Greycortex Archives - Version 2 Limited

The Illusion of Complete Protection: Why Firewalls and EDR Aren’t Enough

While firewalls and endpoint agents (EDR) are crucial pillars of any cybersecurity strategy, their visibility is strictly limited to their specific domains. Whatever occurs outside of the network perimeter or off a managed endpoint falls into a massive security blind spot. This briefing addresses why traditional perimeters fall short and how Network Detection and Response (NDR) bridges the critical gaps left behind.

The Core Defenses: Perimeters and Endpoints

To understand the vulnerability of modern networks, we must first define the limits of our foundational tools:

The Firewall (The Gatekeeper): Operating at the network edge, modern firewalls excel at filtering inbound and outbound traffic, keeping external threats at bay and sensitive data inside. However, once a threat bypasses the perimeter, the firewall is blind to it.
Endpoint Tools (The Internal Guards): Agents installed on laptops, workstations, and servers monitor local activity—such as anomalous logins or rogue encryption attempts. They are highly effective, but only if they can be installed. Unmanaged devices are entirely invisible to them.

Everything situated between the perimeter and the managed endpoint—internal device-to-device traffic, IoT devices, BYOD, and legacy hardware—operates in the shadows. This is precisely where malicious behavior can incubate for weeks without triggering a single alert.

The Industry Consensus: NIST & MITRE ATT&CK

Relying on a single line of defense is a flawed strategy. Much like a physical building requires locks, internal alarms, and cameras to ensure comprehensive security, a network requires overlapping layers of protection.

Leading cybersecurity frameworks echo this necessity for Defense in Depth:

NIST Cybersecurity Framework: Mandates multi-layered detection capabilities spanning the perimeter, the endpoints, and internal network communications to ensure threats missed by one layer are intercepted by another.
MITRE ATT&CK: Details the complete lifecycle of cyberattacks, highlighting how lateral movement, initial access, and data exfiltration frequently leave absolutely no forensic evidence on firewalls or endpoints.

Bridging the Void: The Role of Network Detection and Response (NDR)

Modern adversaries easily bypass basic defenses using legitimate credentials, AI-generated evasion tactics, and encrypted tunnels. Network Detection and Response (NDR) is designed specifically to eliminate the blind spots where these advanced threats hide.

Critical Visibility Gaps Resolved by NDR

The Security Gap	How NDR Solves It
East-West Traffic (Lateral Movement)	Once inside, attackers move between internal devices. This traffic never hits the firewall, and EDR agents can be disabled. NDR passively monitors all internal communications, instantly flagging anomalous lateral movement.
Agentless Environments (IoT/OT)	Industrial sensors, medical equipment, cameras, and printers cannot run endpoint software. NDR secures these devices seamlessly by analyzing their network behavior patterns without requiring agent installation.
Credential Abuse & Insider Threats	When a threat actor utilizes valid login credentials, endpoint tools perceive the activity as normal. NDR identifies the behavioral anomalies—such as a user accessing unprecedented systems or initiating unusual data transfers.
Incident Forensics & Compliance	Firewalls discard traffic payloads, and EDR only logs local host data. NDR retains rich network metadata and full packet captures, providing the exact forensic evidence required by strict regulatory mandates like NIS2 and DORA.

Auditing Your Infrastructure: Uncovering Configuration Flaws

Beyond active threat hunting, NDR provides a pristine, unfiltered view of your actual network architecture, revealing systemic vulnerabilities that traditional tools ignore:

Shadow IT Eradication: Corporate networks inevitably gather unapproved hardware—rogue access points, personal devices, and forgotten test environments. NDR detects every communicating asset, highlighting unauthorized network access immediately.
Exposing Legacy Vulnerabilities: Outdated services, expired SSL certificates, and vulnerable legacy protocols easily pass through firewalls if technically permitted by the rule set. NDR identifies these weak links and traces them to specific devices.
Validating Firewall Policy Drift: Over time, firewall rules become bloated with forgotten exceptions, temporary vendor access, and obsolete troubleshooting ports. By comparing actual network traffic against intended policies, NDR exposes the open doors that should have been locked long ago.

Achieving Comprehensive Network Clarity

Firewalls and EDR agents remain indispensable, but treating them as a complete cybersecurity architecture leaves your organization dangerously exposed. GREYCORTEX Mendel introduces the definitive layer of passive network monitoring required to close these gaps. By analyzing every connection, device, and behavioral deviation, it integrates seamlessly with your existing infrastructure—without burdening your endpoints or disrupting network flow.

