Products / PERISAI
S.A.L.T CI PERISAI
Cybersecurity intelligence on the organisation's own servers. Reconnaissance, active defence, forensics and compliance in one AI-orchestrated suite, usable by a first-year analyst and faster for a seasoned expert.
Serious security tools, without the expertise barrier
The best security tools are open source and powerful, but each demands deep expertise just to operate. Most organisations cannot staff that expertise, so the tools sit unused while attacks arrive every hour.
Tools need specialists
Scanners, frameworks and forensic suites each have their own commands, outputs and pitfalls.
Findings in silos
Reconnaissance, defence, forensics and compliance live in separate products that do not share evidence.
Compliance by hand
Auditors ask for proof that controls work. Teams assemble screenshots and spreadsheets every year.
One suite for every level of user
| Person | What PERISAI gives them |
|---|---|
| New analyst | Describe the goal in plain language; PERISAI plans the steps, runs them and explains every output |
| Security professional | Full tool access with AI acceleration: chained scans, MITRE ATT&CK mapping and written reports |
| IT and system administrator | Scans, hardening checks and compliance gaps on their own infrastructure, without being a specialist |
| CISO and management | Risk posture, compliance status and board-ready reports generated from live data |
PERISAI in one line
A full-spectrum security intelligence suite on top of the industry's most capable open-source tools, run by AI on the organisation's own servers, and built for air-gapped, classified and sovereign networks.
Find, defend, investigate, prove, command
PERISAI is five connected segments. Each works on its own, and together they pass evidence along the whole security lifecycle.
Survey · observe · scout. Finds exposures before attackers do.
Defend · hold · resist. Detects and blocks attacks in real time.
Trace · track · investigate. Reconstructs what happened.
Comply · adhere · certify. Proves controls with live evidence.
Command · coordinate. One executive view of all four.
PERISAI TINJAU
State an objective in plain language; PERISAI builds the attack chain, runs it and delivers the intelligence.
PERISAI TAHAN
Monitor any number of hosts, detect attack patterns and block sources automatically.
PERISAI JEJAK
From alert to evidence package: timeline, artefacts, attack chain and a written forensic report.
PERISAI PATUH
Map controls to PDPA, ISO 27001, NIST CSF, CIS and ISMS-P, with evidence linked from TAHAN and JEJAK.
Evidence flows forward
A TINJAU finding becomes a TAHAN watch rule; a TAHAN alert escalates into a JEJAK case with full context; JEJAK artefacts and TAHAN blocks become PATUH compliance evidence; the SOC Hub reads all four.
The tools are open source. The intelligence is S.A.L.T CI.
PERISAI places an AI intelligence layer over a curated arsenal of established security tools, so people state intent and PERISAI handles tool choice, sequencing, interpretation and reporting.
Plain language to attack chain
An objective in English or Malay becomes a planned, sequenced chain of tools.
Multi-tool orchestration
Outputs of one stage feed the next automatically.
MITRE ATT&CK mapping
Findings and attacks tagged with tactics and techniques.
Risk scoring
Severity, exposure and context combined into a priority.
Written reports
Assessment, forensic and compliance reports drafted with remediation.
Threat intelligence
Attacker IPs enriched with reputation, origin and history.
Integrated tool arsenal
| Domain | Tools |
|---|---|
| Recon and OSINT | Nmap, Masscan, Amass, Subfinder, theHarvester, DNSrecon, Whois, Shodan |
| Web and vulnerability | Nuclei, Nikto, OWASP ZAP, Burp Suite, Gobuster |
| Exploitation testing | Metasploit, CrackMapExec, Responder, Evil-WinRM, PowerSploit |
| Network defence | Suricata, Zeek, Wireshark, fail2ban, iptables |
| Forensics | Volatility, Autopsy, YARA, Timesketch, strings |
| Threat intel and malware | MITRE ATT&CK, OpenCTI, MISP, Cuckoo Sandbox, VirusTotal |
Tools run in an isolated Kali Linux worker with no public port. Online intelligence services are used only where the organisation allows them.
