On-device malware detection built for embedded systems. No cloud. No signatures. No GPU. 37KB of deterministic C that classifies in 34 nanoseconds.
Traditional antivirus needs 50–500MB RAM and multi-core CPUs. Your average IoT device has 256KB–4MB. By early 2027, the EU Cyber Resilience Act makes security mandatory for every connected device sold in Europe. There is currently no production-ready product that fits.
Cameras, routers, industrial sensors, medical devices — all connected, all vulnerable, all running on hardware that cannot host traditional security stacks.
Flax Typhoon (Raptor Train) compromised cameras, storage, and routers at scale. FBI disrupted it in September 2024. The playbook is now proven.
There is literally no production-ready behavioral malware detection engine that deploys at 37KB with no network, no GPU, and no FPU. The category does not exist yet.
The structural gap: Embedded hardware gives you 256KB–4MB RAM. Traditional AV wants 50–500MB. Cloud solutions need constant connectivity. Signature scanners cannot catch zero-days. Every existing approach fails the constraints — and regulation now mandates those constraints be met.
2024–2027 is not arbitrary. Regulation, nation-state activity, and vulnerability rates are hitting inflection points simultaneously. The EU CRA creates a hard compliance cliff.
Regulation (EU) 2024/2847 enters into force January 2025. Obligations for most connected devices apply 36 months later — early 2027. Every device manufacturer selling into Europe must have an on-device security capability. Perimeter-only defense is no longer legally sufficient. This is not a market opportunity; it is a compliance mandate with a countdown.
Flax Typhoon (PRC-state) built Raptor Train from 200,000+ compromised IoT devices. Volt Typhoon sat inside US critical infrastructure for five years undetected. This is no longer cybercrime — it is geopolitics, and the battlefield is your router.
2,155 CVEs across 508 ICS advisories in 2025 — the first year CISA ever published 500+ ICS advisories. Average CVSS crossed 8.0 for the first time. 929 high-severity CVEs in 2024 alone. 75% of all advisories rated high or critical.
Benchmarked across every category. Here is what actually happens when you try to run them on a microcontroller or embedded Linux SoC.
| Metric | Traditional AV | Cloud Detection | Signature Scanner | Planck-99 |
|---|---|---|---|---|
| Peak RAM | 50–500 MB | Server-side | ~30 MB | 0.03 MB |
| Inference time | 10–100 ms | 200–2,000 ms | 1–50 ms | 34 ns |
| Network required | No | Mandatory | No | Never |
| GPU / FPU required | No | Yes | No | Never |
| Air-gap safe | ✗ | ✗ | ~ | ✓ |
| MCU-class viable | ✗ | ✗ | ✗ | ✓ |
| Deterministic | No | No | ~ | ✓ |
| Accuracy (IoT unseen) | 95–98% | N/A | Signatures only | 96.28% |
32-dimensional normalized frequency vectors. Int8-quantized closed-form inference. No neural networks. No cloud. No GPU. No FPU. No runtime dependencies.
Zero black boxes. 100% deterministic. Training computes a mathematical decision surface; inference is a quantized dot product. Every classification produces a JSON proof file — a complete audit trail.
Most ML in security is a black box. You feed it data, it gives you a probability, and you hope it is right. Planck-99 is different.
We model syscall sequences as 32-dimensional normalized frequency fingerprints. Training computes a closed-form decision surface. At runtime, inference is a deterministic int8 dot product — identical input always yields identical output.
The model generalizes 51× beyond its training ceiling (tested to 117,088 syscalls) because normalized frequency ratios are length-invariant by construction. No neural networks. No stochastic behavior. No runtime training.
All benchmarks public. No cherry-picking. The IoT dataset is our primary target — malware from 2016 to 2026 that the model never encountered during training. C kernel numbers shown (int8 quantized).
18.7% CAGR. But the real driver is a 2027 compliance cliff, not market growth.
By early 2027, every connected device sold in Europe must meet mandatory cybersecurity requirements. Manufacturers who cannot demonstrate on-device security capabilities will be legally barred from the market. This creates immediate, non-discretionary demand for a solution that deploys on existing MCU-class hardware without redesigning the product.
Industrial OT requires on-device, air-gapped detection. No cloud solution qualifies. This structural gap is exactly what Planck-99 fills. Industrial IoT security alone was $26.24B in 2024. North America holds 34.2% global share.
APAC IoT security CAGR: 22.2% — highest globally. Japan's JC-STAR IoT security labeling (2024) signals regulatory alignment. Rapid industrial digitalization across Southeast Asia and India creates massive greenfield opportunity.
EU Cyber Resilience Act (2024/2847). UK PSTI Act (enforced April 2024). FDA Cybersecurity in Medical Devices Guidance (2023). NIST SP 800-213A. Every single one mandates on-device security capabilities. Compliance is no longer optional — and the deadline is fixed.
No revenue projections here — those are fantasies until you have a signed contract. These phases represent directional priorities aligned with the EU CRA 2027 compliance window.
No competitor checks all four boxes. Most fail on two or more. That's not a feature gap — it's a category gap that happens to be legally mandated by 2027.
| Category | On-device | Air-gap safe | Real-time | MCU-class | Notes |
|---|---|---|---|---|---|
| Traditional AV Kaspersky, CrowdStrike |
✗ | ✗ | ✓ | ✗ | 50–500 MB RAM requirement |
| Cloud Detection Darktrace, Vectra |
✗ | ✗ | ~ | ✗ | Mandatory connectivity |
| Signature Scanners YARA, ClamAV |
~ | ✓ | ✗ | ✗ | No behavioral analysis |
| OT Platforms Nozomi, Claroty |
✗ | ~ | ~ | ✗ | Network layer only |
| Planck-99 | ✓ | ✓ | ✓ | ✓ | 27 KB · 34 ns · 96.28% |
Everything else — investor decks, revenue projections, patent filings — is noise until a real customer validates the integration. Here's how we get there. Bootstrapped to date. Open to seed partners and strategic investors.
An IoT gateway or OT security vendor shipping embedded Linux devices with an active security team. The product already runs on their hardware class. This is integration, not invention.
Planck-99 deploys as a 27KB binary with a kernel hook. Integration takes hours, not months. The vendor gets a JSON proof file per classification — auditable, verifiable, and compliant with upcoming EU CRA traceability requirements.
A signed agreement is the proof of market demand no pitch deck can substitute. It de-risks every subsequent conversation with investors, accelerators, and OEM partners — and validates the EU CRA compliance story.