Our security is publicly verifiable.
GladiusDefense is the detection engine running on every gladiuscrm.com request. Its score on our published benchmark — and its false-positive rate on simulated production traffic — are both measurable, reproducible, and below this page. You don't have to take our word for any of it.
Verify this yourself
Our benchmark is open-source. The fingerprint c564a85883ab96b1 is a SHA-1 over (scenario_id : detected : remediated) for the suite. Identical inputs → identical fingerprint. Run it:
npx @gladius/bench --verify-claim=c564a85883ab96b1
# → {"verification":"MATCH","externalIqScore":236,"grade":"S"}The benchmark is Apache 2.0. The proprietary detection engine ships separately under a commercial license — you run the eval; we run the engine.
What we measure
9-tier difficulty ladder
easy (weight 1) through transcendent (weight 256). A perfect score on easy/medium scenarios with zero legendary+ catches caps at C grade.
Adversarial mutation survival
5,600 mutations per run (40 base attacks × 7 strategies × 20 mutations). Tests whether rules still catch the attack after an adversary iterates. Current: 89.3%.
Behavioral anomaly sensor
8 detectors: timing anomalies, mechanical jitter, circadian shifts, zero-dwell forms, keystroke biometric mismatch, cold-then-burst, pixel-perfect-mouse, path enumeration. Current: 100%.
FP discipline on benign traffic
Audited against 5,000-row synthetic prod log mimicking dealership traffic: dashboard, marketing, webhooks, OAuth, dealer names with apostrophes (Bob's Honda of Tampa). Zero false positives.
Our public commitments
- ReproducibilityEvery published score includes a deterministic fingerprint. Anyone with the repo can verify it in < 60 seconds.
- Open benchmarkThe 911-scenario suite, 7-strategy mutation harness, and 8-detector behavior sensor are Apache 2.0. We benchmark our engine the same way we benchmark anyone else's.
- CVE adaptationOur threat-intel pipeline pulls CISA-KEV + NVD + GHSA every 6 hours, synthesizes rules automatically, FP-gates against benign anchors, auto-activates if confidence + severity thresholds pass. Median CVE-to-rule latency published at
/security/latency(live data once dev DB wired). - External validationThird-party red-team engagement Q3 2026. Their report (findings + executive summary) will be linked here when delivered.
- Responsible disclosureSecurity researchers: email security@gladiuscrm.com with findings. 72-hour acknowledgment. 90-day disclosure window. Bounties for verified findings are planned for late 2026.
What this page does NOT claim
- • The 0% FP rate is measured on synthetic production traffic. Real customer logs may surface FP categories the synth doesn't model. We'll publish a real-traffic audit when 24h of access logs have been processed.
- • A 236/240 score means our engine catches what the benchmark probes. New attack classes appear constantly; we ship rules continuously, but no engine is permanently complete.
- • Stateful detection (multi-request attack chains, behavioral anomalies) is wired into the production hot path but currently runs in observe-only mode (header signal, no block). Active enforcement enables Q3 2026.
2026-06-02 · Last updated: