Quiet research. Working tools for defenders.
Venode is an AI research lab. Mara is our language model for cyber defence, built to triage at speed, reason under uncertainty, and stay out of the attacker's way.
A language model for cyber threat intelligence.
Mara is built for the analytical work behind a credible security programme: triage, malware analysis, incident response and threat reporting. Deployed inside the tenant, calibrated by senior practitioners, and accountable to a documented model card.
- Financial services
- Healthcare and life sciences
- Scientific research
- Critical infrastructure
- 200K-token context
- STIX, MISP and JSON outputs
- Tenant-deployed
- Documented model card
mara/v1 · model card · refusal behaviour documented
Venode Labs.
Two halves of the lab: the research upstream of Mara, and the models we build to spec for teams who need their own.
Research areas
- 01
Post-training and variant fine-tuning.
Mara is post-trained on threat reports, IR write-ups, malware analyses and detection logic, and evaluated on what defenders actually do, not on benchmark trivia.
- 02
Long-context inference.
200K context as the default, not a tier upgrade. A whole IR ticket, sandbox report and packet capture in one prompt. Document-first reasoning, retrieval kept thin.
- 03
Editorial alignment.
Teaching the model to hold back. Calibrated confidence. Refusal of operational offensive work. No padded answers, no enthusiasm on someone else's behalf.
- 04
Inference economics.
Latency, batching, caching, cost per million tokens. What it takes to run a serious cyber model at a price a small team can defend.
Custom builds. Built for you, not trained on you.
If you don't want a shared product, we build one for you. On-site, hosted, or hybrid. We design and train on your corpus, ship the result to your stack, and stay out of your data. No telemetry into a shared pool. No advertisers. No resale, ever.
- 01
Designed and trained to spec.
On your detection logic, your historical IR, your runbooks, your sources. Mara learns how your team thinks rather than how the public internet does.
- 02
On-site, hosted, or both.
Run it on your hardware behind your firewall, or on ours, or split the difference. The choice stays yours; we sign whatever you need us to sign.
- 03
Your data does not train anything else.
We do not pool customer data into a shared training set. Your corpus trains your model and only your model.
- 04
No advertisers. No resale.
We do not sell data, sell access to data, or hand it to a third party. Not for revenue, not for partnerships, not at all.
Built in the open.
The research is open. Read it to see what we are building, what we are sketching, and what we have decided Mara will never do.