Curious about the blind spots in your current security architecture?

Run a comprehensive network security audit with GREYCORTEX Mendel and uncover the hidden traffic that your firewalls and endpoints are missing.

About GREYCORTEX
GREYCORTEX uses advanced artificial intelligence, machine learning, and data mining methods to help organizations make their IT operations secure and reliable.

MENDEL, GREYCORTEX’s network traffic analysis solution, helps corporations, governments, and the critical infrastructure sector protect their futures by detecting cyber threats to sensitive data, networks, trade secrets, and reputations, which other network security products miss.

MENDEL is based on 10 years of extensive academic research and is designed using the same technology which was successful in four US-based NIST Challenges.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Greycortex 2026

Detecting and Investigating Lateral Movement: A Network Traffic Analysis Framework

A Technical Guide to Identifying Malicious Pivots, Abused Administrative Protocols, and Incident Triaging Workflows via Passive Network Detection and Response (NDR)

Strategic Threat Briefing: Lateral movement represents one of the most critical execution phases of an internal breach. Unlike external exploitation vectors, an adversary navigating your internal network rarely introduces custom malicious tooling; instead, they hijack legitimate, built-in administrative services to blend into normal baseline traffic. This framework details how to leverage passive, agentless network-level telemetry—such as GREYCORTEX Mendel—to expose unauthorized pivots, differentiate malicious commands from routine IT administration, and map structural attack chains in real time.

The Illusion of Administrative Normalcy

The core challenge in isolating lateral movement lies in the nature of the protocols involved. Services like SMB, RDP, and PSExec form the operational foundation of daily Windows enterprise infrastructure. Because these channels are ubiquitous, threat actors deliberately weaponize them to map internal subnets, locate high-value active directories, and exfiltrate staging assets without triggering traditional perimeter defense alarms.

To expose these hidden threat layers, security analysts must shift focus from single file-scanning controls to comprehensive network metadata analysis, checking what occurred before a connection was established and tracking where a host pivoted immediately afterward.

Analyzing the Four Primary Protocol Vectors of Lateral Movement

Adversaries favor native operating system tools because they guarantee execution while bypassing traditional software blocklists. Security teams must monitor four common protocol architectures for signs of operational abuse:

1. SMB and Windows Administrative Shares (ADMIN$)

Server Message Block (SMB) handles standard file distribution and printer mapping across Windows networks. However, its built-in administrative shares—specifically ADMIN$, which exposes the remote host’s system root directory—present a major exploitation risk. Gaining access to this share allows an attacker to drop binaries, stage execution scripts, and move tools laterally across the environment.

Network Traffic Detection Indicators

Passive NDR engines monitor the application layer of an SMB session to track three critical variables: the active SMB protocol version, the explicit share paths being called, and associated file write/read metrics. While a routine administrator connection rarely triggers unexpected application binaries, an adversarial pivot frequently pairs share access with immediate tool compilation. For instance, detecting an active ADMIN$ session immediately followed by a file operation involving unapproved execution layers (such as a local python.exe deployment) serves as a high-fidelity indicator of compromise.

Investigation Checklist

Initiator Verification: Correlate the source IP address against authorized administrative jump hosts and active change management logs.
Post-Access Triggers: Audit the connection payload to check whether the share access was immediately followed by binary file drops or unauthorized script staging.

2. PSExec Service Spawning

PSExec is a lightweight, command-line remote administration utility from the Microsoft Sysinternals suite. It allows IT teams to execute commands on remote endpoints without initializing a full interactive desktop session. Attackers leverage this exact capability to achieve remote shell execution across target subnets.

Network Traffic Detection Indicators

PSExec leaves a distinct signature in network traffic due to its underlying mechanics. Every execution begins by establishing a connection over SMB port 445 to the target’s IPC$ share, followed immediately by installing and starting a temporary Windows service named PSEXESVC. Because this traffic is transmitted in clear text over the wire, an NDR platform can read the exact command string passed to the remote host, providing direct evidence of adversarial intent.

Investigation Checklist

Operator Authentication: Flag any instances of PSEXESVC initialization executing outside standard operational maintenance hours or on endpoints with no historical record of remote administration.
Command String Extraction: Inspect the parsed application metadata to analyze the exact command string executed by the service, prioritizing any obfuscated strings or unmapped binary calls.

