All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
North Star Labs sells CyPhER, a sensor that passively records network traffic and detects attacker behavior without matching known attack signatures. The CEO’s speaker biography describes CyPhER installations at MIT Lincoln Labs Supercomputing Center and the Defense Innovation Unit. North Star Labs reports banking and telecom customers. Founded in 2024, it builds CyPhER on a sensor developed at MIT Lincoln Laboratory in an Air Force AI program. SBIR.gov records $1,874,940 in federal small-business research awards, including $1,799,940 from the Air Force to adapt CyPhER for Air Force networks. SBIR.gov lists North Star Labs at three employees. North Star Labs has some protection from copying, because a rival would need its own way to analyze every connection on a large network in real time.
| Description | North Star Labs sells CyPhER, a passive network sensor that records network activity and security logs to detect adversary behavior without signatures, for defense, government, critical infrastructure and enterprise networks. | [f1] |
|---|---|---|
| Founded | 2024 | [f2] |
| HQ | Alexandria, Virginia, US | [f3] |
| Product | What it does |
|---|---|
| CyPhER | Passive network sensor that records traffic at OSI layers 2 to 4 and analyzes security logs, sold as Fusion, Rx, Edge and OT configurations. |
Cyber Defense Matrix
| Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|
| Devices Workstations, servers, phones, tablets, storage, network devices, IoT infrastructure, and similar hardware. | |||||
| Applications Software, interactions, and application flows on the devices. | |||||
| Networks Connections and traffic flowing among devices and apps, plus communication paths. | |||||
| Data Content at rest, in transit, or in use across devices, apps, and networks. | |||||
| Users The people using the devices, apps, networks, and data. |
CyPhER passively records network activity at OSI layers 2 through 4, maps the network from observed traffic, detects adversary behavior, and can run automated responses such as quarantining systems. These capabilities are mapped to the Cyber Defense Matrix. [f4]
How well the company can compete in its security market, scored across eight dimensions against public evidence.
| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. | 3/5 | North Star Labs aims CyPhER at security teams in defense, government, financial services, telecommunications and critical infrastructure. The company argues that SOC tools produce probability, leaving analysts signals they can neither confirm nor refute. In an ExecutiveBiz interview, CEO Mitchell Sipus says CISOs at major financial institutions increasingly raise dwell time. The buyer and the problem are clear, and the pain is quantified only in the company’s own figures. [s1, s18, s3] |
| Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs and third-party validation. | 3/5 | On its FAQ pages, North Star Labs describes passive capture at OSI layers 2 through 4 and signature-free detection. In its STTR award abstract on SBIR.gov, the company rates the sensor at Technology Readiness Level 5-6. It reports there that tests by MIT and the company found the sensor at least 200X faster than market solutions. No cited third party evaluated those results, so the detail is concrete and documented by the company. [s3, s2, s15, s4] |
| Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. | 4/5 | Two kinds of buyer-side signal fall within roughly the last year. SBIR.gov records a $1,799,940 Air Force STTR Phase II award for the CyPhER network sensor that started September 5, 2025, money committed to turn research code into a commercial product. The Potomac Officers Club cites a 2027 deadline for defense systems to become zero-trust compliant. The signals are government-heavy, and commercial urgency rests on the CEO's own account. [s15, s19, s18] |
| Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. | 3/5 | According to SBIR.gov, CEO Mitchell Sipus is principal investigator on the Air Force STTR award. ExecutiveBiz reports he was a White House Presidential Innovation Fellow. An Art Academy of Cincinnati feature reports he founded a data consultancy in 2007 and an AI startup in 2013. His speaker biography adds a TulcoLabs exit and an early CalypsoAI role, and no independent cited source confirms either. The record shows relevant experience without a corroborated in-domain exit. [s15, s18, s21, s20] |
| GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. | 3/5 | The $1,799,940 Air Force STTR Phase II award on SBIR.gov is a contract to adapt CyPhER for Air Force networks. It is a relationship documented outside the company’s pages. The company says it also has commercial customers in telecommunications and banking, and the cited record names none of them. It lists a Defense Innovation Unit deployment and 16th Air Force validation on its own pages. One named government contract, without independent corroboration of commercial scale, fits this level. [s15, s2, s5, s14] |
| Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. | 3/5 | SBIR.gov records $1,874,940 in federal SBIR and STTR awards, and the cited sources state no other capital amount. Against that, North Star Labs offers CyPhER in four configurations and runs low-fee 30-day trials. The cited record discloses no equity round, revenue or customer growth. The awards look proportional to an early company turning federal research into a product, and efficiency is unconfirmed. [s16, s15, s2, s12] |
| Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. | 3/5 | North Star Labs calls CyPhER a network sensing platform. It says the market’s existing labels each describe only part of it. On its comparisons FAQ, the company contrasts CyPhER with behavioral AI tools, OT inventory platforms and named vendors. Buyers can place CyPhER near network detection, and that placement still depends on the company’s explanation. [s2, s8] |
| Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. | 3/5 | North Star Labs builds CyPhER on a sensor first developed at MIT Lincoln Laboratory. It reports compressing observed data up to 75,000x. A competing security vendor would need to reproduce CyPhER’s algebraic analysis of complete network traffic in real time. CyPhER Fusion groups alerts inside Microsoft Defender, so Microsoft could add a similar function. The cited record shows no retained cross-customer data, because the company says customer data never reaches it. [s15, s3, s4, s2] |
North Star Labs sells to security teams that cannot confirm what their tools report. The company argues that every SOC tool produces probability. Analysts then triage signals they can neither confirm nor refute, the company says, because the evidence was never captured.
