Initializing Security Systems
Please wait...
KAUST Spin-Off · CyberSaR Lab
Genspect
Generative malware analyst for unknown malware.
Genspect inspects Windows binaries and reports everything nasty inside. Every verdict is backed by the evidence, nothing leaves your network — and it never runs the file.
Genspect — analyst verdict LIVE
inspecting unknown.exe
Credential-stealing trojan. Harvests browser & mail logins, evades analysis, exfiltrates over the network.
Credential theftKeyloggingAnti-analysis
✅ every finding evidencedanalyst-ready
The workspace your analysts operate in
A fast, keyboard-driven console — inspection, reports, ATT&CK coverage and deployable detections, all in one place, all on your host.
Deployable detections
Detection rules, organized by tactic — ready for your SIEM.
Exploited-vuln context
Known-exploited-vulnerability awareness, built in.
Aligned with the standards your SOC already runs on
MITRE ATT&CKD3FENDCISA KEVSigma100% local · air-gap-ready · no SaaS dependency
🛡️
Never runs the sample
Inspected safely — no detonation, no risk to your environment.
🔗
Every verdict cites its evidence
Findings your analysts can trust — and defend.
🎯
Catch unknown, newborn malware
Flags never-before-seen, freshly-minted samples that signatures and sandboxes miss.
🧠
Language-model inspection
Built on one of the largest LLM-based malware datasets — it reasons over code, not just signatures.
From file to finished report — in three steps
No detonation. No cloud. No waiting. Just the answer your team needs, with the evidence to back it.
1
Submit a file
Drop in an unknown Windows binary — or point Genspect at a hash.
2
Inspected safely
Genspect examines it without ever executing it, then reasons over what it finds.
3
Get a cited report
An analyst-ready report where every conclusion is backed by its evidence.
Why teams choose Genspect
Built for the unknown, evasive and regulated files that other tools can't safely touch.
🔎
Explainable by design
Every technique, indicator and conclusion points to the evidence behind it — so your team can act with confidence and stand behind the call.
🏠
Runs entirely on your hardware
Air-gap-ready, with zero sample egress. Your malware — and your findings — never leave your network.
🛡️
Safe by design
Genspect never executes the sample, so there's no detonation risk — and the same file always yields a consistent, defensible result.
📄
Analyst-ready outputs
Six report types — from a one-page executive brief to a full malware analysis report — generated in seconds and ready to ship.
0% false alerts. 100% evidence-backed.
Every alert Genspect raises is backed by evidence you can inspect — so your team stops chasing false alarms. When the evidence isn't conclusive, it routes the sample to a human for review rather than guessing, so nothing slips through silently.
Persistence technique ✅ evidenced
Credential theft ✅ evidenced
Unsupported finding
↳ ❌ no evidence — removed
Six reports. One inspection. Pick the audience.
Every report is TLP-marked and ready to ship — from a one-page brief for leadership to a full analysis for your hunters.
TLP:AMBERExecutive 1-pager
Execs · Tier-11–2 pp
Key judgments and top techniques, written for leadership.
TLP:AMBERFull Malware Analysis Report
Tier-2/3 · Hunters20–40 pp
The complete, in-depth inspection your investigation team needs.
TLP:REDIncident Response Runbook
IR teams6–12 pp
Kill-chain timeline, indicators to block now, and the response steps.
TLP:GREENVulnerability Advisory
Vuln-mgmt · Execs2–4 pp
Exposure, severity, and the action your team needs to take.
TLP:AMBERBehavior Profile
Hunters · Tier-36–10 pp
What the sample does, mapped to MITRE ATT&CK.
TLP:GREENDetection Pack
Tier-1/2 · SIEM3–8 pp
Deployable detection rules your SIEM can use today.
For the analyst who has to be right — and the leader who has to report it
🧑💻
SOC Analyst
Pain: Drowning in alerts and black-box tools you can't fully trust.
Genspect: A cited, explainable verdict in seconds — not another opaque score.
🔬
DFIR / Forensics
Pain: Disclosure deadlines vs. the rigor your evidence has to hold up to.
Genspect: Consistent, defensible inspection plus a finished report — in seconds.
🎯
Threat Hunter
Pain: Unknown, evasive or regulated samples that can't be sent to a sandbox.
Genspect: Safe inspection of the file itself, entirely on your own infrastructure.
🏢
CISO / Leader
Pain: Data-sovereignty exposure and tools that ship your samples to the cloud.
Genspect: On-prem by default — nothing leaves your network, ever.
Runs entirely on your network. No cloud. No egress.
Deploy on a single host or fully air-gapped, with role-based access for your team. Your samples and findings stay yours.
your network boundary — nothing leaves
Inspection engine
examines files safely, on-host
Analyst console
triage, reports, coverage
Your samples
never leave your network
Role-based access
admin · analyst · viewer
Single-hostAir-gap-readyNo SaaS dependencyZero sample egress
See a binary become a cited report.
Book a walkthrough and watch Genspect inspect a live sample on your own hardware — or open a real sample report right now.