. Hover a layer to see where it sits.

L7 · Sovereign Data Vault L6 · ITDR · SIEM · Attack Graph L5 · Static PE & Behavioral ML L4 · In-Memory AMSI & ETW L3 · WFP Dynamic Severance L2 · Linux eBPF & Kprobes L1 · Ring-0 ELAM Driver

LAYER 1

Ring-0 C/C++ ELAM Driver

Early Launch Anti-Malware driver that initializes before the OS boot finishes — protecting against bootkits, rootkits and BYOVD (Bring-Your-Own-Vulnerable-Driver) attacks.

In plain words: the guard is already standing at the gate before the building opens.

Ring-0
Pre-boot
Anti-BYOVD

LAYER 2

Linux eBPF & Kernel Kprobes

Zero-overhead kernel hook engine compiling directly to Linux kernel bytecode (agent-linux/ebpf), tracing privileged sys_enter_execve syscalls with negligible 0.12% CPU overhead.

In plain words: a silent camera inside the Linux kernel that records every program launch without slowing the machine.

eBPF
0.12% CPU
sys_enter_execve

LAYER 3

Hardware WFP Dynamic Severance

Windows Filtering Platform sublayer filtering that isolates compromised endpoints in <18ms while preserving an encrypted administrative SOC tunnel.

In plain words: it digitally unplugs the infected PC from the network in a blink — but leaves one secure line open for your admins.

<18ms isolation
Encrypted SOC tunnel

LAYER 4

In-Memory AMSI & ETW Interceptors

Intercepts fileless scripts, memory patching and reflective DLL injection in real time — attacks that never touch the disk.

In plain words: it reads malicious instructions while they are still in the computer's memory, where antivirus normally can't look.

AMSI
ETW
Fileless defense

LAYER 5

Static PE & Behavioral Analysis

EMBER-trained machine learning scores every Portable Executable binary before it is allowed to run, then watches its behaviour after launch.

In plain words: every program gets a risk score at the door — before it ever gets inside.

EMBER-trained ML
Pre-execution scoring

LAYER 6

Unified ITDR, SIEM & Attack Graph Pipeline

Real-time Active Directory threat detection — Kerberoasting, privilege escalation — correlated into an attack graph and mapped to MITRE ATT&CK.

In plain words: it connects the dots across many machines and users to show the attacker's complete path.

Kerberoasting
Privilege escalation
MITRE ATT&CK

LAYER 7

Air-Gapped Sovereign Data Vault

Hardware TPM 2.0-anchored, append-only Merkle-tree log vault ensuring 180-day continuous tamper-proof audit trails in strict compliance with CERT-In 2022 national cybersecurity directives.

In plain words: a sealed diary that nobody — not even an attacker with admin rights — can quietly rewrite.

TPM 2.0
Merkle tree
180-day retention
CERT-In 2022

CyberBridge: Human-in-the-Loop & 4-Eyes Control

06 / Safety Governance

Autonomy with accountability. You choose how much freedom the AI gets — and high-impact actions always need two humans.

Dual Operating Modes

Autonomous Mode vs Draft Mode

Autonomous: sub-second machine containment — the AI investigates and acts on its own.

magician://cyberbridge.console

Press “Simulate Incident” to watch the selected mode in action.

4-Eyes Cryptographic Approval

High-impact actions need two keys.

Full network isolation or killing a critical process enforces dual-supervisor authorization. Each supervisor signs the action with HMAC-SHA256 — nothing executes until both signatures verify.

Supervisor A— awaiting signature —

Supervisor B— awaiting signature —

● LOCKED — 0 of 2 signatures. Action blocked.

In plain wordsLike a bank vault that needs two managers to turn two keys. One person alone — or one hacked account — can never trigger the most disruptive actions.

Asymmetric Case Study Showcase

07 / The Immersive Defense Garden

01 01 / Ring-0 C ELAM & eBPF Kprobes

The Kernel Autonomy

Kernel-level telemetry intercepting privileged execution before OS boot completion.

C ELAM Driver
Linux eBPF Kprobes
0.12% CPU Overhead
Zero User-Mode Bypass

magician://kernel.telemetry

[INIT_ELAM] DriverObject: 0xFFFFB8000492E010[HOOK_SSDT] NtCreateProcessEx intercepted at Ring-0[EBPF_PROBE] sys_enter_execve attaches to cgroup[STATUS] Zero privileged bypass vectors detected.

