Aura is not a generic LLM with a security wrapper. It's a purpose-built model trained on European attack data, optimized for sub-60-second response, and deployed entirely within EU jurisdiction.
Most AI security products take a generic foundation model and bolt security prompts onto it. That works for chat and basic classification — but it doesn't catch what hasn't been seen before, and it certainly doesn't run inside European jurisdiction.
Aura is built differently. It's a specialized detection model trained from the ground up on European attack patterns — DNS abuse, web application exploitation, AI-generated phishing, credential theft kits, ransomware C2 traffic. It runs on our own GPUs in EU data centres. It never calls out to OpenAI, Anthropic, or Google APIs. The intelligence stays where the data stays.
Every module in ProtectionGrid feeds telemetry into Aura. Cross-module correlation is what makes attacks visible that any single module would miss.
Continuous inference pipeline. Ingests events from all six modules, enriches them with global threat intelligence, scores risk in real time, and pushes mitigation actions back to the relevant module within seconds.
Latency budget is the most important number in defense. Every step here has a measured target.
Every event from every module — every blocked request, login, email, DNS query — streams into Aura via a low-latency event bus. No batching, no waiting.
Context is added: user identity history, device posture, IP reputation, current threat intelligence feeds, related events from sibling modules within the customer's tenant.
The model evaluates the enriched event against learned attack patterns — producing a risk score, an attack-type classification, and a confidence level.
High-confidence threats trigger automatic mitigation in the relevant module — block, quarantine, step-up auth, or notify. Low-confidence events route to human review.
The most important question for any security AI is "where does the training data come from?" Here's our answer.
Aura is trained on threat data observed across our European customer base — DNS abuse seen in DACH, phishing campaigns targeting EU financial services, ransomware C2 patterns from regional incident response. European attackers exploit European infrastructure differently than US-targeted attackers.
Critically: customer data is never used as training input without explicit opt-in. Threat patterns are extracted in aggregate, anonymized, and never linked back to individual tenants.
No customer data without opt-inGeneric foundation models are trained once and then locked. Aura runs a continuous training pipeline: new threat data is incorporated daily, new attack patterns trigger model updates within hours, and weekly evaluations measure detection rates against held-out validation sets.
When attackers shift tactics, Aura adapts before the next customer is hit. That's the entire point of running our own model in our own infrastructure.
24/7 training pipelineWe don't publish detection-rate vanity stats. These are the operational metrics CISOs ask about.
From event ingestion to executed mitigation in the relevant module — across all six surfaces. P99 latency target is set at 90 seconds; we typically run well below.
Aggressive blocking with low false positives is what separates production-ready security AI from research demos. Under 0.5% on legitimate traffic is our internal SLO.
Aura inference runs in active-active mode across multiple EU regions. If one region degrades, traffic shifts within seconds — no waiting for failover, no operator intervention.
Aura is not a hosted SaaS layer over OpenAI or Anthropic. We run our own inference infrastructure on dedicated GPUs in colocation facilities across Germany, Ireland, Portugal and Cyprus. No data ever leaves European jurisdiction.
For customers with strict sovereignty requirements (financial services, public sector, KRITIS), single-tenant deployments are available — your traffic, your model instance, your dedicated hardware.
Our engineering team runs technical deep-dives for prospective customers — architecture review, threat modeling against your specific environment, latency walkthroughs, and live Q&A. Typically 60 minutes, signed NDA, no marketing.