BASELINE
Full repository analysis
Map architecture, dependencies, data flows, trust boundaries, and security hotspots across the repository. Run from a GitHub repository, the managed runner, or your local developer workflow.
Explore code analysisLive global threat intelligence
Your Business Is Being
Attacked Right Now.
South Africa is the most targeted country in Africa for cybercrime. Hackers hit South African businesses 1,863 times every week. Most companies only find out after the damage is done. MaxiCyber catches attackers before they reach you — automatically, 24/7.
577/hrattacks in SA
R49Maverage breach cost
1–45 daysadvance detection
Live Threat Log
Streaming
Awaiting threat telemetry...
15+
Years operational
140K+
Attacks analysed daily
<10ms
Detection latency
0-day
Pre-patch protection
Why Traditional Security FailsYour Firewall Wasn't Built
Your Firewall Wasn't Built
for Today's Attacks
Traditional cybersecurity tools — antivirus, firewalls, standard endpoint protection — were built for a world where attacks were simpler and slower. Today's attackers use AI, steal credentials, disguise themselves as legitimate users, and move through your network for weeks before any alarm sounds. By the time your current tools detect a threat, the damage is already measured in millions.
“We have a firewall”
Firewalls can't stop stolen credentials
Firewalls block known bad traffic — but they can't stop a hacker who logs in with legitimate stolen credentials. 95% of South African breaches involve human error or credential theft. Once an attacker is inside, your firewall is blind.
95% of SA breaches
involve credentials or human error
“We train our staff”
AI phishing defeats human training
Generative AI now creates hyper-personalised emails that even experienced IT teams can't distinguish from genuine communication. Business Email Compromise is up 26% in South Africa — and one convincing email can trigger a R49 million breach.
26% rise in BEC
recorded in South Africa (SABRIC)
“We have an IT provider”
IT providers manage — they don't hunt
Most IT providers manage your infrastructure and respond after something breaks. They're not actively hunting for adversaries moving through your network right now. The average South African company takes 49 days to discover a breach. Reactive support isn't protection.
49 days
average time to discover a SA breach
The uncomfortable truth: If your security strategy relies on tools that only respond to threats they already know about, you are not protected — you are simply waiting to find out.
The MaxiCyber DifferenceWe Don't Just Defend.
We Don't Just Defend.
We Deceive, Disrupt, and Deny.
MaxiCyber works like a human immune system. Instead of waiting to get sick and then treating the illness, it patrols your entire digital environment — catching intruders before they can do any damage.
The entire cycle — detect, analyse, block — runs automatically, 24/7, with no human in the loop required. Your team wakes up to a report, not a crisis.
Self-Reinforcing Loop
Deception signals feed intelligence production, which feeds prevention enforcement, which feeds analytic investigation — continuously, without manual intervention at any stage.
Machine SpeedPrevention operating independently of human analysts.
Zero False PositivesDeception signals represent exclusively adversarial vectors.
01DECEIVE
Catch them in the act
We place digital honey pot traps throughout your network. They look exactly like your real systems — your login portals, your file servers, your devices. The moment an attacker touches one, we know. No innocent user ever triggers these traps. Zero false alarms.
BaitHive Decoy + TCP Mirage
02DISRUPT
Turn their attack into intelligence
Every move the attacker makes teaches us exactly how they operate. Our AI analyses their tools, techniques, and intentions in real time — and automatically updates your defences everywhere, within 5 seconds, without a human having to press a button.
CATIS Intelligence Engine
03DENY
Block them before they reach your real systems
The intelligence from the traps flows automatically to your firewall, your DNS layer, and every endpoint — building a wall around your real systems before the attacker even knows their cover is blown. We have blocked threats up to 45 days before they were publicly known.
NanoFirewall + ShenDNS
Platform Data FlowDirectional & Autonomous
1. Detection (Deceive)
BaitHive Decoy and TCP Mirage capture adversarial payloads, behavioral sequences, and fingerprints from inbound interactions.
2. Intelligence (Disrupt)
CATIS ingests telemetry, enriches via AI, and produces predictive threat intelligence 1–45 days before public disclosure.
3. Prevention (Deny)
NanoFirewall, ShenDNS, and endpoints receive preemptive blocking rules for autonomous enforcement at the edge.