3. Remote Desktop Protocol (RDP) Sessions

Remote Desktop Protocol (RDP) provides full graphical interface access to remote target machines. If an adversary harvests valid corporate credentials via phishing or local credential dumping, they can initialize an authenticated RDP session to interact directly with internal file networks, bypassing endpoint malware detection layers.

Network Traffic Detection Indicators

Because RDP session traffic is encrypted natively, security analysts cannot directly inspect in-session keystrokes or file actions from network flows alone. Investigation must therefore pivot to analyzing connection metadata, tracking variables like source-destination IP pairs, session durations, and geographic origin indicators.

Session duration metadata provides deeper insights than most analysts realize. While a brief internal RDP session might appear benign, it must be evaluated alongside the prior activity baseline of the initiating host. If that host demonstrated anomalous system queries or unmapped database access immediately before opening the RDP session, the connection is likely part of a lateral chain. Analysts can leverage peer graphing to trace every internal endpoint the host interacted with immediately after the session ended to define the complete blast radius.

Investigation Checklist

Pre-Session Host Baseline: Analyze the historical activity of the source device to determine if unusual communication trends or scanning behavior preceded the session.
Downstream Peer Graphing: Leverage network peer graphing to map out and audit every subsequent internal connection initialized by the target host after the RDP session closed.

4. LLMNR Poisoning (Link-Local Multicast Name Resolution)

Link-Local Multicast Name Resolution (LLMNR) serves as a fallback name resolution protocol when standard DNS queries fail. When a Windows endpoint cannot locate a target hostname via DNS, it broadcasts a multicast packet across the local network segment asking if any peer knows the address, allowing any device on the subnet to respond.

Network Traffic Detection Indicators

An attacker can exploit this behavior by running tools like Responder to listen for these multicast queries on UDP port 5355. The attacking device sends a spoofed unicast response claiming to be the target host, forcing the victim machine to attempt authentication and transmit its NTLM credential hash over the wire. A legitimate LLMNR exchange occurs exclusively between a client and a valid asset holder; detecting a unicast response originating from an unexpected IP address with no prior communication history indicates an active poisoning attempt.

Investigation Checklist

Responder Validation: Compare the IP address of the unicast responder against the authoritative hostname registry, and flag any nodes attempting to answer queries for unmapped domains.

Unifying Parallel Detection Methodologies

Isolating sophisticated lateral movement requires running multiple, complementary analytics engines simultaneously to eliminate individual visibility blind spots:

Detection Vector	Core Analytical Focus	Lateral Movement Insight Contribution
Network Behavior Analysis (NBA)	Establishes a dynamic baseline of traffic volumes, connection durations, and peer pairings.	Flags structural anomalies, such as a workstation suddenly initiating unmapped connections to high-value database segments.
Intrusion Detection System (IDS)	Applies deterministic signature matching against known threat actor methodologies.	Instantly identifies specific exploit strings and known post-exploitation framework patterns, regardless of baseline trends.
Log Correlation & Processing	Aggregates application and event logs from endpoints, directories, and internal services.	Enriches network flow metrics with explicit system details, including Windows Event IDs and active process creations.

When these detection layers operate in tandem within a unified NDR console, disjointed alerts turn into a clear attack timeline. For example, if an IDS signature flags an anomalous ADMIN$ connection while the behavior analysis engine simultaneously logs an unusual surge in internal peer links from that same device, analysts are no longer looking at random noise—they are tracking an active compromise chain.

From Real-Time Triage to Retrospective Forensics

Lateral movement is a progressive sequence that unfolds across multiple protocols, devices, and subnets over time. Because threat actors use standard administrative tools to blend in, catching them requires deep, continuous network visibility to map out both pre-alert behaviors and downstream activities.

This visibility remains valuable long after an active incident is contained. Maintaining a long-term network metadata repository allows security teams to run retrospective analysis months after an event. This historical record ensures your enterprise can confidently execute deep threat hunting exercises, satisfy regulatory compliance audits, and verify the absolute closure of a breach.

About GREYCORTEX
GREYCORTEX uses advanced artificial intelligence, machine learning, and data mining methods to help organizations make their IT operations secure and reliable.

