On-device malware detection for embedded systems. No cloud. No signatures. No GPU. 37 KB of deterministic C classifying threats in 34 nanoseconds.
A decade of work in systems, security, and architecture — all public, all verifiable.
#9 Egypt · 12+ critical vulns in 48 hours · Feb–Jun 2026 · Publicly verifiable
PTRR Framework · Minor revisions requested and completed
PTRR Framework · 9 reviewers engaged, 2 active through all 4 rounds, 1 explicit publication endorsement
Planck-99, Axiom-WAF, SYRTH, AdmitGPT, and 11 others — no team, no institutional resources
Z-Jail (native code sandbox for Linux) highlighted among the week's new tools in Risky Business newsletter, June 8, 2026
A qualified legal guardian is fully in place and prepared for all formal engagements. A specialized law firm with expertise in cybersecurity law, data protection, and intellectual property has been retained on behalf of Division-36 to handle all commercial, contractual, and IP matters. Full legal capacity for investment negotiations, licensing agreements, and regulatory compliance is operational.
Traditional antivirus needs 50–500 MB RAM and multi-core CPUs. Your average IoT device has 256 KB–4 MB. By December 2027, the EU Cyber Resilience Act mandates security for every connected device sold in Europe. No production-ready product fits.
Cameras, routers, industrial sensors, medical devices — all connected, all vulnerable, all running hardware that cannot host traditional security stacks. 64% run on MCU-class hardware.
Flax Typhoon (Raptor Train) compromised 260,000+ cameras, routers, and storage devices. FBI disrupted it September 2024. The playbook is proven and repeatable.
No production-ready behavioral malware detection engine deploys at 37 KB with no network, no GPU, and no FPU. The category does not exist yet.
The structural gap: Embedded hardware gives you 256 KB–4 MB RAM. Traditional AV wants 50–500 MB. Cloud solutions need constant connectivity. Signature scanners cannot catch zero-days. Every existing approach fails the constraints — and regulation now mandates those constraints be met.
2024–2027 is not arbitrary. Regulation, nation-state activity, and ICS vulnerability rates are hitting inflection points simultaneously.
Regulation (EU) 2024/2847 entered into force December 10, 2024. Full obligations apply December 11, 2027. Every device manufacturer selling into Europe must demonstrate on-device security. Reporting obligations begin September 11, 2026. Non-compliance: €15M or 2.5% of global annual turnover, whichever is higher — or removal from the EU market entirely.
Flax Typhoon (PRC-state) built Raptor Train from 260,000+ compromised IoT devices. Volt Typhoon sat inside US critical infrastructure for five years undetected. This is geopolitics executed through unsecured embedded hardware.
508 ICS advisories in 2025 — the first year CISA published 500+. Average CVSS crossed 8.0 for the first time in 2024 and held in 2025. 82% of 2025-only advisories rated high or critical.
32-dimensional normalized frequency vectors. Int8-quantized closed-form inference. No neural networks. No cloud. No GPU. No FPU. No runtime dependencies. Every classification produces a JSON proof file for CRA Article 13 compliance.
Syscall sequences are modeled as 32-dimensional normalized frequency fingerprints. Training computes a closed-form decision surface. Inference is a deterministic int8 dot product — identical input, identical output, every time. The model generalizes 51× beyond its training ceiling because normalized frequency ratios are length-invariant by construction.
All benchmarks public and reproducible. The IoT dataset is the primary target — malware from 2016–2026 the model never encountered during training. C kernel numbers shown (int8 quantized).
What actually happens when you try to run existing tools on a microcontroller or embedded Linux SoC.
| Metric | Traditional AV | Cloud Detection | Signature Scanner | Planck-99 |
|---|---|---|---|---|
| Peak RAM | 50–500 MB | Server-side | ~30 MB | 0.03 MB |
| Inference time | 10–100 ms | 200–2,000 ms | 1–50 ms | 34 ns |
| Network required | No | Mandatory | No | Never |
| GPU / FPU required | No | Yes | No | Never |
| Air-gap safe | ✗ | ✗ | ~ | ✓ |
| MCU-class viable | ✗ | ✗ | ✗ | ✓ |
| Deterministic | No | No | ~ | ✓ |
| Accuracy (IoT, unseen) | 95–98% | N/A | Signatures only | 96.28% |
18.7% CAGR global IoT security. The real driver is a December 2027 compliance cliff, not organic growth.
By December 11, 2027, every connected device sold in Europe must meet mandatory cybersecurity requirements (Regulation EU 2024/2847). Non-compliance triggers a fine of €15M or 2.5% of global annual turnover, whichever is higher — or removal from the EU market entirely, with no size exemption for small manufacturers.
Exein, Nozomi, Claroty, and Dragos all require a Linux kernel with eBPF support or network-layer visibility. Planck-99 is pure C — the only production path into the 64% of IoT devices running MCU-class silicon with no OS, no GPU, sometimes no FPU.