4. Investigation
ASPEN receives enriched context for correlation, deep-dive hunting, and SOC workflow with sub-10ms latency.
Platform OverviewOne Platform. Every Layer
Explore the Full PlatformOne Platform. Every Layer
of Your Business Protected.
Start with a single component or deploy the full system. Everything is designed to work together — or alongside your existing security tools.
Deceive
BaitHive Decoy
Digital honey pot traps that look exactly like your real systems — login portals, file servers, devices. The moment an attacker touches one, we know. No legitimate user ever triggers these. Zero false alarms.
US Patent US12284211B2
Deceive
TCP Mirage
Sits at the very edge of your network, catching attackers at first contact — before they have even begun their attack. Works on any device, including old industrial equipment and IoT infrastructure.
Transport-layer · Zero production exposure
Disrupt
CATIS Intelligence
The brain of the platform. Turns every attacker interaction into predictive blocking intelligence — automatically protecting you against threats 1–45 days before they are publicly known to exist.
1–45 days advance detection
Deny
NanoFirewall
A self-learning firewall that fits on any device — even older factory equipment and IoT devices most security tools cannot reach. Updates its threat rules in under 5 seconds, continuously, automatically.
~100MB footprint · 5-second rule updates
Deny
ShenDNS
Blocks malicious connections before they even load — at the domain name level. Also gives management clear visibility into which apps and services staff are using, including risky shadow IT tools.
DNS-layer · Shadow IT visibility
Investigate
ASPEN Analytics
Your security command centre. See everything happening across your business in real time. Investigate threats using plain English — no deep technical expertise required. 50K EPS throughput.
Sub-10ms correlation · LLM console
Assess
Vulnerability Scan
Instant external assessment of what attackers can see when they look at your business online. Delivered as a plain-English PDF report within 24 hours. No software to install. No obligation.
PDF report · 24-hour turnaround
Respond
MIRT Response Team
When a serious attack hits, our team deploys within 2 hours to contain the breach, track the attacker, and get your business back online — with minimal disruption to operations.
2-hour activation SLA · 20+ major incidents
Every component is designed to work independently or as part of the full platform. Start where you need to.
Start with a Free Scan Application security
Review the whole codebase. Then protect every change.
MaxiCyber brings standards-aware code analysis into the developer workflow: establish a full-repository security baseline, scan current Git changes in Visual Studio Code, and trigger traceable full-repository reviews from GitHub Actions.
- Security, functional quality, and performance analysis
- Evidence-linked findings with file and line locations
- OWASP-aligned guidance and prioritised remediation
- Developer and executive reporting from one analysis record
CONTINUOUS
CI-triggered code review
Start a full-repository review from pull-request and push events, retain the base and head commit metadata, and give developers one report for findings, evidence, risk, and next steps.
Explore CI/CD analysisUse the Visual Studio Code extension for full-workspace and current-change scans.
Request a code-security demo Establish the baseline
Map the whole repository and prioritise existing risk.
Review current changes
Give developers fast local feedback before commit.
Track remediation
Keep technical evidence and executive reporting connected.
The Security Pillars
The platform loop is fully autonomous and self-reinforcing. Deception signals feed intelligence production, which feeds prevention enforcement, which feeds analytic investigation — continuously.
Deceive
Deception Mesh
Zero-false-positive deception surfaces capture adversarial behavior at application and transport layers before production systems are reached.
BaitHive Decoy
High-fidelity cyber clone trap (Application & HTTP Layer). Exposes realistic, vendor-specific clone interfaces across IoT devices, edge infrastructure, and corporate portals. Emulates exact HTTP responses and authentication flows.
- • Active Response Shaping
- • JA4H + JA4T Fingerprinting
- • Synthetic Vulnerability Surfaces
TCP Mirage
Transport-layer clone trap. Silently mirrors any TCP-based service across any port, intercepting reconnaissance at the first packet. Functions as an extreme low-overhead precision deception instrument.
- • Extreme Low Overhead
- • Topology Obfuscation
- • Encrypted Traffic Coverage
Disrupt
Intelligence Backbone
Transforms live attacker telemetry into predictive blocking intelligence distributed autonomously across the prevention stack.
