Why the model is never the first line of defence
Software that guesses does not get to declare an emergency. The layer order is a commitment, not a preference.
Rules and simulation are the spine. Statistical baselines sit above them, machine learning and graph analysis above that, invariants and fusion on top. The order is not an optimisation. It is a commitment, and inverting it is how a security product starts paging people on hallucinations.
Deterministic engines own every number
Severity, triggers and thresholds are set by code that can be read, replayed and argued with. A Safe delegatecall is never benign; that is a rule, not an inference. A transaction of the Bybit shape consults no model, because none would be more trustworthy than the rule.
This matters commercially as much as technically. A deterministic verdict can be handed to an auditor, quoted in a report and defended in a post-mortem. A confidence score cannot.
The model enriches, and it abstains
Model output is clamped in code and grounded against evidence the layers beneath it produced. Every claim cites specific evidence; with none, it abstains rather than improvising. A probabilistic signal can never, on its own, block a transaction or trip a breaker. It needs a deterministic anchor, every time, with no exception path.
That constraint costs recall on exactly the class of attack a model would catch first and explain worst. It is the correct trade for a system whose false alarm wakes a human at three in the morning and whose false silence costs nine figures.
More from the walls.
Post-block alerting is a receipt, not a defence
It tells you precisely how much you lost and exactly when you lost it. Both facts arrive too late to be worth anything.
6 min read
Your audit certified the code. The attacker is signing in as you.
Four incidents, four different mechanisms, and not one of them was a Solidity bug the auditors were asked to look for.
7 min read
Read and attest: capping the blast radius of your own vendor
The question nobody asks their monitoring vendor: what happens on the day the vendor is the one that gets breached?
6 min read
The next breach is already being dug.
Every engagement is scoped to your protocol by the team, and pricing follows that scope.