MENDEL, GREYCORTEX’s network traffic analysis solution, helps corporations, governments, and the critical infrastructure sector protect their futures by detecting cyber threats to sensitive data, networks, trade secrets, and reputations, which other network security products miss.

MENDEL is based on 10 years of extensive academic research and is designed using the same technology which was successful in four US-based NIST Challenges.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

2026 Greycortex

GREYCORTEX Mendel 4.6

Clearer Context, Faster Investigations, and Smoother Workflows

Mendel 4.6 focuses on making investigations more efficient and network context easier to understand. The new version improves how analysts work with packet data, host identity, and application-layer information, while extending support for enterprise identity standards. Together, these updates help teams confirm findings faster, reduce manual steps, and operate Mendel more effectively in large and complex environments.

Track Host Identity Changes with Hostname History

Devices in a network rarely keep a single identity. Laptops move between networks, systems are reimaged, and different protocols may report different hostnames. As a result, analysts often struggle to confirm whether multiple events belong to the same device. Hostname History and Identity Tracking provides a unified view of how a host’s name changes over time. Mendel 4.6 continuously collects and correlates hostname information from multiple network sources and presents it as a single, time-based identity record per host.

With this capability, analysts can:

Recognize the same device even when its hostname or IP address changes.
Follow suspicious activity across different network contexts.
Quickly determine whether multiple alerts relate to one host or several.

The result is clearer investigations and better visibility into devices that move, are renamed, or rebuilt.

Identify Devices With Application-Layer Data

Many devices in modern networks communicate in similar ways at the network layer. Without structured application-layer context, analysts lack the information needed to accurately identify device roles and expected behavior — especially in mixed IT and OT environments.

Mendel 4.6 addresses this by extracting and structuring protocol-level metadata and linking it directly to hosts. This turns raw traffic into clear indicators of device role, service usage, and communication behavior.

With this capability, analysts can:

Spot unusual or unexpected protocol usage across IT and OT environments.
Search and filter hosts by application attributes and service characteristics.
Use application-layer details to add context to detections during investigations.

The new version improves asset classification, accelerates investigations, and provides clearer context for detections and alerts.

Investigate Faster with a Unified PCAP Workspace

Mendel 4.6 introduces a unified PCAP workspace that brings capture and replay into one place, with access to PCAPs from all connected sensors. This allows analysts to move directly from alerts to packet-level evidence, speeding up validation and investigation.

With this capability, analysts can:

Replay captured traffic to confirm detection details and understand activity in context.
Search and filter packets by time, IP address, or session.
Correlate traffic flows across IT and OT environments.

The result is faster, more confident investigations with direct access to packet-level evidence, streamlining the retrospective investigation workflow.

Extend Identity Integration with SAML Support

Mendel 4.6 extends identity integration with SAML support, complementing existing LDAP, Kerberos, and OAuth options. This allows security teams to connect Mendel to enterprise SSO platforms and align access control with established identity and authentication policies.

With this capability, administrators can:

Enable web-based Single Sign-On using corporate identity providers.
Manage authenticators through a clearer, more flexible configuration interface.
Secure API access using OAuth2 client credentials and scopes.

The result is simpler user onboarding, consistent access control across environments, and better alignment with enterprise identity standards.

Additional Updates

Flow-Preserving Hardware Bypass for Napatech
High-performance sensors using Napatech adapters now support a flow-preserving hardware bypass mode that reduces CPU load while keeping flow size, timing, endpoints, and metadata.

Zabbix Integration Update for Asset Information
The Zabbix integration now aligns asset data with Mendel’s standardized Asset Information tags. Vendor, model, firmware, and device type details are displayed consistently for each host.

OpenAppID Framework
Upgrade
Mendel has been updated to support the latest OpenAppID framework and signatures, improving application and protocol identification

About GREYCORTEX
GREYCORTEX uses advanced artificial intelligence, machine learning, and data mining methods to help organizations make their IT operations secure and reliable.

MENDEL, GREYCORTEX’s network traffic analysis solution, helps corporations, governments, and the critical infrastructure sector protect their futures by detecting cyber threats to sensitive data, networks, trade secrets, and reputations, which other network security products miss.