CATIS (Cognitive and Adaptive Threat Intelligence Service)
Ingests real-time attacker telemetry from the deception sensor network, enriches it using adaptive AI/ML, and distributes actionable, high-fidelity threat intelligence. Operates a crowd immunity model giving predictive cover 1 to 45 days before public vulnerability disclosure.
Detection Timing
1-45 days advance
False Positives
Near-zero
Zero-day Coverage
Core capability
Intelligence Source
Live interactions
Deny
Prevention Layer
Enforces preemptive blocking rules at network edge, DNS layer, and host — including ARM-class and IoT/OT devices.
ShenDNS
Intelligent DNS enforcement and visibility platform. Preemptively blocks connections to malicious infrastructure (C2 channels, phishing domains) before they are established. Provides organizational visibility into shadow IT usage.
DNS-Layer Enforcement
NanoFirewall
AI-powered, self-learning edge firewall engineered for rapid deployment. With a footprint of ~100MB, it consumes CATIS threat intelligence and applies preemptive blocking rules autonomously in under 5 seconds.
Edge Embedded Module
Investigate
Security Analytics
Correlates telemetry from all components in a unified analyst workspace with sub-10ms correlation and LLM-powered investigation.
ASPEN Platform
High-performance security analytics platform where deception signals, CATIS threat intelligence, DNS enforcement events, and endpoint telemetry converge. Sustained throughput of 50,000 EPS engineered for large enterprise and government environments.
- Sub-10ms Real-Time Correlation
- Multi-Dimensional Behavioral Analysis
- Post-Write Correlation (Threat Hunting)
- LLM-Based Interactive Console
Active Breach Response
Major Incident Response Team
When a serious security incident strikes, speed and expertise are everything. MIRT delivers both — combining proven human capability with purpose-built tooling to contain, eradicate, and recover from the most sophisticated attacks.
Engagement Model
Retainer
2-hour remote activation guarantee with priority commitment.
On-Demand
Engaged as-needed for active incidents without prior commitment.
Rapid On-Site Forensics
Proprietary toolset deployed immediately on-premises. Produces a first-picture attack timeline — patient zero, lateral movement, exfiltration indicators — within hours, independent of existing SIEM or logging infrastructure. Air-gap capable.
Attacker Identification & Isolation
Internal honeypots track active adversary movement. Secondary tamper-resistant endpoint protection layer remains effective even when primary defenses are compromised. Surgical host isolation minimizes business disruption.
Layered Outbound Traffic Control
Proprietary methodology enabling granular, per-layer outbound traffic restrictions — adjustable within minutes based on real-time risk — with no impact to legitimate business operations. Blocks C2 channels and exfiltration paths while preserving necessary connectivity.
20+
Major incidents resolved across defense & infrastructure
2hr
Activation guarantee on standard retainer SLA
National Cyber Defence · South Africa
Enabling National Threat
Intelligence for South Africa
South Africa faces a rapidly escalating cyber threat landscape — state-sponsored actors targeting SOEs, ransomware groups disrupting financial and municipal services, and pervasive attacks on critical infrastructure. MaxiCyber's full ACIS platform creates a sovereign, nationally federated intelligence mesh that transforms every attack attempt into shared defensive intelligence.
By deploying deception infrastructure across government, financial, energy, and telecommunications sectors, we establish a real-time, cross-sector threat picture — giving South Africa's national defenders early warning and the tools to act ahead of threat actors.
Live Mesh
National Mesh — Active
577
/hr
Cyberattacks hit South Africa every hour
R49M
+
Average cost of a single data breach in SA
#3
Most targeted country globally — behind only USA & UK
Protecting South Africa's highest-risk sectors
Banking & Financial Services
Government & Public Sector
Energy & Utilities
Healthcare & Medical
Manufacturing & Industrial
Telecommunications
Legal & Professional Services
Education & Research
Full platform capabilities
How the National Intelligence Loop Works
Each product feeds the next — creating a self-reinforcing, sovereign intelligence cycle
Autonomous
01
Deception Deployed
BaitHive + TCP Mirage
High-fidelity decoys distributed across government, SOE, and critical infrastructure networks capture real attacker behaviour targeting South Africa.
02
Intelligence Produced
CATIS
Raw telemetry is enriched by AI, producing sovereign threat intelligence specific to South African threat actors — shared across all connected defenders.