Find the exposure before an attacker does
TINJAU is an AI-powered reconnaissance console. State the objective in plain language, and it selects the tools, explains each step, runs them and narrates the findings.
Plain-language goal
Chain chosen and sequenced
Services and versions
Enumeration
Known CVEs
Web server checks
Written assessment
AI co-pilot
Interprets intent, picks the tool chain and explains each step in plain English or Malay. No command-line expertise required.
Chain execution engine
Reconnaissance, vulnerability scan, web scan and directory discovery run in sequence, each feeding the next.
Threat level dashboard
Assets scanned, findings by severity from critical to info, and a live feed as tools complete.
Rich assessment report
Findings grouped by type and severity, with CVE explanations, exploitation context and remediation.
Scan history and comparison
Every scan kept; compare runs to track remediation or new exposure over time.
Authorised scope only
Targets are limited to an approved scope list of the organisation's own assets, and every run is recorded.
tinjau › Plan: ports → subdomains → known CVEs → web checks. Target is on the approved scope list.
tinjau › nmap · 6 open services · nginx 1.18 on 443
tinjau › subfinder · 11 subdomains · 2 not in the asset register
tinjau › nuclei · 1 high outdated TLS configuration · 3 medium
tinjau › Report ready: 2 forgotten subdomains and one high finding, with fixes in priority order.
An always-on shield that blocks by itself
TAHAN is a real-time security operations centre. It watches any number of hosts, recognises attack patterns in their logs and blocks the source automatically.
Web, proxy and SSH
Pushed to TAHAN
Decoded and normalised
27+ attack patterns
Reputation and origin
Firewall and proxy deny
Live feed and e-mail
Multi-host monitoring
Web servers, SSH servers, API gateways, AI platforms and databases, each with its own alert stream.
Automated blocking
Sources blocked through firewall rules and reverse-proxy deny lists when thresholds are met, configurable per deployment.
27+ detection rules
SQL injection, XSS, path traversal, command injection, SSH brute force, scanners, admin probes, Shellshock and more.
Real-time alert feed
A live feed filtered by host, severity or rule, with e-mail notification of every block.
Threat intel enrichment
Every attacker IP enriched with reputation, country, network owner and history, cached for speed.
Threat reports
Executive summary, top attackers, alert log and block history, ready for the board or an incident file.
Proven on S.A.L.T CI's own servers
TAHAN defends S.A.L.T CI's own public services. By May 2026 it had handled more than 250,000 live alerts, with over 900,000 more in its archive, and permanently blocked more than 150 attacking sources.
From alert to evidence package
JEJAK is a digital forensics workspace that reconstructs what happened, when and by whom, and produces evidence fit for management, regulators or law enforcement.
Escalated from TAHAN
Logs across hosts
Hash and catalogue
Attack path graph
Tactics identified
Chain of custody
Written forensic report
Timeline reconstruction
First contact, lateral movement, persistence and exfiltration on an interactive timeline.
TAHAN integration
Any TAHAN alert escalates into a case with the original log line, attacker, rules and enrichment.
Artefact cataloguing
Logs, captures, file metadata and system snapshots hashed, time-stamped and linked to custody.
Attack chain graph
The attacker's path across systems, with MITRE ATT&CK tactics labelled throughout.
Evidence packaging
Structured packages with custody records, artefact hashes and analyst sign-off.
AI forensic report
Narrative, root cause, attack chain summary, indicators of compromise and remediation.
Evidence that stays on site
Artefacts are kept in an encrypted evidence vault on the organisation's own servers. Nothing is uploaded to an outside sandbox unless the organisation chooses to.
Compliance proven with live evidence
PATUH maps the organisation's controls to the frameworks it must meet and links real evidence from TAHAN and JEJAK, so compliance is shown, not asserted.