MENDEL is based on 10 years of extensive academic research and is designed using the same technology which was successful in four US-based NIST Challenges.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Greycortex 2026

GREYCORTEX: A Decade of Network Resilience

In 2016, GREYCORTEX was founded in Brno by eight individuals driven by a singular conviction: world-class technical excellence could be engineered locally to protect critical enterprises anywhere in the world. A decade later, that conviction has been validated on the global stage.Today, GREYCORTEX operates across 27 international markets, earns recognition from premier analyst firms like Gartner and Forrester, and acts as a trusted partner for organizations where information security is not optional. This position was earned through one deployment, one customer, and one complex challenge at a time.

The Core Philosophy: Engineering with Consequence

Our trajectory has never been defined by single breakthroughs, but by a cultural alignment toward systemic excellence. The feedback loop between real-world deployments and core R&D is immediate. The engineers building GREYCORTEX Mendel stay directly aligned with the threat hunters monitoring live, hostile environments.

“When our platform runs inside a critical environment, our commitment is absolute—it is a matter of operational integrity, not an SLA threshold negotiated in a sales room.”
— Radek, Chief Experience Officer (CXO)

Because Mendel is deployed within hospitals, government networks, and critical industrial automation zones, every member of our team understands that security failures carry human and societal consequences. We show up because we recognize the impact of our solution.

Crucibles of Growth: Turning Points

The Geopolitical Pivot

During the onset of COVID-19, our deep market expansion in Japan paused overnight due to global travel restrictions. Despite immense financial pressure, management refused headcount or salary reductions, preserving the structural integrity of our team to execute when the world reopened.

The Architectural Leap

An early, large-scale deployment across nearly twenty remote state nodes pushed our engine beyond its original design limits. In less than thirty days, our R&D team reengineered the core processing module—creating the scalable foundation that underpins our largest enterprise models today.

The Next Epoch: IT/OT Convergence

We did not build GREYCORTEX to be a localized champion. Cybersecurity is a borderless crisis, and our mission has always been global network defense. As traditional enterprise IT rapidly converges with Operational Technology (OT) environments, the threat vector targeting critical infrastructure grows exponentially. This intersection is where we continue to deepen our analytical capabilities.

Our next chapter centers on establishing GREYCORTEX as the definitive standard for network detection and response across Europe, and subsequently, the global enterprise market.

About GREYCORTEX
GREYCORTEX uses advanced artificial intelligence, machine learning, and data mining methods to help organizations make their IT operations secure and reliable.

MENDEL, GREYCORTEX’s network traffic analysis solution, helps corporations, governments, and the critical infrastructure sector protect their futures by detecting cyber threats to sensitive data, networks, trade secrets, and reputations, which other network security products miss.

MENDEL is based on 10 years of extensive academic research and is designed using the same technology which was successful in four US-based NIST Challenges.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Greycortex 2026

HPE Aruba & GREYCORTEX Mendel Integration Demo

The Outcome: In a live-fire simulation, the integrated HPE CX10000 and GREYCORTEX Mendel solution detected and neutralized an Nmap port scan in under two minutes, requiring zero manual analyst intervention.

The Integration Workflow

1. Telemetry Ingestion: The CX10000 collects deep flow data and relays it to the Mendel intelligence engine.

2. Behavioral Detection: Mendel recognizes malicious scan patterns in real-time.

3. Automated Response: Mendel triggers a script to update switch security policies immediately.

4. Host Isolation: The attacker is blocked from the network, containing the threat.

Technical Significance

Featured on HPE Aruba’s Airheads Broadcasting, this demonstration highlights how deep network telemetry can be transformed into actionable, automated security policy. By bridging the gap between infrastructure hardware and security analytics, organizations can significantly reduce the “mean time to respond” (MTTR).

Watch the Full Technical Demo

About GREYCORTEX
GREYCORTEX uses advanced artificial intelligence, machine learning, and data mining methods to help organizations make their IT operations secure and reliable.

MENDEL, GREYCORTEX’s network traffic analysis solution, helps corporations, governments, and the critical infrastructure sector protect their futures by detecting cyber threats to sensitive data, networks, trade secrets, and reputations, which other network security products miss.

MENDEL is based on 10 years of extensive academic research and is designed using the same technology which was successful in four US-based NIST Challenges.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Greycortex 2026

Vendor Access Monitoring & Audit Guide

Vendor access monitoring in most organizations stops at the VPN log. It tells you who connected, but fails to explain what they did next. Without activity data, investigating an incident relies on assumptions rather than facts.

Network Visibility RequirementsReal-time and retrospective tracking of accessed systems.
Protocol-level analysis of all communications.
Data transfer volume and directionality logs.
Detailed records of file copies and commands executed.