The company ties that problem to sampled network data and long attacker dwell time. North Star Labs says full-fidelity capture removes the sampling blind spots that make probabilistic detection unavoidable. In an ExecutiveBiz interview, CEO Mitchell Sipus says CISOs at major financial institutions ask how long a vulnerability has existed.
North Star Labs names large network operators as target buyers. It says banks and capital markets infrastructure face stakes that do not tolerate machine-speed compromise. It says carrier-scale traffic exceeds the capacity of sampled telemetry, and it counts AI data centers among critical infrastructure targets. [s1, s18]
CyPhER is a passive network sensor that records network activity at OSI layers 2 through 4. North Star Labs says CyPhER identifies reconnaissance, lateral movement, beaconing and staging without signatures or endpoint agents. The company says its detection works from communication behavior, so encryption leaves the analyzed traffic patterns visible.
North Star Labs delivers CyPhER in four configurations. Fusion analyzes existing alert and log volume, and Rx analyzes live traffic. Edge deploys at the switch, and OT runs on equipment such as programmable logic controllers. CyPhER Fusion runs inside Microsoft Defender, grouping related alerts and returning one finding to the Defender console.
North Star Labs says it builds CyPhER’s analysis on algebra rather than trained neural networks. The company reports compressing observed data up to 75,000x, which lets CyPhER run on low compute and storage. CyPhER can execute responses automatically, such as quarantining implicated systems, or hand them to an analyst. [s3, s2, s4]
North Star Labs positions CyPhER as a record of network activity that other security tools consume. It calls CyPhER a network sensing platform and says the market’s existing labels each describe only part of it. The company says CyPhER does not replace a SIEM and supplies ground truth to the rest of the stack.
North Star Labs publishes FAQ answers on how CyPhER differs from named vendors. The vendors it names include Darktrace, Corelight, Vectra AI, ExtraHop, Claroty, Nozomi Networks, Dragos and Armis. The same FAQ also addresses behavioral AI network tools and OT asset inventory platforms as categories.
North Star Labs differentiates mainly on detection method. It says behavioral AI tools learn a statistical model of normal behavior and alert on deviation. CyPhER instead builds a complete record and reasons deterministically over it, the company says. [s2, s9, s8]
The Air Force STTR Phase II award is a relationship documented outside North Star Labs’ own pages. It is a contract to adapt CyPhER for Air Force networks. According to SBIR.gov, the award is worth $1,799,940 under contract FA8649-25-P-0497. It runs from September 5, 2025 to June 7, 2027. In the abstract, North Star Labs cites support from units including the 16th Air Force.
North Star Labs claims broader traction on its own pages. It says it has commercial customers in telecommunications and banking and critical infrastructure customers in water, transportation and freight. On its government page, the company lists a Defense Innovation Unit deployment and 16th Air Force operational validation. The cited record names none of the commercial customers.
North Star Labs sells through federal acquisition paths and partners. It tells agencies they can deploy CyPhER through SBIR Phase III sole-source authority without new competition. It describes reseller and referral structures with tiered economics on its partners page.
ExecutiveBiz reports that the company avoided typical startup press releases after its 2024 founding. It called Sipus’ May 2026 Potomac Officers Club appearance the company’s public breakout moment in government contracting. [s15, s2, s5, s7, s18]
Mitchell Sipus leads North Star Labs as founder and CEO and is principal investigator on its Air Force STTR award. SBIR.gov lists Jenafer Howard as the award’s business contact. Sipus moderated a panel on advanced persistent threats at the Potomac Officers Club’s 2026 Cyber Summit.
