Concept — illustrative, not product data
Observe
Beaconing, measured
Connections that repeat at a fixed interval stand out against normal traffic.
In developmentArgus SentinelExplore
Intelligence systems for decisions that matter.
Noxeron builds systems that turn complex signals into clear, controlled action. Our first system, Argus Sentinel, is being developed for network security operations.
Workflow
- 01ObserveNetwork behavior
- 02UnderstandCorrelation
- 03DecideIn development
- 04ActIn development
Host
10.0.0.42
Internal · 10.0.0.0/8
Opened T+00:00
Open
Incident 0142 · 10.0.0.42
Beacon · 10.0.0.42 → 203.0.113.17interval 60 s · fixed
- T+00:0010.0.0.42→203.0.113.17Outbound TLS at a fixed 60-second intervalObserve
- T+00:0610.0.0.42→resolver.localDNS queries with high-entropy subdomainsObserve
- T+00:1110.0.0.42→198.51.100.9Upload volume far above this host's baselineObserve
- T+00:12beaconing + DNS tunneling + exfiltration3 behaviors correlatedUnderstand
DecideIn development
Working hypothesis
Command-and-control channel with likely data exfiltration
T+00:00T+00:06T+00:11
ActIn development
Proposed
- isolate 10.0.0.42
- block 203.0.113.17
- export evidence package
Awaiting analyst approval
II About
Systems built to observe, understand, decide, and act.
Noxeron develops technology designed to turn fragmented information into intelligence, decisions, and action. Each of its systems follows the same four stages.
- 01Observe
Collect signals from systems, markets, and the public record.
- 02Understand
Correlate them, add context, and explain what changed.
- 03DecideIn development
Weigh the options against risk, cost, and time.
- 04ActIn development
Recommend a controlled response, and carry it out once a person approves.
III Flagship systemIn development
Argus Sentinel
Network detection today. Investigation and controlled response in development.
Argus Sentinel is an on-premises network detection system. Its working engine reads network telemetry from Suricata sensors, scores behavior such as beaconing, DNS tunneling, and data exfiltration, and matches traffic against threat intelligence. It is now being extended into investigation and controlled response, so that each incident can be carried from first signal to a reversible action that a person approves.
Argus Sentinel · Network detection
Concept — illustrative, not product data
One host. Three behaviors. One evidence trail.
-
01
Beaconing
Callbacks from 10.0.0.42 to 203.0.113.17 at a perfectly regular interval. The regularity is scored, and the destination matches threat intelligence.
First seen T+00:00 -
02
DNS tunnel shape
Bursts of long, high-entropy queries from 10.0.0.42 to resolver.local: the shape of data carried inside DNS.
Scored per burst -
03
Upload anomaly
A sustained outbound stream from 10.0.0.42 to 198.51.100.9, well above the host's usual volume, scored as an exfiltration shape.
Evidence package · incident 0142
Concept — illustrative, not product data
Observe
DNS tunnel shape
Long, high-entropy subdomains are scored as a sign of data carried inside DNS.
Data
Stays on your infrastructure
Argus Sentinel runs on-premises. Network telemetry is processed where it is collected.
Concept — illustrative, not product data
Awaiting analyst approval
Response · in development
Act · in development
Evidence, then approval
Evidence packages are generated today. Controlled response is being built to wait for a person's approval.
- Stage
- Working network-detection engine. Investigation and response in development. No customer deployments.
- Deployment
- On-premises, containerized.
- Data
- Network telemetry is processed on the customer's infrastructure and does not leave it.
- Access
- Technical briefings and live demonstrations by request.
IV ArchitectureIn development
One architecture. Multiple domains.
Three names, three roles. Noxeron is developing one architecture so that each new system can start from the same foundation instead of from zero.
- Noxeron
- The company
- An independent technology company working on intelligence systems, financial technology, and cybersecurity.
- Noxron
- The core · pronounced “nox-ron”
- The architecture Noxeron is developing beneath every system: one foundation for data, knowledge, and models.
- Phronek
- The AI layer
- Noxron's reasoning and agent layer, being built so that a person approves every consequential step.
Concept — illustrative, not product data
- 04
Systems
ProductsArgus Sentinel is the only system in development. Network detection and evidence packages work today; investigation and controlled response are being built.
In development
- 03
Phronek
AI layerReasoning · Forecasting · Agents · Human approval
In development
- 02
Noxron
CoreData · Knowledge · Models
In development
- 01
Input
SourcesNetwork telemetry · Company records · Market feeds
Read from the bottom: data is intended to enter Noxron, Phronek is being built to reason over it, and each system is designed to sit on top.
V NoxronIn development
Noxron. Built to sit beneath every system.
Without a shared core, every new system would rebuild its own data pipeline, its own view of the world, and its own models. Noxron is in development so that they can share one; Argus Sentinel is intended to be the first system built on it.
-
01
Data
Designed to normalize telemetry, records, and feeds into one shape.
-
02
Knowledge
Designed to hold entities, relationships, and the history of what changed.
-
03
Models
Designed to score and forecast, and to keep every version reproducible.
VI Divisions
Three divisions. One architecture.
Security comes first. Intelligence and financial systems are intended to follow on the same foundation, each once its first system is ready.
Noxeron
Security
Security systems for networks and digital risk.
Argus SentinelIn developmentNetwork detection today; investigation and controlled response in development.
Noxeron · in research
Intelligence
Research systems for understanding companies, markets, and change.
IstorenResearchCompany and market research
EphoranResearchTracking company, market, and regulatory change
Noxeron · concept
Katallar
Financial systems for markets, capital, and private wealth.
Katallar: from Greek katallassein, “to exchange; to reconcile”.
BasanorConceptMarket and risk analysis
TablinarConceptPrivate capital analysis
Noxeron does not provide investment advice and is not an investment adviser.
Of the systems, only Argus Sentinel is in development. The others are at the research or concept stage.
VII Research
Noxeron Research
Working notes on decision systems, security operations, and the architecture underneath them.
- Decision systems
Beyond Dashboards: What Decision Intelligence Has to Get Right
Forthcoming - Architecture
What an Agent Has to Prove Before It Is Allowed Near an Incident
Forthcoming - Security
From Alert Triage to Assisted Investigation
Forthcoming - Decision systems
From OODA to Assisted Decisions: What a Fighter Pilot's Loop Still Gets Right
Forthcoming
VIII Company
Independent, early, and built to be checked.
Noxeron is independent and at an early stage, with one system in development.
Most software stores information or automates a task. The systems worth building next will watch an environment, explain what changed in it, and stand behind what they recommend. That is the work Noxeron exists to do.
- Founder
- Ngoc Lam Nguyen
- Contact
- contact@noxeron.com
- Disclosure
- contact@noxeron.com
IX Contact
Start a conversation.
Request a technical briefing- Noxeron
- contact@noxeron.com
- Argus Sentinel
- contact@argussentinel.com
- Security disclosure
- contact@noxeron.com