VPN vs. ZTNA: A Shift in Principle

Traditional VPN

Opens a wide network segment. Once connected, a supplier can potentially reach far more systems than required.

Modern ZTNA

Grants access exclusively to the specific service or application authorized. Nothing beyond that is reachable.

The Risk of Shadow Access (4G/5G Routers)

IT teams often face “shadow” access points installed by vendors for convenience. These unauthorized 4G/5G routers bypass security policies and monitoring entirely. In stable OT (Operational Technology) environments, this is a severe risk.

How to Detect Unauthorized Hardware

Network Detection and Response (NDR) solutions identify rogue hardware through:

Device Discovery: Automatic classification of every new device on the segment.
Behavioral Baselining: Alerting on new communication patterns or unknown destinations.

Conclusion

Building a verifiable audit trail ensures that when something goes wrong, the data is there to explain it. Moving to a passive monitoring approach allows IT teams to respond to incidents with factual certainty and fulfill compliance requirements through long-term data retention.

About GREYCORTEX
GREYCORTEX uses advanced artificial intelligence, machine learning, and data mining methods to help organizations make their IT operations secure and reliable.

MENDEL, GREYCORTEX’s network traffic analysis solution, helps corporations, governments, and the critical infrastructure sector protect their futures by detecting cyber threats to sensitive data, networks, trade secrets, and reputations, which other network security products miss.

MENDEL is based on 10 years of extensive academic research and is designed using the same technology which was successful in four US-based NIST Challenges.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Greycortex 2026

AMI Anomaly Detection: Operational Playbooks

In modern AMI environments, smart meters and gateways communicate in highly predictable streams. Deviations from these patterns provide high-fidelity signals for configuration errors or security intrusions. These playbooks offer a structured approach to detecting and validating the most frequent network-level anomalies.

Primary AMI Anomalies and Validation Steps

1. Unidentified Device Discovery

New hardware appearing in AMI subnets often indicates undocumented field work, meter replacement, or unauthorized vendor access.

Mendel Detection: Automatically identifies new assets and classifies them by role (e.g., DLMS/COSEM Server).

Validation Checklist:

Service Verification: Confirm any recent local maintenance or meter swaps.
Protocol Analysis: Review the device’s main communication peers and used ports.
Pattern Matching: Compare behavior against known meters in the same subnet.

Field Action: If the device remains unverified, perform physical verification to prevent unauthorized intrusion.

2. First-Seen Communication Patterns

Emergent use of new protocols or ports may signal unauthorized firmware updates, diagnostic tool misuse, or configuration drift.

Validation Checklist:

Standard Compliance: Verify if the protocol aligns with standard AMI operation.
Firmware Context: Check for recent rollouts or vendor-driven updates.
Geographic Review: Ensure destination IPs are not located in high-risk regions.

Field Action: Conduct a configuration review of the relevant gateway to ensure only authorized services are active.

3. Network Segmentation Violations

Communication outside of approved boundaries (e.g., traffic to the public internet) typically indicates routing failures or firewall misconfigurations.

Validation Checklist:

Architectural Alignment: Is the destination part of the approved Head-End platform?
Change Audit: Review recent firewall or gateway configuration logs.

Field Action: Adjust gateway settings to strictly restrict AMI traffic to approved internal destinations.

4. Unauthorized DLMS/COSEM Parameter Changes

Unexpected application-layer SET operations can indicate unauthorized manipulation of meter values or settings.

Validation Checklist:

Baseline Comparison: Match the new parameter against the expected master configuration.
Source Attribution: Verify if the initiating IP address is an authorized system.

Field Action: Restore the baseline configuration and audit access logs before returning the device to service.

Conclusion

Network-level visibility transforms anomaly detection into a practical operational control. By following these playbooks, teams can maintain a predictable AMI environment and detect security deviations early.

About GREYCORTEX
GREYCORTEX uses advanced artificial intelligence, machine learning, and data mining methods to help organizations make their IT operations secure and reliable.

MENDEL, GREYCORTEX’s network traffic analysis solution, helps corporations, governments, and the critical infrastructure sector protect their futures by detecting cyber threats to sensitive data, networks, trade secrets, and reputations, which other network security products miss.

MENDEL is based on 10 years of extensive academic research and is designed using the same technology which was successful in four US-based NIST Challenges.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Greycortex 2026

GREYCORTEX Mendel 4.6 Now Available

Streamlined Network Analysis: Mendel 4.6 introduces enriched network context and faster investigation tools, allowing security analysts to work more efficiently with complex data.

The 4.6 update focuses on optimizing how analysts validate security findings and interact with network telemetry. By providing a deeper level of visibility, the platform ensures that response teams can identify and address threats with higher precision.

New Features & System Improvements:

Hostname & Guest Identity Tracking: Enhanced history logs for hostnames and guest identity monitoring.
Application Layer Visibility: Deeper insights into device behavior and asset status using application layer data.
Unified PCAP Workflow: A centralized environment for the capture and playback of PCAP records.
Modern Authentication Support: Expanded identity management featuring SAML and Single Sign-On (SSO).
Napatech Bypass Mode: Implementation of a bypass mode that maintains consistent network flows for Napatech integrations.
Enhanced Zabbix Integration: Updated asset information exchange for better synchronization.
OpenAppID Framework Update: Refresh of the OpenAppID framework to the latest version.

About GREYCORTEX
GREYCORTEX uses advanced artificial intelligence, machine learning, and data mining methods to help organizations make their IT operations secure and reliable.

MENDEL, GREYCORTEX’s network traffic analysis solution, helps corporations, governments, and the critical infrastructure sector protect their futures by detecting cyber threats to sensitive data, networks, trade secrets, and reputations, which other network security products miss.

MENDEL is based on 10 years of extensive academic research and is designed using the same technology which was successful in four US-based NIST Challenges.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

2026 Greycortex

Network Security Monitoring as a Service (NSMaaS): Enterprise Visibility Without the Overhead

Until recently, achieving full network visibility was a privilege reserved for large enterprises. Advanced monitoring required significant capital investment, specialized security teams, and lengthy deployment cycles. Today, IT teams, particularly those across Europe, face heightened complexity, limited staff, and growing regulatory pressures. The threat landscape is constant, but the ability to manage it varies widely.

Making Enterprise Visibility Accessible

Managed monitoring changes the operational equation for organizations that cannot afford a dedicated 24/7 Security Operations Center (SOC). It provides many benefits similar to SOC as a Service (SOCaaS) but avoids the complexity and infrastructure burden of building a full security function internally.

With technologies like GREYCORTEX Mendel (a Network Detection and Response, or NDR, solution), providers can offer the same depth of insight previously only accessible to major corporations.

The core value is simple: organizations finally gain clarity into what is happening inside their network. They can spot misconfigurations, detect unauthorized connections, and notice the early signs of malicious activity. For many, this is the first time they can verify whether their segmentation and firewall rules are effective against real-world traffic.

How Service-Based Monitoring Works in Practice

This model is exemplified by partners like SOC360 in Poland. They combine Mendel’s deep visibility with their own expert monitoring and response processes, providing predictable costs, quick deployment, and continuous expert oversight.

Key Components of a Managed NDR Service:

✅ Continuous network and log monitoring, providing a constant pulse on system health.
✅ Detection of hidden threats, unauthorized access attempts, and policy violations using behavioral analysis.
✅ Investigation support using historical metadata and full-context analytics for rapid root cause analysis.
✅ Monthly reporting and guidance with clear, actionable recommendations for IT teams.

For many organizations, this replaces reliance on assumptions and isolated alerts with insights supported by data and clear recommendations.

Scaling Up: Visibility for Mature Security Teams

For larger organizations that maintain their own SOC, the approach shifts. Instead of outsourcing, they integrate GREYCORTEX Mendel directly into their environment. In these setups, deep network visibility becomes a powerful analytical advantage.

In-house SOC teams gain a clear view of device communication, user behavior, and performance trends over time. Crucially, they access historical data that traditional log-centric tools often cannot provide. This depth speeds up investigations, reduces noise, and helps analysts understand not only that something happened, but also how and why it occurred.

Conclusion: Visibility That Fits Any Security Maturity

Network security monitoring proves that meaningful visibility is no longer limited by the size of your security team. Smaller companies gain critical clarity without building a SOC, while mature environments enhance their detection and investigation workflows through deeper network context.

GREYCORTEX Mendel supports both needs: it enables providers to deliver reliable monitoring as a service, and it gives enterprise SOCs the analytical depth required to manage complex infrastructures. The objective remains the same: reduce uncertainty, speed up response, and create a network environment where hidden activity is harder to ignore.