Europe's semiconductor market reached $137.3B in 2025, backed by €43B in EU Chips Act investment to double regional production capacity by 2030. Germany alone holds 25–27% of that market, anchored by automotive and industrial OEM demand.
EU Cyber Resilience Act (2024/2847) · UK PSTI Act (enforced April 2024) · Japan JC-STAR labeling (2024) · FDA Cybersecurity in Medical Devices Guidance (2023) · NIST SP 800-213A · Saudi NCA and UAE frameworks emerging. See full table below.
| Region | Regulation | Status | What it requires |
|---|---|---|---|
| European Union | Cyber Resilience Act (2024/2847) | Binding · Dec 2027 | On-device security evidence for every connected product; €15M / 2.5% turnover penalty or market removal |
| United Kingdom | Product Security & Telecoms Infrastructure (PSTI) Act | Enforced Apr 2024 | Bans default passwords, mandates vulnerability disclosure for consumer connectable products |
| Japan | JC-STAR IoT Security Labeling | Active 2024 | Government-backed security labeling scheme for IoT devices sold domestically |
| United States | NIST SP 800-213A / FDA Medical Device Guidance | Active | Federal IoT baseline security controls; mandatory cybersecurity documentation for connected medical devices |
| Saudi Arabia | National Cybersecurity Authority (NCA) IoT controls | Emerging | Government-mandated IoT security controls with penalties for critical infrastructure operators |
| UAE | UAE IoT Security Framework | Emerging | Minimum security benchmarks for connected devices under national cybersecurity strategy |
Different layer, different hardware tier. No competitor checks all four boxes at the MCU level.
| Category | On-device | Air-gapped | Real-time | MCU-class | Notes |
|---|---|---|---|---|---|
| Traditional AV Kaspersky, CrowdStrike | ✗ | ✗ | ✓ | ✗ | 50–500 MB RAM |
| Cloud Detection Darktrace, Vectra | ✗ | ✗ | ~ | ✗ | Mandatory connectivity |
| Signature Scanners YARA, ClamAV | ~ | ✓ | ✗ | ✗ | No behavioral analysis |
| OT Network Platforms Nozomi, Claroty, Dragos | ✗ | ~ | ~ | ✗ | Network layer only — partners, see below |
| Exein (Pulsar) | ✓ | ~ | ✓ | ✗ | eBPF/Linux only · €700M val · no MCU |
| Planck-99 | ✓ | ✓ | ✓ | ✓ | 37 KB · 34 ns · 96.28% · deterministic |
These platforms operate at the network layer: they see traffic moving between devices on an industrial floor. Planck-99 operates at the device layer: it runs inside the MCU-class hardware itself, where no Linux-dependent, eBPF-based, or cloud-connected platform can physically reach. A joint customer facing CRA audit needs both layers to produce a complete compliance artifact — network-level visibility plus device-level behavioral evidence. That combination is the natural bundling motion for OT platforms that want to close the same gap Accenture just paid $4.175B to acquire Dragos, runZero, and NetRise for — without any of it touching MCU-class silicon.
Exein raised €170M in 2025 at ~€700M valuation — proof the embedded security market is real, large, and expanding. But Exein requires Linux with eBPF support and cannot reach MCU-class hardware. That's the 64% of the 21 billion device install base they cannot address.
No revenue projections until a contract is signed. These priorities are aligned with the EU CRA December 2027 compliance window. Full legal infrastructure is operational.
An IoT gateway or OT security vendor shipping embedded Linux devices — Advantech, Moxa, Kontron class. The product already runs on their hardware class. This is integration, not invention.
Planck-99 deploys as a 27 KB binary with a kernel hook. Integration takes hours, not months. The partner gets a JSON proof file per classification — auditable, CRA Article 13 compliant, verifiable by any auditor or reinsurer.
A signed agreement is proof of market demand no pitch deck can substitute. It de-risks every subsequent conversation with investors, accelerators, and OEM partners — and validates the EU CRA compliance story.
Alongside OEM design partners, Planck-99 targets a reinsurer compliance channel (Munich Re, Swiss Re, Lloyd's, SCOR, AXA XL). If a leading reinsurer mandates Planck-99 for OT coverage eligibility, OEM adoption becomes pull-through demand — no sales cycle required. 12–18 month engagement cycle aligned with the EU CRA December 2027 enforcement deadline. No competitor — including Exein — has this channel.
A qualified legal guardian is fully in place. A specialized law firm with expertise in cybersecurity law, data protection law, and intellectual property has been retained by Division-36 for all commercial, licensing, and investment engagements. Full legal capacity for contract negotiations, IP registration, and regulatory compliance is operational today — no delays on our side. On single-founder risk: the core engine is 37 KB of deterministic C — not team-dependent complexity. IP and architecture are fully documented.