Sipus’ background is in government data and AI work. ExecutiveBiz reports he was a White House Presidential Innovation Fellow. It also reports he expanded a data collection business into Afghanistan, Somalia, Iraq and Syria. An Art Academy of Cincinnati feature reports he founded the government mapping and data consultancy SSR+D in 2007 and the AI startup Symkala in 2013.
Sipus’ Potomac Officers Club speaker biography is the cited source for two further claims. By that account, he was CalypsoAI’s first hire and co-founded TulcoLabs, which Acrisure Insurance acquired in 2020 for $420 million. North Star Labs says its staff includes MIT Lincoln Laboratory, Carnegie Mellon CyLab and Air Force Research Laboratory alumni. [s15, s19, s18, s21, s20, s13]
North Star Labs presents CyPhER’s on-premises design as its main data protection control. It says CyPhER installs inside the customer’s environment and all analysis happens there. The company says it receives none of the customer’s network data or findings.
North Star Labs describes its SOC 2 position as architectural. It says it upholds SOC 2 requirements through its architecture, without a hosted-service attestation. No public trust center or attestation report appears on the probed surfaces.
North Star Labs says CyPhER supports NIST 800-53 Revision 5 and the Risk Management Framework. It also says CyPhER is deployed in government Top Secret and Controlled Unclassified Information environments. No cited government record names an authorization for CyPhER. [s2, s10, s11, s9]
| Company | Relationship | Note | Compare |
|---|---|---|---|
| Darktrace | competes with | North Star Labs answers how CyPhER differs from it in its comparisons FAQ. | N/AWe captured the evidence for these companies under different evidence-model versions (v1 vs v2), so the totals were scored under different conditions and are not directly comparable. |
| Corelight | competes with | North Star Labs answers how CyPhER differs from it in its comparisons FAQ. | |
| Vectra AI | competes with | North Star Labs answers how CyPhER differs from it in its comparisons FAQ. | |
| ExtraHop | competes with | North Star Labs answers how CyPhER differs from it in its comparisons FAQ. | |
| Claroty | competes with | North Star Labs answers how CyPhER differs from it in its comparisons FAQ. | |
| Nozomi Networks | competes with | North Star Labs answers how CyPhER differs from it in its comparisons FAQ. | |
| Dragos | competes with | North Star Labs answers how CyPhER differs from it in its comparisons FAQ. | N/AWe captured the evidence for these companies under different evidence-model versions (v1 vs v2), so the totals were scored under different conditions and are not directly comparable. |
Add analyzed competitors to compare them side by side with North Star Labs.
A closer look at the company's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.
reinforce or reposition
North Star Labs licenses CyPhER as software that customers install and run on their own networks. CyPhER analyzes complete network traffic with algebraic methods, and the sensor began as MIT Lincoln Laboratory research. Governments and regulated network operators are its target buyers. An Air Force research and transition contract is a government relationship recorded outside the company’s own pages. The company says customer data never reaches it. A departing customer would disconnect CyPhER from its SIEM and Microsoft Defender and keep its own record of network activity.
| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. | 1/3 | North Star Labs licenses CyPhER to scale with the environment it observes and runs paid trials on customer data. The customer installs and operates CyPhER on premises and keeps the findings. That is software sold as the product. |
| Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. | 2/3 | CyPhER pushes findings into the customer’s SIEM and Defender console and can run responses through existing enforcement tooling. Leaving means removing a passive sensor and those integrations, and the customer keeps its own record. The cited record describes passive traffic observation and automated responses through existing enforcement tools. It shows no network effect or regulatory tie and does not size a migration. |
| Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. | 1/3 | North Star Labs says it upholds SOC 2 through its architecturerather than through a hosted-service attestation. A probe found no public attestation report. The company says CyPhER runs in Top Secret and CUI environments, and no cited record names an authorization for it. A funded competitor could meet these requirements through ordinary preparation. |
| Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. | 3/3 | CyPhER analyzes complete network traffic at OSI layers 2 through 4 with algebraic methods, live traffic included. The sensor began as MIT Lincoln Laboratory research, and North Star Labs rates it at Technology Readiness Level 5-6. Analyzing full traffic in real time at network scale is real-time systems work that takes specialized expertise. |
| Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. | 3/3 | North Star Labs builds and sells CyPhER for defense agencies, banks, telecommunications carriers and critical infrastructure operators. The Air Force funds CyPhER’s research and transition through an STTR award recorded on SBIR.gov. Governments and regulated enterprises are the buyer class CyPhER is built and sold for. |
| Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. | 2/3 | CyPhER’s passive sensing observes copies of traffic at mirror or tap points, and Fusion runs nothing inline. It sends findings to the customer’s SIEM and can trigger responses through existing enforcement tools, across four configurations. That is a platform with application features, and the customer’s traffic does not pass through it. |
| Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. | 1/3 | North Star Labs says it owns the intellectual property in CyPhER, including rights from its STTR work. It also holds a registered service mark. The company also says customer network data and findings never reach it. The cited record names no patent, licensed content or dataset the company retains. |
North Star Labs sells to defense and government agencies and to operators of large commercial networks. It names AI data centers, financial institutions and telecommunications providers as customer types. It says its commercial customers are in telecommunications and banking, with critical infrastructure operators in water, transportation and freight.