02 02 / On-Device 3B ReAct AI

The 1.48s Detonation

Eliminating the 15–45 minute cloud upload delay of legacy EDRs. Isolating ransomware in 1.48s on-device.

3B Small LM (4-bit)
Air-Gapped Inference
MITRE ATT&CK T1486 Alignment
Zero Cloud Latency

magician://react.detonation

[THREAT] MITRE ATT&CK T1486 (Cryptor Ransomware)[THOUGHT] High-entropy write sequence across C:\Data[ACTION] Suspend PID 4920 & Snapshot VSS Shadow Copies[RESULT] Threat isolated in 1.48 seconds. 0 Bps sent to cloud.

03 03 / Hardware Packet Severance

18ms WFP Dynamic Cut

Sub-20ms packet filter isolation stopping lateral propagation across subnets while keeping the SOC tunnel alive.

WFP Dynamic Sublayer
< 18ms Severance Latency
Zero Lateral Spread
Preserved SOC Tunnel

magician://wfp.severance

[C2_ALERT] Beaconing attempt to 194.26.29.11:443[WFP_SEVER] FwpmFilterAdd0 invoked with WEIGHT_MAX[DROP_RULE] Block all egress IPv4/IPv6 traffic for PID 4920[ISOLATION] Node quarantined from 10.0.0.0/8 in 17.4ms

04 04 / National Defense & Banking

Sovereign Air-Gap Vault

Purpose-built for military defense bases, space establishments, and banking networks that operate strictly offline.

100% Offline Autonomy
CERT-In 180-Day Logs
TPM 2.0 Cryptographic Vault
Zero Foreign Exposure

magician://vault.sovereign

[STORAGE] Append-Only Sovereign Write-Once Vault[AUDIT] Continuous 180-Day Immutable Log Retention[HASH_CHAIN] Merkle-Tree root signed with local TPM 2.0[COMPLIANCE] CERT-In 2022 Directive Retention Verified

Interactive Threat Detonation Lab

08 / Live Simulation Chamber

A scripted simulation to illustrate the Thought ➔ Action ➔ Observation flow. Timings shown are representative on-device results.

Containment Speed1.48 Seconds

Data Leakage0.00 Bytes

magician://detonation.chamber — air-gapped

CrowdStrike Falcon vs Ahamoris MAGICIAN

09 / Head-to-Head Matrix

Criterion

CrowdStrike Falcon

Ahamoris MAGICIAN

Data Sovereignty

Foreign US Cloud / AWS

100% Indian On-Premise / Air-Gapped

Containment Speed

15 to 45 minutes (cloud delay)

<2.1 seconds, autonomous on-device (1.48s median)

Offline Resilience

Severely degraded without internet

100% fully autonomous offline

Agent Footprint

Variable

<45MB RAM footprint

Cost / TCO

₹23,000–₹35,000/node/yr ($280–$420)

₹6,000–₹8,000/node/yr + ₹40L SOC payroll saved

CERT-In 180-Day Compliance

Expensive local SIEM add-ons needed

Native built-in TPM 2.0 vault included

Competitor figures reflect publicly reported list pricing and architecture and are provided for general comparison. MAGICIAN figures are Ahamoris Labs internal measurements.

Architectural Leadership

10 / Founder

Founder & Chief Architect
Ahamoris Labs

Abhay Singh Taknet

Founder & Chief Architect, Ahamoris Labs

“India cannot protect its critical nuclear, defense, and economic assets using black-box algorithms hosted on foreign cloud servers. True security is sovereign security.”

MAGICIAN was engineered by Abhay Singh Taknet over four years (1,400+ days) of deep R&D to make Indian defense establishments, critical infrastructure, and enterprises completely self-reliant and impervious to foreign cloud dependencies.

0Years of R&D

0+Days of R&D

0Chief Architect

abhaytaknet@gmail.com

11 / Enterprise Engagement Request Enterprise PoC

For CISOs, defense architects, government curators and partners: let's run MAGICIAN on your own network and watch it work — with the internet unplugged.

Defense Evaluation Inquiry Explore Kernel Architecture Experience Detonation

Founder & Chief Architect: abhaytaknet@gmail.com Business Manager (Ayush Chejara): kumawatayush82@gmail.com General: contact@ahamoris.com