Skip to content
PHP2Shell: the critical PHP vulnerability and how to patch it
Black Shard

Popular

Black Shard
Talk to us24/7 incident line 1800 370 270

Whitepaper

Jetstone: the agent, detection, response and undo model

Jetstone will watch Windows and Mac devices and Microsoft 365 or Google Workspace sign-ins, act on its own against high-confidence threats on a published list, and let every automatic action be undone.

  • Current at 26 Oct 2026
  • PDF, 7 pages, 304 KB
  • BS-RPT-04, version 1.0
Download the PDF, PDF, 7 pages, 304 KBEvery report

Executive summary

Jetstone is a cyber defence agent for organisations with 1 to 200 devices. It will watch Windows and Mac devices and Microsoft 365 or Google Workspace sign-ins, and it is built in Australia and will be hosted there.

A lightweight agent for Windows 10 and 11 and macOS 13 and later, with no kernel driver. Detection will run in Microsoft Azure Australia East, with rules mapped to MITRE ATT&CK. On a high-confidence detection, Jetstone is designed to act on its own against threats on a published list: end the process, quarantine the file, isolate the device, or sign the user out of Microsoft 365 or Google Workspace. Every automatic action will be undoable in one tap.

Three design rules carry the product. Detection will be deterministic, so every finding can be traced to the rule that matched it. The plain-English write-up will explain an incident and never decide what happens to it. And every automatic action will be reversible, so a business can turn protection on without fearing the false alarm.

  • An agent on each device, with no kernel driver, designed to work alongside the antivirus built into Windows.
  • Detection and storage in Microsoft Azure Australia East.
  • Automatic response only against a published list, only on high confidence, inside fixed guardrails.

Whitepaper

The figures

From the device to the undo

Five steps: an agent on the device collects process, file, network and sign-in telemetry; detection in Microsoft Azure Australia East with rules mapped to MITRE ATT&CK; one incident per device or user, written up in plain English; the response on a high-confidence detection on the published list; and an undo from the notification. Agent on the deviceProcess, file, network and sign-in telemetry, with no kerneldriverDetection in Australia EastRules mapped to MITRE ATT&CKOne incident, in plain EnglishFindings grouped per device or user, with the evidence keptResponse on high confidenceEnd, quarantine, isolate or sign out, from a published listOne-tap undoFrom the notification that reports the action
Jetstone’s model in five steps, as it is designed to run. Source: Jetstone product design.

Identity: from the signal to the response

Four identity signals, impossible travel, MFA fatigue, a malicious inbox rule and a risky OAuth consent, lead to a confirmed account compromise, which leads to four responses: revoke the sessions, disable the account and force a password change, delete the inbox rule, revoke the OAuth grant. The signalsImpossible travelMFA fatigueA malicious inbox ruleA risky OAuth consentConfirmed account compromiseMatched to the device the user signed in fromThe responseRevoke the sessionsDisable the account, force a new passwordDelete the inbox ruleRevoke the OAuth grant
Signing the user out is the first step of the response, never all of it. Source: Jetstone product design.

The isolation guardrail

A fleet drawn as a grid of devices. Jetstone may isolate the top half on its own; the line across the middle is the point where automatic isolation stops. The device it was enrolled from is marked for a second confirmation. Automatic isolation stops here: never more than half of afleetMay be isolated automaticallyNeeds your approvalEnrolling device, second confirmation
Automatic isolation stops at half of a fleet, and the device Jetstone was enrolled from needs a second confirmation. Source: Jetstone product design.

Response and undo

On a high-confidence detection, Jetstone is designed to act on its own against threats on a published list: end the process, quarantine the file, isolate the device, or sign the user out of Microsoft 365 or Google Workspace.

Three policy presets, Watch, Guard and Lockdown, with fixed isolation guardrails. Watch will detect and notify, and will take no action on its own. Guard, the default preset, will act on its own on high-confidence detections on the published list and turn everything else into a card to approve or dismiss. Lockdown will be the strictest of the three.

Every action will be logged, and every automatic action will be reversible from the notification that reports it. Every automatic action will be undoable in one tap.

Undo is what makes automatic response usable on a small fleet. A business without a security team cannot afford to have a payroll laptop cut off on a false alarm and wait until Monday for someone to release it, so release will sit in the same notification as the action.

What to do

Questions to put to any detection and response product before it goes on your devices:

  1. Where is the telemetry processed and stored, and does any of it leave Australia?
  2. Which actions can the product take on its own, and is that list published?
  3. Can every automatic action be undone, by whom, and how quickly?
  4. Does anything other than a rule decide what action to take?
  5. What evidence is a write-up drawn from, and what stops it describing something that did not happen?
  6. What limits stop a misfiring rule from isolating the whole fleet?
  7. Does the product check that the built-in antivirus is running, or does it replace it?

The Jetstone waitlist is open. Register at blackshard.com.au/contact to hear first when it opens to new businesses.

Method

Jetstone is in build. Every capability below is described as it is designed, in the future tense, from the product’s engineering specification. Where the design fixes a rule in code, such as the isolation guardrails, the rule is stated as it will ship.

Prices, the count of detection rules and detection rates are held back. A detection rate means something only beside the test that produced it, and we will publish figures with their tests.

The model draws on the work our practice already does: the telemetry our own monitoring reads, the incidents our response team handles, and the attacks our advisories describe. Our security monitoring analysed its first 430 million security events from 1 October to 26 October 2026, counted at 00:45 AEST.

BS-RPT-04, published 26 Oct 2026

The full whitepaper, as a PDF

PDF, 7 pages, 304 KB. Current at 26 Oct 2026.

Download the PDF, PDF, 7 pages, 304 KBTalk to us

More reports