03
Prevention Enforced
NanoFirewall + ShenDNS
Preemptive blocking rules flow to every endpoint and DNS resolver across the national mesh — stopping known attack vectors before they trigger.
04
Threats Investigated
ASPEN
All signals converge in a national SOC workspace — enabling analysts to correlate cross-sector incidents and hunt persistent threats at scale.
05
Incidents Contained
MIRT + Vuln Scan
When breaches occur, MIRT deploys within hours. Continuous vulnerability scanning ensures the national perimeter stays mapped and hardened.
Assess your organisation's exposure today
Start with a free vulnerability scan and receive a board-level PDF report within 24 hours.
POPIA Compliance
A Cyberattack Isn't Just a Security Problem.
It's a Legal One.
Under South Africa's Protection of Personal Information Act (POPIA), every business that holds customer data has a legal obligation to protect it — and to report any breach immediately. The 2025 amendments have significantly tightened enforcement obligations, with random SME audits, mandatory breach reporting portals, and stricter third-party vendor liability now in effect.
Non-compliance fines reach R10 million per violation. The Department of Justice was fined R5 million in 2023 simply for failing to renew their security software. The era of POPIA as a theoretical risk is over.
Maximum fine per violation
R10 million
Criminal exposure for responsible individuals
Up to 10 years
First major enforcement — Dept of Justice
R5 million
SME fines issued in 2024 alone
R4 million+
Breach reporting obligation
As soon as reasonably possible
2025: new mandatory e-Services portal
Breach reporting required
How MaxiCyber helps
MaxiCyber's platform gives you the detection speed, breach documentation, and reporting tools to demonstrate to the Information Regulator that your organisation took every reasonable step to protect personal data — reducing both your liability exposure and the severity of any potential enforcement action.
POPIA enforcement timeline
2021
POPIA fully effective — compliance deadline
2023
Department of Justice fined R5 million
2024
Over R4 million in SME fines issued
2025
Mandatory e-Services portal · Stricter vendor liability
Free External Vulnerability Assessment
Find Out How Exposed Your Business Really Is — Free
Right now, automated scanners are crawling the internet — probing South African business domains for weak points. They don't send warnings. Our free scan does exactly what those scanners do, but shows the results to you first.
In 5–10 minutes, you'll know what hackers already know about your business.
- Open ports and exposed services visible from the internet
- DNS configuration weaknesses attackers exploit for phishing
- Known vulnerabilities in your web infrastructure
- Whether your domain appears in active attacker intelligence feeds
- Email security misconfigurations that enable phishing in your name
- Forgotten subdomains that create entry points before you find them
1Scan details
2Create account
Listed on
MicrosoftMarketplace
MaxiCyber is listed on the Microsoft Azure Marketplace, enabling enterprise and government customers to procure the platform through existing Microsoft licensing agreements — simplifying billing, procurement, and compliance documentation.
View on Azure Marketplace
Enterprise Threat Intelligence · CATIS
Partner with MaxiCyber
Build a cybersecurity revenue line without building the platform.
Resell MaxiCyber, launch a white-labelled managed service, or take the offer into accounts you already serve. We provide the product foundation; you own the customer relationship and route to market.
Explore partner modelsWhite-label platform
Deploy MaxiCyber under your brand, domain, offer structure, and customer experience.
MSP and MSSP resale
Package recurring cyber defence, assessments, code security, and response for your customers.
Microsoft channel
Support Microsoft-aligned procurement and CSP-led customer relationships where eligible.
Managed deployment
Choose vendor-operated delivery or a controlled partner deployment for customer data needs.
01
Choose the model
Referral, reseller, managed service, white-label, or Microsoft channel.
02
Build the offer
Combine platform capabilities with your onboarding, remediation, compliance, and support.
03
Launch with support
Use a defined deployment, enablement plan, escalation path, and customer ownership model.
Active scans running across South Africa
Don't Wait for a Breach.
Start With a Free Scan Today.
The average South African business has already been probed hundreds of times this week. Find out what attackers see when they look at your business — in 2 minutes, for free, with no obligation.
Active incident? Contact our MIRT emergency line for immediate 2-hour response activation.
577/hr
Cyberattacks hit South Africa every hour
R49M
Average cost of a single data breach in SA
1,863/wk
Average attacks per organisation per week
5%
Of SA companies rated cyber-mature