Passive deep packet inspection on more than 100 protocols, three proprietary correlation engines and response that can be enabled segment by segment. Up and running in 10 minutes.
Patented technology, developed in Italy.
Passive capture, logging, AI correlation and response: the pipeline that turns raw traffic into actionable events.
Traffic copy via SPAN/mirror port or TAP. Deep packet inspection on headers and payload, more than 100 IT/OT protocols, no agents on hosts.
Every connection becomes a structured log: source, destination, protocol, relevant content. First evidence within a few hours.
Tires-IA models the baseline in 2–5 weeks, Specto assigns the severity score. In OT, ANTLIA maps techniques to MITRE ATT&CK for ICS.
Raises contains the threat directly on the traffic. Probe Mode by default, granular activation by segment when you’re ready.
Out-of-band deployment: LECS runs alongside your network with no agents, no administrative credentials and no dependency on existing devices. From a single site to multi-site with the Aggregator.
Modern attacks get past the perimeter and move through east-west traffic, where firewalls and EDR see less. That is exactly the traffic LECS analyses.
supported protocols
beyond the connections typically analyzed
of false positives in logs*
deployment in minutes
Triangulation of proprietary engines: three for IT traffic, dedicated modules for OT, IoT, IoMT and asset intelligence. More independent evidence, fewer false positives.
Behavioural AI that continuously learns the LAN, models its baseline and catches deviations and early signs of compromise.
It performs a hidden, parallel analysis of all individual connections. It inspects traffic at a deep level (header + payload) and does not slow down or block operations.
Response engine: contains the threat on the traffic while preserving business continuity. Disabled by default, it can be enabled segment by segment.
The OT detection engine performs an in-depth analysis of industrial protocols to detect unauthorized or critical commands and abnormal setpoint variations.
Passive network inventory: identifies and classifies devices, detects CVEs and supports IEC 62443 with segmentation into Zones and rules between Conduits.
Analyses behaviour, context and identity on the host: detects credential abuse, lateral movement and insider threats, even with valid credentials.
Specto, Raises and Tires-IA analyse the same traffic in parallel and cross-check their evidence.
Real-time risk score, reconstructed incidents and forensic evidence ready to export.
Integrity and certified date, verifiable over time.
LECS enriches SIEM and SOC with network telemetry that is already correlated.
IT, OT and IoT in a single platform: business continuity, system stability and support for NIS2, GDPR and DORA compliance.
No. LECS works on a copy of the traffic (SPAN or TAP). For endpoints, CELESTIA™ is coming soon: an AI agent complementary to EDR.
Installation takes about 10 minutes and the first evidence arrives within a few hours. ORION completes asset classification in about 15 days; Tires-IA consolidates the behavioural baseline in 2–5 weeks.
LECS keeps detecting, correlating and notifying (Probe Mode). You can enable response whenever you want, segment by segment, with automatic or manual fine tuning.
Only if the traffic runs over Ethernet through a gateway. ANTLIA also decodes non-IP Layer 2 industrial protocols such as IEC 61850 GOOSE/SV and PROFINET DCP.
In the Cloud version, on servers in Italy; in the On-Premises version, logs stay on the Aggregator inside your perimeter. A dedicated project is available for air-gapped environments.
*Estimate based on real-world testing compared with traditional log aggregation systems.
