ENGINEERING EVIDENCE · FIRST PILOT
Results from the first Lira pilot
Anonymized measurements from the first Lira pilot. They demonstrate real operating load without exposing customers, hosts, accounts or source addresses.
Rolling 30-day period; cumulative blocks shown separately
First Lira pilot only
Data generated: 2026-08-28 13:50 UTC
Latest cached snapshot — generated 2026-08-28 13:50 UTC.
Geography of blocked sources
Country is derived from the network source address. It describes routing geography and does not attribute a person, organization or attacker.
PL24
GB11
NL11
DE10
US8
LT6
RU4
BR3
HU3
KR3
There is not enough aggregated data to publish country distribution.
Publication safeguards
- No IP addresses, hostnames, usernames or customer names
- No per-customer or per-server breakdown
- Five-minute cached aggregate instead of database access from the browser
- Timestamp and reporting period displayed with every snapshot
How the figures are calculated
- The reporting scope is explicitly limited to the first Lira pilot; partner and customer environments are excluded.
- Authentication events are counted as Windows records received during the rolling period. One connection may produce more than one event.
- A blocking decision is a recorded Lira decision with an application time. Unique sources are deduplicated by source address but addresses are never published.
- Authorized sign-ins include successful RDP network and interactive logon records. They demonstrate operational load and are not interpreted as security incidents.
- Country rows are published only when at least three unique blocked sources are present. LAN and unknown locations are excluded.
What these measurements prove
The figures show that Lira processed sustained authentication and blocking workloads during its first pilot. They are operational evidence, not an independent audit, certification or claim that every failed event was a confirmed attack.