About GREYCORTEX
GREYCORTEX uses advanced artificial intelligence, machine learning, and data mining methods to help organizations make their IT operations secure and reliable.

MENDEL, GREYCORTEX’s network traffic analysis solution, helps corporations, governments, and the critical infrastructure sector protect their futures by detecting cyber threats to sensitive data, networks, trade secrets, and reputations, which other network security products miss.

MENDEL is based on 10 years of extensive academic research and is designed using the same technology which was successful in four US-based NIST Challenges.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Greycortex 2025

Women of GREYCORTEX: Different Paths, One Purpose in Cybersecurity

When people envision cybersecurity, they often default to a highly technical, male-dominated image. The reality, particularly at events like the recent Ženy v kyber (Women in Cyber) conference in the Czech Republic, paints a different picture—one focused on stories, curiosity, and the determination to enter a new field.

We were proud supporters of the event, as diversity is a core principle at GREYCORTEX. Approximately one-third of our team are women, playing vital roles across every department: development, product, marketing, sales, and technical support. Each of them followed a unique trajectory into cybersecurity. Let’s explore what brought them here.

Curiosity, Coincidence, and Determination

The journey into cybersecurity is rarely linear. Some arrive naturally, while others find their way almost by chance.

Minh, a developer, was drawn by the field’s broad scope—from mathematics and cryptography to programming and data analysis. “What drew me most,” she says, “was that the work has real impact, even on a national level. And, of course, I liked the idea of using my analytical mind to fight the bad guys.”
Aja, our marketing manager, started by coincidence after writing about tech companies during parental leave. “When they later opened a marketing role, I didn’t hesitate,” she laughs.

Regardless of their starting point, the consensus is that the field’s fast pace and energy keep them engaged. As Monika, our Country Manager for Poland, notes: “I like people, and I like when things happen, and in cybersecurity, things are always happening.”

Cybersecurity is not exclusively reserved for people with traditional technical degrees. What truly counts is persistence, curiosity, and a dedication to lifelong learning.

Irina from our marketing team shared, “The beginning was tough. I had to dive into the tools and really understand how cybersecurity works. I’m still learning every day, but that’s exactly what makes it exciting.”

Breaking Down Stereotypes

Though outdated stereotypes of cybersecurity being solely a “men’s field” are fading, many women still encounter them in professional and everyday situations.

Bára, a security analyst, recalled an instance when a shop assistant only accepted her complaint about a faulty router after she meticulously listed every technical test she had already performed on the device.
Saša from the product team experienced similar subtle bias at university, which, rather than discouraging her, served as a strong motivator: “Those moments motivated me to keep improving, to be consistent, and confident in my work.”

From the HR perspective, there is growing awareness of the value women bring. Ira from HR states, “I often hear that teams want more women because they bring a different way of thinking and communicating.”

At GREYCORTEX, success is measured by results and expertise, not background or gender. Women on our team lead major projects, design products, analyze network traffic, and run international business operations. They find respect, equal opportunities, and space to grow.

The Human Side of Cybersecurity

When asked what draws people to the field, conference participants cited remarkably similar answers: constant learning, variety, and the feeling that their work has a tangible, real-world impact.

What resonated most was the sense of community. Behind the complex systems are people who share knowledge and support each other, underscoring that security is fundamentally about collaboration and trust.

Ira from HR summarizes this well: “HR in IT is the ideal mix for me. You need to understand technology, but also know how to help teams grow and work together.”

Supporting Women in Cybersecurity

The message from the confident, curious, and inspiring women of GREYCORTEX to anyone considering the field is clear:

If cybersecurity interests you, go for it. And choose a company where the people inspire you and the environment feels right.

At GREYCORTEX, we prove every day that diverse perspectives make teams stronger, more creative, and ready for any challenge ahead.

About GREYCORTEX
GREYCORTEX uses advanced artificial intelligence, machine learning, and data mining methods to help organizations make their IT operations secure and reliable.

MENDEL, GREYCORTEX’s network traffic analysis solution, helps corporations, governments, and the critical infrastructure sector protect their futures by detecting cyber threats to sensitive data, networks, trade secrets, and reputations, which other network security products miss.

MENDEL is based on 10 years of extensive academic research and is designed using the same technology which was successful in four US-based NIST Challenges.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Greycortex 2025