Government work is the segment with outside evidence, through the Air Force STTR award recorded on SBIR.gov. North Star Labs’ government mission areas include DoD defensive cyber operations, OT and ICS, space systems and intelligence work. On its space page, the company says it is engaging Space Force program offices, defense space programs and commercial operators.
CyPhER’s method is algebraic analysis of a complete record of network traffic. North Star Labs says it builds CyPhER’s analysis on algebra rather than trained neural networks. Sipus told ExecutiveBiz that the company can translate an entire network into linear algebra.
The sensor began as MIT Lincoln Laboratory research. According to the STTR abstract, CyPhER began in an Air Force AI Accelerator project at MIT Lincoln Laboratory. North Star Labs reports compressing observed data up to 75,000x. It also reports that tests by MIT and North Star Labs found CyPhER at least 200X faster than market solutions.
North Star Labs’ documented route to market runs from federal research awards to direct agency purchases. According to SBIR.gov, it has won an Air Force SBIR Phase I award and a $1,799,940 STTR Phase II award. The company tells agencies they can deploy CyPhER through SBIR Phase III sole-source authority without new competition.
Commercial sales start with an evaluation on the customer’s own data. North Star Labs runs a 30-day trial at a low fee tied to an agreed performance indicator. It describes reseller, referral and federal distribution channels and names Microsoft Defender as its lead integration through CyPhER Fusion.
North Star Labs prices CyPhER by environment scale and configuration and scopes each deal against the customer’s network. It licenses CyPhER to scale with the environment it observes. The 30-day trial carries a low fee that is credited toward a license if the customer proceeds.
Government buyers have a sole-source route through SBIR Phase III authority. Under acquisition on its government page, North Star Labs lists Carahsoft, NASA SEWP and GSA MAS among its purchasing paths.
CyPhER runs on the customer’s premises. North Star Labs says CyPhER’s passive sensing connects to existing mirror or tap points and installs nothing on customer equipment. It can also run air-gapped, and the Edge and OT configurations deploy at the switch and on operational equipment. CyPhER Fusion installs on a standard server and reads Microsoft Defender alerts without a network tap, agents or inline components.
The customer keeps the data CyPhER produces. North Star Labs says it receives none of the customer’s network data or findings. It says the record stays with the customer if the customer stops working with the company. North Star Labs is hiring a forward deployed engineer, according to its careers page.
North Star Labs addresses compliance through CyPhER’s on-premises design. It says it upholds SOC 2 requirements through its architecture, without a hosted-service attestation. No public trust center or attestation report appears on the probed surfaces.
North Star Labs says CyPhER supports NIST 800-53 Revision 5 and runs in Top Secret and Controlled Unclassified Information environments. The USPTO registered the NORTH STAR LABS service mark to North Star Labs LLC, a Virginia limited liability company.
CyPhER sends its findings into tools security teams already run. North Star Labs says CyPhER pushes consolidated threat events into the customer’s SIEM. Fusion returns findings to the Microsoft Defender console. The company describes integration paths across XDR, SIEM and SOAR categories on its partners page.
North Star Labs keeps analysts in the tools they already use. It says findings arrive in the same SIEM queue analysts already work. Automated responses run through the customer’s existing enforcement tooling, according to the company.
Mitchell Sipus is founder and CEO and principal investigator on the Air Force award. SBIR.gov lists Jenafer Howard as the award’s business contact. ExecutiveBiz reports Sipus was a White House Presidential Innovation Fellow. An Art Academy of Cincinnati feature reports his Carnegie Mellon PhD work.
North Star Labs’ research ties run through named institutions. The company describes joint research with MIT Lincoln Laboratory through the DAF-MIT AI Accelerator. It reports subcontract work under DARPA research programs.
| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | North Star Labs: homepage | official | 2026-10-16 |
| f2 | ExecutiveBiz: Executive Spotlight interview with Mitchell Sipus by Pat Host | press | 2026-10-16 |
| f3 | North Star Labs: FAQ, About North Star Labs | official | 2026-10-16 |
| f4 | North Star Labs: FAQ, About CyPhER | official | 2026-10-16 |
This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.
The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.
Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.
The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.
To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.
Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.
Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.