Personal Data Protection Act 2010
ISO/IEC 27001:2022
CSF 2.0: identify to recover
18 critical security controls
Public-sector information security
Further frameworks, such as RMiT for financial institutions, are added as control libraries.
Framework mapping
Controls mapped across frameworks, with pass or fail per control and AI remediation guidance.
Compliance score
An organisation-wide score by domain, framework and risk tier, updated as controls are met.
Live evidence linking
TAHAN alerts, JEJAK artefacts, policies and configurations attached to controls with timestamps.
Control checklist
Status, notes, owners and evidence for every control, with full history.
AI gap analysis
Missing controls and evidence found, with a prioritised roadmap by effort and risk.
Audit export
Board-ready reports and auditor packages: scorecard, evidence index, gaps and trends.
The whole security picture, on one screen
The SOC Hub unifies live intelligence from all four segments into one executive view, built for CISOs, SOC managers and command-level personnel.
AI executive assessment
One click analyses all four segments at once: security posture, active threats and compliance status, with recommendations.
Four command panels
Live figures from TINJAU, TAHAN, JEJAK and PATUH, each linking to its own dashboard.
Offline threat map
Attacker origins geolocated on a self-contained world map. No external map service needed.
Top attackers
A live leaderboard of the most active sources, with country attribution and intensity.
Severity breakdown
Critical, high and medium alerts at a glance, without opening TAHAN.
Ecosystem health
Live health and latency of every segment, refreshed automatically.
How the Hub assembles the picture
Scans, findings, assets
Alerts, severity, attackers
Cases, artefacts
Scores, gaps
Sources to countries
AI command assessment
Security software that is secure itself
PERISAI runs entirely on the organisation's infrastructure, inside the S.A.L.T CI platform, with its tools isolated from the network and its evidence encrypted.
Air-gapped capable
Local models and a local CVE mirror; online intelligence only where allowed.
Isolated tooling
Security tools run in a worker with no public port.
Platform identity
Sign-in, roles and audit through the S.A.L.T CI core.
Any hardware
Containers on the organisation's servers, VMs or private cloud.
Many analysts
Concurrent sessions, and project isolation for multiple clients.
White-label reports
Reports in the organisation's or partner's own brand.
Part of S.A.L.T CI
PERISAI uses the TERAS core for models, identity and audit, and its modules can watch and report on the S.A.L.T CI platform itself.
Works with the platform
TERAS agents can query PERISAI as a tool; S.A.L.T NEXUS operators can act on its findings on the affected servers.
Self-run software
PERISAI is software the organisation's own team runs. Partners can add training, setup and managed support.
One sovereign suite instead of a shelf of tools
PERISAI compared with the usual ways organisations assemble security capability.
| Capability | PERISAI | Separate open-source tools | Cloud security services |
|---|---|---|---|
| Runs on your own servers, air-gapped | Yes | Yes | No |
| Usable without specialist training | Yes, plain-language AI | No | Partly |
| Recon, defence, forensics and compliance together | Yes, five segments | Separate tools | Partly |
| Evidence shared across the lifecycle | Yes | By hand | Partly |
| Malaysian frameworks (PDPA, ISMS-P) | Built in | No | Varies |
| Written reports in English or Malay | Yes | No | Partly |
| Data stays in the country | Yes | Yes | Varies |
Categories describe typical offerings; individual products differ.
Who PERISAI is for
| Market | Typical needs |
|---|---|
| Enterprise security teams | Banks, telcos, utilities, energy, healthcare and manufacturing: cover more ground with fewer people; integrate with an existing SIEM |
| Government and defence | Full air-gap, classified networks, Malay responses, offline CVE data and government frameworks |
| Universities and agencies | Self-run security for the organisation's own team, plus a guided mode for training and CTF exercises |
| Security consultancies | Faster engagements, client project isolation and white-label deliverables |
Part of one sovereign platform
PERISAI runs on the TERAS core with the same sign-in, audit and models as every other S.A.L.T CI application.