Built in Accra for Ghana's regulated institutions
Hydra investigates every alert and shows its working.
Every alert gets a verdict and the evidence behind it. We are building to run Hydra for you as a licensed security operation, and nothing changes in your systems unless a person approves.
Talk to us about an evaluation
See how an investigation works →
Early stage. Hydra works in our lab. We have no customers yet, and we do not hold our licence yet.
Too many alerts, too few people
Most of what your monitoring tools raise is harmless. A few alerts are not, and they look the same until someone digs. That digging is slow, it depends on who is on shift, and it is hard to show an auditor afterwards.
The Bank of Ghana's 2026 cybersecurity directive expects regulated institutions to detect threats and respond to them. Good analysts are hard to find, and most smaller institutions cannot staff a team around the clock. We built Hydra to do the first pass on every alert, and we are building the service around it.
What Hydra does with an alert
- It arrives. Your monitoring tools send the alert to Hydra: Wazuh, Splunk, Microsoft Defender and others. Hydra keeps the full original event.
- It checks the event. Hydra looks at what the event itself shows. Did a program in a user's Downloads folder read the memory that holds passwords? Did Word start PowerShell with an encoded command? 35 patterns like these are built in, and each one is explained in plain words.
- It looks around. It finds other alerts on the same machine or user, and what your analysts decided about similar alerts before.
- It writes a verdict. An AI model reads what Hydra gathered and writes one of three verdicts: attack, harmless, or needs a person. Every verdict lists the evidence it relies on.
- Rules check the AI. Hydra's own rules can overrule the model. If the event shows a strong attack pattern, the model cannot dismiss it. If the evidence is thin, the verdict is "needs a person".
- A person decides. Hydra may recommend isolating a computer or disabling an account. Nothing happens until someone with the right role approves it, and every decision is logged.
An investigation, opened
The evidence score runs from 0 to 100 and measures how much evidence points to an attack. It is not a probability. It rises when the event shows attack patterns or other alerts on the same machine or user agree. It falls when the event matches routine activity.
You stay in charge
Hydra recommends. You decide. A person with the right role approves every action before anything runs. A kill switch stops all actions at once. Every decision goes into an audit log in which a changed or deleted entry can be detected.
Today Hydra runs in advice-only mode: it does not change anything in your systems at all. How we keep Hydra safe, and where we are
Who runs it
Today you run Hydra. Your analysts read what it writes and decide. That is how we are testing it.
The plan is for us to run it for you. As we read the Bank of Ghana's 2026 directive, the security monitoring system an institution subscribes to has to be run by a company accredited by the Cyber Security Authority and owned mostly by Ghanaians. So we are not planning to sell you software and step back. Radiant is preparing to apply for that licence. Hydra will do the first look at every alert, and our analysts will handle the ones that need a person.
It would come as one annual subscription, set by your institution's Bank of Ghana tier, covering the software, the operation and the reports the regulator asks for. We have not fixed prices, and nobody pays us yet.
This is our reading of the directive. A Ghanaian lawyer has not checked it yet. How we handle licensing
What we have measured, and what we have not
In a lab test with Qwen3.8-27B and program evidence, Hydra confirmed 23 of 26 attacks and cleared 204 of 251 harmless alerts. No attacks were dismissed and no false alarms were raised in this sample.
The program-history setup separates attacks from harmless activity by construction, so this is an upper bound, not a production estimate. The full results include two other evidence settings and every case left to a person.
Measured 25 October 2026 on 277 recorded cases. Engine v2 is not enabled in production.
Connectors we have built
Hydra can read alerts from Wazuh, Splunk, Microsoft Sentinel, Microsoft Defender, CrowdStrike Falcon, Microsoft Entra ID, Okta, Google Workspace, AWS GuardDuty and Google Cloud, and from an on-premises Active Directory relay. A Palo Alto Networks connector can block an address once a person approves it.
Real events have reached Hydra in our own lab from Wazuh, Okta, CrowdStrike Falcon, Splunk and an Active Directory relay. The other connectors are built, most of them with automated tests, and we will prove each one with the first team that uses it.
On our list, not built yet: SentinelOne, VMware Carbon Black, Cisco Umbrella, Fortinet, Elastic, Sumo Logic, ServiceNow, PagerDuty, Jira, Qualys.
Four people in Accra
We met on a security internship at Telecel Ghana. Three of us are cybersecurity engineers and one is a finance lead. Samuel puts it this way: "I had a huge list of alerts to sort through, and it took me five days. I built a prototype of our current investigation engine in my homelab."
Start with a shadow evaluation
Hydra reads your alerts for six weeks and writes down what it would conclude. It changes nothing. Your analysts keep doing their work, and at the end you compare the two.
An evaluation comes first. Running Hydra as a service for you starts only once we hold our licence.
We will not start with a customer until the Cyber Security Authority has confirmed our licence position in writing. We are glad to talk before then.
Last reviewed: 21 October 2026 by Samuel Maclar.