Squirks Plain answers to the questions buyers ask most.
No. Unusual means far from your normal, not proven hostile. A printer out of paper can look as surprising as an intrusion. So can a misconfiguration, one-off admin work, or a new app.
Squirks decides which events get looked at first. People, with help from labeling and AI analysis if you want it, decide what those events mean.
No. Squirks groups events that look alike into a single line, so thousands of similar events show up as one item to review.
The grouping comes from the math, not from rules someone wrote. Squirks sets aside the surprising parts of each event and groups events whose ordinary parts match. You only choose how fine or coarse the groups are. Familiar activity stays apart from strange activity, so the list reads as a short set of distinct things, not one muddled bucket.
No. Reading everything is the problem, for an AI just as for a person: there is too much, and something has to decide what deserves attention first. Squirks makes that decision with math.
It hands people, or an AI assistant, a short list instead of the whole haystack. That cuts what anyone has to read, and what you spend on AI to read it.
Yes. The score is a defined measurement: how far an event sits from the baseline Squirks learned from your data, counted in bits. It is not a mystery severity dial.
You can walk someone through the chain: this data’s baseline, this event’s score against it, and why similar events were grouped. In practice you defend your analysis of the event, not the number. The score just decided what reached your desk.
No. A SIEM is the system that collects and searches your security logs. Squirks can sit in front of it and send along only what is worth reading, so the SIEM spends its attention on a shorter list.
You do not need a SIEM for Squirks to be useful, though. You can work the short list directly. What Squirks does not do is case management: it can open a ticket, but it does not close one.
Because rules only catch what someone already thought to describe. Writing one means guessing what attackers will try next, and a rule that never fires cannot tell you whether you are safe or just not looking at the right data.
Rules are also expensive to keep up: hours of expert time per rule, or a large pack of someone else’s rules that mostly do not fit what runs in your environment. Squirks learns your normal from your own data and shows what does not fit, without waiting for anyone to write anything.
No. Lists of known-bad addresses and file fingerprints only cover what someone has already seen and chose to publish. They are not a map of what will happen next to you.
Squirks does not start from any list. It ranks activity against your own normal. It works fine alongside the lists you already trust.
Not the usual kind. Most anomaly and behavior tools still rely on things people wrote ahead of time: which fields to pull out, which patterns count as bad, which thresholds matter.
Squirks starts from none of that. It learns what your data normally looks like, byte by byte, and ranks what stands out. You can hand its short list to those other tools if you have them.
Keep them. Endpoint tools, the software agents that watch and protect individual computers, can stop harmful programs from running. Squirks does not do that job.
The gap is everything that cannot run an agent: factory and utility equipment, network gear, appliances, and many other systems. They still produce data. Squirks can learn their normal from that data without installing anything on them.
No. Squirks does not decide what an event means or close anything. It gets the most unusual events in front of people fast, with labeling and AI notes attached if you want them. Your people still decide what matters, what to chase, and what to ignore.
You can sketch the idea in an afternoon. Running it well is the hard part: stable learning on raw data, ranking that stays useful as your normal shifts, grouping without hand-written rules, and a path from the short list to the people who act on it.
Homegrown versions usually stall on data formats and rule packs, or never reach the people who need them. Squirks is that layer, already working. Spend your engineers on the problems only your environment has.
Squirks has to see your data to learn from it and score it. If Squirks runs where your data lives, the data stays put. If Squirks runs somewhere else, you stream the data to it.
Either way, Squirks does not keep your data after it has learned from it and scored it. It keeps two things. The first is the model, a compact picture of your normal (megabytes learned from gigabytes). The second is the short list itself: while a group of lookalike events is on the list, Squirks keeps one example event for it. The rest of the group is only counted, not stored. Your originals stay in the systems you already trust.
Yes, and you should treat it that way. A model that has learned your data can be made to generate new data that looks a lot like the original. So the model is as sensitive as what it learned from: if the data is classified, treat the model as classified too.
That is one more reason Squirks can run where your data already lives, under the same protections.
Almost any. Squirks reads raw bytes, so nobody has to explain a format, write a parser, or split data into fields first. Logs, network records, messages, and output from factory equipment or appliances that no other tool understands all work.
The one honest limit: truly encrypted data looks random, so there is little to learn from it. Data that is merely unreadable to people is different. Codes, tokens, and headers that repeat still form patterns Squirks can learn, and something new in them still stands out.
No. Squirks only sees the data you point at it. What you leave out stays unwatched, the same as with any tool. The difference is that cost no longer forces the choice, so what stays unwatched is a decision, not an accident of budget.
Because watching and storing are different costs. Most security tools charge by how much data you send and keep, so teams cut back: they sample, turn logging down, or skip systems. Whatever gets cut can never be caught.
Squirks’ cost follows the work of learning and scoring, not how much you keep. It can watch data you could never afford to store in your SIEM, and send only the short list on to the expensive tools.
It still needs hardware, but far less. A single machine with a graphics card can do much of the learning and scoring. The model of your normal stays small next to the data it learned from, so you are not paying to keep everything forever.
Less than you might think. The goal is not a perfect probability for every event. It is a short list that is close to the one you would want. Once a model has learned from your data, Squirks can start ranking, and the list keeps improving as more of your normal comes in. In our own case study, the model had four days of data.
If their activity truly matches what your data already does, it will not stand out. That is the honest limit of comparing against normal.
Blending in that well is harder than it sounds. Squirks scores every byte, and most real attacks introduce something new: an unfamiliar file name, a strange address, an odd pattern. Squirks does not promise every patient attacker will glow. It does mean anything that is not already your normal has a much worse place to hide than data nobody is watching.
That risk is real for anything that learns normal. In practice, trying it has a shape: a flood of similar attempts groups together on the short list, so people can act while the attempt is still going on.
Becoming normal takes a lot of volume over time, not a handful of tries. If a flood is ignored long enough, it can fade into normal for that kind of event, and then something that follows it, like a successful login from a strange address, stands out even more.
It will look unusual at first. A new app, a busy season, or a system swap is new until it becomes routine. When your new software shows up on the short list, that is the system working.
As the new behavior becomes common, it stops standing out and stops competing with the real outliers. Squirks keeps learning the normal you actually run, including the changes you meant to make.
Still have a question? Talk to us, or see it on real data in the case study.