We started Falak Neo because we were tired of guessing what our own workloads were doing
Falak is the Arabic word for the celestial sphere — the frame within which everything else moves. It seemed like the right name for a platform whose whole argument is that you should observe the frame, not the objects' own accounts of themselves.
What we believe
Four opinions that shape the product
Open schemas beat proprietary ones
We chose OCSF before it was fashionable, and we implement it strictly rather than as an export format. If a customer decides to leave, their six years of history is already in a schema someone else can read. That constraint makes us better, not weaker.
A detection without a technique is not a detection
It is an anomaly with a colour. Requiring an ATT&CK technique on every finding forces detection engineering to answer 'what would an attacker be doing here?' before shipping, and it makes coverage a measurable property instead of a slide.
The analyst is the customer, not the buyer
Procurement signs the contract; a person on-call at 3am decides whether the product was worth it. Every screen in the console is built for that person — dense, keyboard-driven, and honest about what it does not know.
Boring architecture, interesting detections
One sensor, one core, one console. No collector tier, no message bus, no service mesh between our own components. We spend our complexity budget on the eBPF and the detection content, because that is where it buys something.
How we got here
A short history
2023
The prototype
Two of us were on-call for a Kubernetes estate where the only runtime signal was container stdout. We wrote a weekend eBPF prototype to answer 'what actually execs in this namespace?' and never stopped.
2024
OCSF as a constraint, not a feature
We threw away our internal event schema and rebuilt on OCSF v1.3. It cost a quarter and it made every subsequent integration a configuration rather than a project.
2025
Sensor and core open-sourced
Apache-2.0 for the components that run in a customer's kernel and hold a customer's data. If we want kernel-level trust, the code that runs there has to be readable.
2026
Multi-tenant SaaS and the analyst console
The managed platform, the attack graph, the coverage matrix, and evidence-grounded triage assistance that has to cite its sources.
How we work
Four working habits
- Say the specific thing
- 'Reduces alert fatigue' means nothing. 'Correlates the mount set with the subsequent exec's device' means something.
- Ship the constraint
- When the honest answer is 'the sensor cannot see that', we say so and we exclude it from the coverage matrix rather than colouring it grey.
- Write it down
- Architectural decisions live in the repository as numbered laws with reasons. Anyone joining should be able to read why, not just what.
- Small on purpose
- We would rather be a small company with an excellent sensor than a large one with a broad portfolio and a mediocre kernel story.
Open source
The sensor (falak-neo-minion) and the core (falak-neo-core) are Apache-2.0, along with the protobuf contract that defines every event on the wire. Read the eBPF that runs in your kernel before you install it — we would.
View on GitHubWorking here
Small team, distributed across Europe and the Levant, with a bias toward people who have carried a pager. We hire slowly and we write a lot down. If kernel-level observability, detection engineering, or making dense interfaces feel calm is your idea of a good problem, we would like to hear from you.
Get in touchCurious how it actually works? Read the architecture guide or our engineering writing.